Edit tour

Windows Analysis Report
ceFgl3jkkk.exe

Overview

General Information

Sample name:	ceFgl3jkkk.exe renamed because original name is a hash value
Original sample name:	857270428d9d88c5da6d8b9d33059d4e29347637879a17975631408c5359b623.exe
Analysis ID:	1560168
MD5:	9cf2fcabd10ee683a3652815014b368c
SHA1:	f49914f1cf2b7fbba812eb8fd807b19065008b23
SHA256:	857270428d9d88c5da6d8b9d33059d4e29347637879a17975631408c5359b623
Tags:	77-105-161-194exeuser-JAMESWT_MHT
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found pyInstaller with non standard icon

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

ceFgl3jkkk.exe (PID: 824 cmdline: "C:\Users\user\Desktop\ceFgl3jkkk.exe" MD5: 9CF2FCABD10EE683A3652815014B368C)

ceFgl3jkkk.exe (PID: 7008 cmdline: "C:\Users\user\Desktop\ceFgl3jkkk.exe" MD5: 9CF2FCABD10EE683A3652815014B368C)

ngentask.exe (PID: 2976 cmdline: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngentask.exe MD5: AE933850C93D3B3001AB21BB65C3EFA1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["drawwyobstacw.sbs", "resinedyw.sbs", "mathcucom.sbs", "vennurviot.sbs", "allocatinow.sbs", "droppyrelivei.cfd", "condifendteu.sbs", "ehticsprocw.sbs", "enlargkiw.sbs"], "Build id": "DtiPjR--NashTraff"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T13:45:26.060652+0100	2028371	3	Unknown Traffic	192.168.2.9	49765	104.102.49.254	443	TCP
2024-11-21T13:45:28.616606+0100	2028371	3	Unknown Traffic	192.168.2.9	49776	188.114.97.3	443	TCP
2024-11-21T13:45:29.977517+0100	2028371	3	Unknown Traffic	192.168.2.9	49780	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T13:45:29.330441+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49776	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T13:45:29.330441+0100	2049836	1	A Network Trojan was detected	192.168.2.9	49776	188.114.97.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T13:45:28.616606+0100	2057416	1	Domain Observed Used for C2 Detected	192.168.2.9	49776	188.114.97.3	443	TCP
2024-11-21T13:45:29.977517+0100	2057416	1	Domain Observed Used for C2 Detected	192.168.2.9	49780	188.114.97.3	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (allocatinow .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T13:45:22.503700+0100	2056568	1	Domain Observed Used for C2 Detected	192.168.2.9	64895	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (condifendteu .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T13:45:23.786678+0100	2056558	1	Domain Observed Used for C2 Detected	192.168.2.9	49306	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawwyobstacw .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T13:45:24.034227+0100	2056556	1	Domain Observed Used for C2 Detected	192.168.2.9	61384	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ehticsprocw .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T13:45:23.539228+0100	2056560	1	Domain Observed Used for C2 Detected	192.168.2.9	60602	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (enlargkiw .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T13:45:22.773752+0100	2056566	1	Domain Observed Used for C2 Detected	192.168.2.9	61039	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (marshal-zhukov .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T13:45:27.114029+0100	2057415	1	Domain Observed Used for C2 Detected	192.168.2.9	63122	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mathcucom .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T13:45:22.256926+0100	2056570	1	Domain Observed Used for C2 Detected	192.168.2.9	57919	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (resinedyw .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T13:45:23.031762+0100	2056564	1	Domain Observed Used for C2 Detected	192.168.2.9	59111	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vennurviot .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T13:45:23.292257+0100	2056562	1	Domain Observed Used for C2 Detected	192.168.2.9	53627	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T13:45:26.878290+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.9	49765	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ceFgl3jkkk.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://marshal-zhukov.com/api)	Avira URL Cloud: Label: malware
Source: https://marshal-zhukov.com/apis	Avira URL Cloud: Label: malware
Source: droppyrelivei.cfd	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["drawwyobstacw.sbs", "resinedyw.sbs", "mathcucom.sbs", "vennurviot.sbs", "allocatinow.sbs", "droppyrelivei.cfd", "condifendteu.sbs", "ehticsprocw.sbs", "enlargkiw.sbs"], "Build id": "DtiPjR--NashTraff"}

Multi AV Scanner detection for submitted file

Source: ceFgl3jkkk.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: ceFgl3jkkk.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String decryptor: drawwyobstacw.sbs
Source: 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String decryptor: condifendteu.sbs
Source: 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String decryptor: ehticsprocw.sbs
Source: 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String decryptor: vennurviot.sbs
Source: 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String decryptor: resinedyw.sbs
Source: 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String decryptor: enlargkiw.sbs
Source: 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String decryptor: allocatinow.sbs
Source: 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String decryptor: mathcucom.sbs
Source: 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String decryptor: droppyrelivei.cfd
Source: 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String decryptor: DtiPjR--NashTraff

Source: ceFgl3jkkk.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.9:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.9:49776 version: TLS 1.2

Source: ceFgl3jkkk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\win32\_multiprocessing.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_uuid.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _uuid.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_decimal.pdb%% source: ceFgl3jkkk.exe, 00000000.00000003.1497263952.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_lzma.pdbOO source: ceFgl3jkkk.exe, 00000000.00000003.1497870502.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: libssl-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_ssl.pdb source: _ssl.pyd.0.dr
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdbAA source: libssl-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_lzma.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1497870502.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_queue.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1498233789.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _queue.pyd.0.dr
Source:	Binary string: d:\a01\_work\2\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_overlapped.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1498125097.00000000006CD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\pyexpat.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1500128542.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, pyexpat.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_bz2.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1496897214.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\select.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_ctypes.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1497059480.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 1.1.1l 24 Aug 2021built on: Thu Aug 26 18:55:02 2021 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-1_1"not available source: libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\python39.pdb source: python39.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_asyncio.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1496140740.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _asyncio.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_decimal.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1497263952.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_hashlib.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1497503094.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\unicodedata.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, unicodedata.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_socket.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1498335139.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: libcrypto-1_1.dll.0.dr

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 0_2_00F603E2 FindFirstFileExW,GetLastError,FindNextFileW,GetLastError,	0_2_00F603E2
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 0_2_00F699B3 FindFirstFileExW,	0_2_00F699B3
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 2_2_00F699B3 FindFirstFileExW,	2_2_00F699B3
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 2_2_00F603E2 FindFirstFileExW,GetLastError,FindNextFileW,GetLastError,	2_2_00F603E2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 4E7D7006h	3_2_004410DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+02h]	3_2_0041032C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-000000BEh]	3_2_0040D330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 27BAF212h	3_2_0044082D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov edi, ecx	3_2_0040F882
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042F04C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov byte ptr [edx], cl	3_2_0042F04C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov dword ptr [eax+ebx], 30303030h	3_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov dword ptr [eax+ebx], 20202020h	3_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_004240E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+299316FDh]	3_2_004440F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	3_2_0042E080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov word ptr [edi], dx	3_2_0040C150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 731CDBF3h	3_2_0043E100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 07E776F1h	3_2_0042D13C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 07E776F1h	3_2_0042D13C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-15FF4FD1h]	3_2_004411C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+08h]	3_2_0040F1A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edx+40h]	3_2_004292C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov byte ptr [eax+ebx], 00000030h	3_2_004012D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 07E776F1h	3_2_0042B2AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov dword ptr [0044FE84h], esi	3_2_00441322
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov edi, dword ptr [esi+04h]	3_2_0042F339
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov byte ptr [edi], dl	3_2_0042F339
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov byte ptr [edi], dl	3_2_0042F339
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042F339
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-352DC610h]	3_2_0042C442
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0042C442
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+72E893D5h]	3_2_0041D44C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], C85F7986h	3_2_0043D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_004374E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 07E776F1h	3_2_004124A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov ebx, eax	3_2_0040A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov ebp, eax	3_2_0040A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov byte ptr [edi], dl	3_2_0042F5E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov byte ptr [edi], dl	3_2_0042F5E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042F5E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_0042D590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov ebx, dword ptr [esp]	3_2_0042C5B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 03BA5404h	3_2_0043D6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+608185C2h]	3_2_004226F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+04h]	3_2_004226F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+72E892F9h]	3_2_0041D68E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	3_2_0041D68E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov byte ptr [edx], al	3_2_00430698
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov byte ptr [edx], al	3_2_00430698
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi-41CF7017h]	3_2_004106BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 07E776F1h	3_2_0042B76F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-659232DCh]	3_2_0041F860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_0041F860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp di, 005Ch	3_2_0041F860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 07E776F1h	3_2_0043D820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0040D830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi+25h]	3_2_00408890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	3_2_0042B8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	3_2_0043E8B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+299316FDh]	3_2_00444930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0042FA6E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	3_2_00425AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 1CBB9425h	3_2_00441A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 07E776F1h	3_2_00441A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then jmp eax	3_2_0041EB05
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 62429966h	3_2_0043DB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0040EB29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	3_2_0041DBCE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	3_2_0042DBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then add edi, 02h	3_2_0042DBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	3_2_0042BCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov ecx, edx	3_2_00420C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov byte ptr [edx], al	3_2_00430C1E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_00430C1E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+72E892D9h]	3_2_0043EC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], F3285E74h	3_2_0043EC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 731CDBF3h	3_2_0043EC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	3_2_00429C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then jmp eax	3_2_0042CC8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 07E776F1h	3_2_0042CC8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	3_2_00404CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	3_2_0042BCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	3_2_00405D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then mov esi, eax	3_2_00425D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 7B3AFDABh	3_2_0043DD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+72E89391h]	3_2_00421D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ebp+1C76AA82h]	3_2_0040DE20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	3_2_0041DED1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	3_2_0043BEE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then movzx edi, byte ptr [esp+esi+10h]	3_2_0042BF7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	3_2_00443FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 64567875h	3_2_0043DFA0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056564 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (resinedyw .sbs) : 192.168.2.9:59111 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056556 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawwyobstacw .sbs) : 192.168.2.9:61384 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056562 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vennurviot .sbs) : 192.168.2.9:53627 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056560 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ehticsprocw .sbs) : 192.168.2.9:60602 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057416 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI) : 192.168.2.9:49776 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2056570 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mathcucom .sbs) : 192.168.2.9:57919 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056568 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (allocatinow .sbs) : 192.168.2.9:64895 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056566 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (enlargkiw .sbs) : 192.168.2.9:61039 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057415 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (marshal-zhukov .com) : 192.168.2.9:63122 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057416 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI) : 192.168.2.9:49780 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2056558 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (condifendteu .sbs) : 192.168.2.9:49306 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49776 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49776 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.9:49765 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: drawwyobstacw.sbs
Source: Malware configuration extractor	URLs: resinedyw.sbs
Source: Malware configuration extractor	URLs: mathcucom.sbs
Source: Malware configuration extractor	URLs: vennurviot.sbs
Source: Malware configuration extractor	URLs: allocatinow.sbs
Source: Malware configuration extractor	URLs: droppyrelivei.cfd
Source: Malware configuration extractor	URLs: condifendteu.sbs
Source: Malware configuration extractor	URLs: ehticsprocw.sbs
Source: Malware configuration extractor	URLs: enlargkiw.sbs

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49776 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49780 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49765 -> 104.102.49.254:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: marshal-zhukov.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: global traffic	DNS traffic detected: DNS query: droppyrelivei.cfd
Source: global traffic	DNS traffic detected: DNS query: mathcucom.sbs
Source: global traffic	DNS traffic detected: DNS query: allocatinow.sbs
Source: global traffic	DNS traffic detected: DNS query: enlargkiw.sbs
Source: global traffic	DNS traffic detected: DNS query: resinedyw.sbs
Source: global traffic	DNS traffic detected: DNS query: vennurviot.sbs
Source: global traffic	DNS traffic detected: DNS query: ehticsprocw.sbs
Source: global traffic	DNS traffic detected: DNS query: condifendteu.sbs
Source: global traffic	DNS traffic detected: DNS query: drawwyobstacw.sbs
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: marshal-zhukov.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: marshal-zhukov.com

Source: ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498477157.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498335139.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497263952.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500128542.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497870502.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499874700.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500855304.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498125097.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499609486.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498233789.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496897214.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497059480.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: ceFgl3jkkk.exe, 00000000.00000003.1498335139.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2Assured
Source: ceFgl3jkkk.exe, 00000000.00000003.1498125097.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredI
Source: ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498477157.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498335139.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497263952.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500128542.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497870502.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499874700.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500855304.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498125097.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499609486.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498233789.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497059480.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496140740.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497503094.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: ceFgl3jkkk.exe, 00000000.00000003.1498477157.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498335139.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497263952.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500128542.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497870502.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499874700.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500855304.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498125097.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498233789.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496897214.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497059480.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496140740.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497503094.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: ceFgl3jkkk.exe, 00000000.00000003.1499609486.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: ceFgl3jkkk.exe, 00000000.00000003.1498335139.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498125097.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497059480.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digi
Source: ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498477157.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498335139.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497263952.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500128542.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497870502.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499874700.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500855304.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498125097.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499609486.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498233789.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496897214.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497059480.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498233789.00000000006DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: ceFgl3jkkk.exe, 00000000.00000003.1498477157.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498335139.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497263952.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500128542.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497870502.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499874700.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500855304.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498125097.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498233789.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496897214.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497059480.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498233789.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496140740.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498477157.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498335139.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497263952.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500128542.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497870502.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499874700.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500855304.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498125097.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499609486.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498233789.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496897214.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497059480.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496140740.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: ceFgl3jkkk.exe, 00000000.00000003.1498477157.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498335139.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497263952.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500128542.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497870502.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499874700.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500855304.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498125097.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498233789.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496897214.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497059480.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496140740.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497503094.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digice
Source: ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498477157.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498335139.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497263952.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500128542.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497870502.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499874700.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500855304.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498125097.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499609486.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498233789.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496897214.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497059480.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498477157.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498335139.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497263952.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500128542.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497870502.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499874700.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500855304.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498125097.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499609486.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498233789.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496897214.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497059480.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496140740.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497503094.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: ceFgl3jkkk.exe, 00000000.00000003.1498477157.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498335139.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497263952.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500128542.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497870502.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499874700.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500855304.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498125097.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498233789.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496897214.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497059480.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496140740.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497503094.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498477157.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498335139.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497263952.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500128542.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497870502.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499874700.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500855304.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498125097.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499609486.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498233789.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496897214.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497059480.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498477157.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498335139.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497263952.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500128542.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497870502.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499874700.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500855304.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498125097.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499609486.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498233789.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496897214.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497059480.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496140740.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497503094.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: ceFgl3jkkk.exe, 00000000.00000003.1498477157.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498335139.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497263952.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500128542.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497870502.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499874700.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500855304.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498125097.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498233789.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496897214.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497059480.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496140740.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497503094.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: ceFgl3jkkk.exe, 00000000.00000003.1499609486.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: ngentask.exe, 00000003.00000002.1613429184.00000000013A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: ngentask.exe, 00000003.00000002.1613155400.0000000001312000.00000004.00000020.00020000.00000000.sdmp, ngentask.exe, 00000003.00000002.1613429184.00000000013A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: ngentask.exe, 00000003.00000002.1613429184.00000000013A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: ceFgl3jkkk.exe, 00000000.00000003.1499609486.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: ceFgl3jkkk.exe, 00000000.00000003.1499609486.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: ceFgl3jkkk.exe, 00000000.00000003.1499609486.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: ceFgl3jkkk.exe, 00000000.00000003.1498477157.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498335139.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497263952.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500128542.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497870502.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499874700.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500855304.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498125097.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498233789.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496897214.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497059480.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496140740.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497503094.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: ceFgl3jkkk.exe, 00000002.00000002.1548717939.0000000003430000.00000004.00001000.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1523747536.0000000003311000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1523600484.00000000032E3000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1523686303.00000000032F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://auscitte.github.io/systems%20blog/Exception-Directory-pefile#implementation-details
Source: ngentask.exe, 00000003.00000002.1613155400.0000000001312000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstati
Source: ngentask.exe, 00000003.00000002.1613155400.0000000001312000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.co
Source: ngentask.exe, 00000003.00000002.1613155400.0000000001312000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/im
Source: ngentask.exe, 00000003.00000002.1613155400.0000000001312000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=id
Source: ngentask.exe, 00000003.00000002.1613155400.0000000001312000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?
Source: ceFgl3jkkk.exe, 00000002.00000003.1505557465.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505286993.0000000000D83000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505789755.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1546530228.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505890825.0000000000D4D000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000002.1547030217.0000000000D4D000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505501911.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1546492928.0000000000D33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: ceFgl3jkkk.exe, 00000002.00000003.1505286993.0000000000D83000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000002.1547815675.0000000002B20000.00000004.00001000.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505501911.0000000000D86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: ceFgl3jkkk.exe, 00000002.00000003.1546492928.0000000000D33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: ceFgl3jkkk.exe, 00000002.00000003.1505557465.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505286993.0000000000D83000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505789755.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1546530228.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505890825.0000000000D4D000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000002.1547030217.0000000000D4D000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505501911.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1546492928.0000000000D33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: ceFgl3jkkk.exe, 00000002.00000003.1505557465.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505286993.0000000000D83000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505789755.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1546530228.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505890825.0000000000D4D000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000002.1547030217.0000000000D4D000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505501911.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1546492928.0000000000D33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: ngentask.exe, 00000003.00000002.1613155400.0000000001312000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/
Source: ngentask.exe, 00000003.00000002.1613322725.0000000001342000.00000004.00000020.00020000.00000000.sdmp, ngentask.exe, 00000003.00000002.1613322725.0000000001347000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api
Source: ngentask.exe, 00000003.00000002.1613322725.0000000001342000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api)
Source: ngentask.exe, 00000003.00000002.1613322725.0000000001347000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apis
Source: python39.dll.0.dr	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: ngentask.exe, 00000003.00000002.1613429184.00000000013A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498477157.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498335139.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497263952.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500128542.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497870502.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499874700.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1500855304.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498125097.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499006621.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1499609486.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498233789.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1496897214.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497059480.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: ceFgl3jkkk.exe, 00000002.00000002.1548717939.0000000003430000.00000004.00001000.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1523747536.0000000003311000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1523600484.00000000032E3000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1523600484.00000000032B1000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1523686303.00000000032F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mandiant.com/resources/blog/tracking-malware-import-hashing
Source: ceFgl3jkkk.exe, 00000002.00000003.1523747536.0000000003311000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1523600484.00000000032E3000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000002.1548099724.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1523686303.00000000032F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ntcore.com/files/richsign.htm
Source: ceFgl3jkkk.exe, 00000000.00000003.1499874700.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr	String found in binary or memory: https://www.openssl.org/H
Source: ceFgl3jkkk.exe, 00000000.00000003.1503202450.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000002.1548042408.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: ceFgl3jkkk.exe, 00000002.00000003.1506886633.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1506725417.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000002.1547469415.0000000000F00000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.9:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.9:49776 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

Code function: 3_2_004348D0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_004348D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

Code function: 3_2_004348D0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_004348D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

Code function: 3_2_00435785 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

3_2_00435785

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 0_2_00F5D1B3	0_2_00F5D1B3
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 0_2_00F592A0	0_2_00F592A0
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 0_2_00F58A40	0_2_00F58A40
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 0_2_00F5D3E5	0_2_00F5D3E5
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 0_2_00F6BBE8	0_2_00F6BBE8
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 0_2_00F56C00	0_2_00F56C00
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 0_2_00F6FD6C	0_2_00F6FD6C
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 0_2_00F576B4	0_2_00F576B4
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 0_2_00F7169D	0_2_00F7169D
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 0_2_00F6FE8C	0_2_00F6FE8C
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 0_2_00F6B750	0_2_00F6B750
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 2_2_00F5D1B3	2_2_00F5D1B3
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 2_2_00F592A0	2_2_00F592A0
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 2_2_00F58A40	2_2_00F58A40
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 2_2_00F5D3E5	2_2_00F5D3E5
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 2_2_00F6BBE8	2_2_00F6BBE8
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 2_2_00F56C00	2_2_00F56C00
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 2_2_00F6FD6C	2_2_00F6FD6C
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 2_2_00F576B4	2_2_00F576B4
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 2_2_00F7169D	2_2_00F7169D
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 2_2_00F6FE8C	2_2_00F6FE8C
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 2_2_00F6B750	2_2_00F6B750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00411210	3_2_00411210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0040D330	3_2_0040D330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0040F882	3_2_0040F882
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00439E03	3_2_00439E03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0042F04C	3_2_0042F04C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00401000	3_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_004240E0	3_2_004240E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00439090	3_2_00439090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0042A14F	3_2_0042A14F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0040C150	3_2_0040C150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0043E100	3_2_0043E100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0040F1A0	3_2_0040F1A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0040B1B0	3_2_0040B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00409270	3_2_00409270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_004292C0	3_2_004292C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_004012D5	3_2_004012D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_004392F0	3_2_004392F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00442350	3_2_00442350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0043A300	3_2_0043A300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00441322	3_2_00441322
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00401328	3_2_00401328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0042F339	3_2_0042F339
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_004263EF	3_2_004263EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00405470	3_2_00405470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_004124A9	3_2_004124A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_004074B0	3_2_004074B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00421500	3_2_00421500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0040A5D0	3_2_0040A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0040B640	3_2_0040B640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_004226F0	3_2_004226F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00430698	3_2_00430698
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0043A6B0	3_2_0043A6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0041F860	3_2_0041F860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00428807	3_2_00428807
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0041683E	3_2_0041683E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_004038E0	3_2_004038E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00408890	3_2_00408890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0042B8A0	3_2_0042B8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00444930	3_2_00444930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0042C9C0	3_2_0042C9C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_004379F9	3_2_004379F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0042AA65	3_2_0042AA65
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0042FA6E	3_2_0042FA6E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00426A12	3_2_00426A12
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00441A90	3_2_00441A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00427B13	3_2_00427B13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0040AB20	3_2_0040AB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0042EBC1	3_2_0042EBC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0041DBCE	3_2_0041DBCE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00432BD0	3_2_00432BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00420C10	3_2_00420C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00430C1E	3_2_00430C1E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0042CC8A	3_2_0042CC8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00426D48	3_2_00426D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00425D50	3_2_00425D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00426D60	3_2_00426D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0040CDD0	3_2_0040CDD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00422D80	3_2_00422D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00421D90	3_2_00421D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00433D95	3_2_00433D95
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0040DE20	3_2_0040DE20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00432E30	3_2_00432E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00407EF0	3_2_00407EF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0042AE82	3_2_0042AE82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00441E90	3_2_00441E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00429F40	3_2_00429F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00426F50	3_2_00426F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00437F7A	3_2_00437F7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_0042BF7F	3_2_0042BF7F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: String function: 0040CBE0 appears 75 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: String function: 0041CB50 appears 172 times
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: String function: 00F687DB appears 58 times
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: String function: 00F59710 appears 44 times
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: String function: 00F52290 appears 194 times
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: String function: 00F5A140 appears 102 times
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: String function: 00F52340 appears 86 times

Source: ceFgl3jkkk.exe, 00000000.00000003.1498477157.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs ceFgl3jkkk.exe
Source: ceFgl3jkkk.exe, 00000000.00000003.1498335139.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs ceFgl3jkkk.exe
Source: ceFgl3jkkk.exe, 00000000.00000003.1497263952.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs ceFgl3jkkk.exe
Source: ceFgl3jkkk.exe, 00000000.00000003.1500128542.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs ceFgl3jkkk.exe
Source: ceFgl3jkkk.exe, 00000000.00000003.1497870502.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs ceFgl3jkkk.exe
Source: ceFgl3jkkk.exe, 00000000.00000003.1499874700.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs ceFgl3jkkk.exe
Source: ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs ceFgl3jkkk.exe
Source: ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs ceFgl3jkkk.exe
Source: ceFgl3jkkk.exe, 00000000.00000003.1498125097.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs ceFgl3jkkk.exe
Source: ceFgl3jkkk.exe, 00000000.00000003.1498233789.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs ceFgl3jkkk.exe
Source: ceFgl3jkkk.exe, 00000000.00000003.1496897214.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs ceFgl3jkkk.exe
Source: ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs ceFgl3jkkk.exe
Source: ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs ceFgl3jkkk.exe
Source: ceFgl3jkkk.exe, 00000000.00000003.1495979955.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs ceFgl3jkkk.exe
Source: ceFgl3jkkk.exe, 00000000.00000003.1497059480.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs ceFgl3jkkk.exe
Source: ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs ceFgl3jkkk.exe
Source: ceFgl3jkkk.exe, 00000000.00000003.1496140740.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs ceFgl3jkkk.exe
Source: ceFgl3jkkk.exe, 00000000.00000003.1497503094.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs ceFgl3jkkk.exe

Source: ceFgl3jkkk.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@5/21@11/2

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe

Code function: 0_2_00F565B0 GetLastError,FormatMessageW,

0_2_00F565B0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

Code function: 3_2_00439BF0 CoCreateInstance,CoCreateInstance,

3_2_00439BF0

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI8242

Jump to behavior

Source: ceFgl3jkkk.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ceFgl3jkkk.exe

ReversingLabs: Detection: 44%

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe

File read: C:\Users\user\Desktop\ceFgl3jkkk.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ceFgl3jkkk.exe "C:\Users\user\Desktop\ceFgl3jkkk.exe"
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Process created: C:\Users\user\Desktop\ceFgl3jkkk.exe "C:\Users\user\Desktop\ceFgl3jkkk.exe"
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngentask.exe
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Process created: C:\Users\user\Desktop\ceFgl3jkkk.exe "C:\Users\user\Desktop\ceFgl3jkkk.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngentask.exe	Jump to behavior

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe

File opened: C:\Users\user\Desktop\pyvenv.cfg

Jump to behavior

Source: ceFgl3jkkk.exe

Static file information: File size 7166290 > 1048576

Source: ceFgl3jkkk.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ceFgl3jkkk.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ceFgl3jkkk.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ceFgl3jkkk.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ceFgl3jkkk.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ceFgl3jkkk.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ceFgl3jkkk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: ceFgl3jkkk.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\win32\_multiprocessing.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1498027498.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_uuid.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1498682200.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _uuid.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_decimal.pdb%% source: ceFgl3jkkk.exe, 00000000.00000003.1497263952.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_lzma.pdbOO source: ceFgl3jkkk.exe, 00000000.00000003.1497870502.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: libssl-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_ssl.pdb source: _ssl.pyd.0.dr
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdbAA source: libssl-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_lzma.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1497870502.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_queue.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1498233789.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _queue.pyd.0.dr
Source:	Binary string: d:\a01\_work\2\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_overlapped.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1498125097.00000000006CD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\pyexpat.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1500128542.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, pyexpat.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_bz2.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1496897214.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\select.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_ctypes.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1497059480.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 1.1.1l 24 Aug 2021built on: Thu Aug 26 18:55:02 2021 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-1_1"not available source: libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\python39.pdb source: python39.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_asyncio.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1496140740.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _asyncio.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_decimal.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1497263952.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_hashlib.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1497503094.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\unicodedata.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1502779320.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, unicodedata.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\win32\_socket.pdb source: ceFgl3jkkk.exe, 00000000.00000003.1498335139.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: libcrypto-1_1.dll.0.dr

Source: ceFgl3jkkk.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ceFgl3jkkk.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ceFgl3jkkk.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ceFgl3jkkk.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ceFgl3jkkk.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: libcrypto-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00449B66 push ds; iretd	3_2_00449B83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00416BE0 pushad ; mov dword ptr [esp], eax	3_2_00416BEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Code function: 3_2_00449C02 push F38BE726h; iretd	3_2_00449C16

Persistence and Installation Behavior

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe

Process created: "C:\Users\user\Desktop\ceFgl3jkkk.exe"

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI8242\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI8242\python39.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI8242\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI8242\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI8242\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI8242\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI8242\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI8242\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI8242\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI8242\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI8242\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI8242\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI8242\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI8242\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI8242\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI8242\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI8242\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI8242\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI8242\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI8242\_socket.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe

Code function: 0_2_00F55270 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00F55270

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI8242\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI8242\python39.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI8242\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI8242\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI8242\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI8242\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI8242\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI8242\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI8242\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI8242\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI8242\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI8242\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI8242\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI8242\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI8242\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI8242\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI8242\_socket.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe

API coverage: 7.2 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe TID: 5948	Thread sleep time: -120000s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe TID: 6080	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 0_2_00F603E2 FindFirstFileExW,GetLastError,FindNextFileW,GetLastError,	0_2_00F603E2
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 0_2_00F699B3 FindFirstFileExW,	0_2_00F699B3
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 2_2_00F699B3 FindFirstFileExW,	2_2_00F699B3
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 2_2_00F603E2 FindFirstFileExW,GetLastError,FindNextFileW,GetLastError,	2_2_00F603E2

Source: ngentask.exe, 00000003.00000002.1613322725.0000000001347000.00000004.00000020.00020000.00000000.sdmp, ngentask.exe, 00000003.00000002.1613155400.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ceFgl3jkkk.exe, 00000002.00000002.1547337183.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1544241363.0000000000DDC000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1517209000.0000000000DDC000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1546386874.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

Code function: 3_2_00440600 LdrInitializeThunk,

3_2_00440600

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe

Code function: 0_2_00F63987 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00F63987

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 0_2_00F6A500 mov eax, dword ptr fs:[00000030h]	0_2_00F6A500
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 0_2_00F627A5 mov eax, dword ptr fs:[00000030h]	0_2_00F627A5
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 2_2_00F6A500 mov eax, dword ptr fs:[00000030h]	2_2_00F6A500
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 2_2_00F627A5 mov eax, dword ptr fs:[00000030h]	2_2_00F627A5

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe

Code function: 0_2_00F6AD03 GetProcessHeap,

0_2_00F6AD03

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 0_2_00F5A075 SetUnhandledExceptionFilter,	0_2_00F5A075
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 0_2_00F63987 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00F63987
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 0_2_00F59986 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00F59986
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 0_2_00F59EE1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00F59EE1
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 2_2_00F5A075 SetUnhandledExceptionFilter,	2_2_00F5A075
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 2_2_00F63987 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00F63987
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 2_2_00F59986 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00F59986
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Code function: 2_2_00F59EE1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00F59EE1

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: ceFgl3jkkk.exe, 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: drawwyobstacw.sbs
Source: ceFgl3jkkk.exe, 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: condifendteu.sbs
Source: ceFgl3jkkk.exe, 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ehticsprocw.sbs
Source: ceFgl3jkkk.exe, 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: vennurviot.sbs
Source: ceFgl3jkkk.exe, 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: resinedyw.sbs
Source: ceFgl3jkkk.exe, 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: enlargkiw.sbs
Source: ceFgl3jkkk.exe, 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: allocatinow.sbs
Source: ceFgl3jkkk.exe, 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: mathcucom.sbs
Source: ceFgl3jkkk.exe, 00000002.00000003.1532103299.0000000009C8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: droppyrelivei.cfd

Writes to foreign memory regions

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe base: 445000	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe base: 448000	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe base: 458000	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe base: EA6008	Jump to behavior

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Process created: C:\Users\user\Desktop\ceFgl3jkkk.exe "C:\Users\user\Desktop\ceFgl3jkkk.exe"			Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngentask.exe			Jump to behavior

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe

Code function: 0_2_00F5A185 cpuid

0_2_00F5A185

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\_uuid.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI8242\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ceFgl3jkkk.exe	Queries volume information: C:\Users\user\Desktop\ceFgl3jkkk.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe

Code function: 0_2_00F59DD4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00F59DD4

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe

Code function: 0_2_00F6D933 _free,GetTimeZoneInformation,_free,

0_2_00F6D933

Source: C:\Users\user\Desktop\ceFgl3jkkk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	33 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
ceFgl3jkkk.exe	45%	ReversingLabs	Win32.Spyware.Lummastealer
ceFgl3jkkk.exe	100%	Avira	TR/AVI.Lumma.hwuxs
ceFgl3jkkk.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI8242\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI8242\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI8242\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI8242\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI8242\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI8242\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI8242\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI8242\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI8242\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI8242\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI8242\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI8242\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI8242\_uuid.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI8242\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI8242\libffi-7.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI8242\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI8242\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI8242\python39.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI8242\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI8242\unicodedata.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
https://community.fastly.steamstatic.co	0%	Avira URL Cloud	safe
https://community.fastly.steamstati	0%	Avira URL Cloud	safe
https://marshal-zhukov.com/api)	100%	Avira URL Cloud	malware
https://auscitte.github.io/systems%20blog/Exception-Directory-pefile#implementation-details	0%	Avira URL Cloud	safe
https://www.ntcore.com/files/richsign.htm	0%	Avira URL Cloud	safe
https://marshal-zhukov.com/apis	100%	Avira URL Cloud	malware
droppyrelivei.cfd	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
marshal-zhukov.com	188.114.97.3	true	false	high
droppyrelivei.cfd	unknown	unknown	true	unknown
condifendteu.sbs	unknown	unknown	true	unknown
allocatinow.sbs	unknown	unknown	true	unknown
vennurviot.sbs	unknown	unknown	true	unknown
drawwyobstacw.sbs	unknown	unknown	true	unknown
mathcucom.sbs	unknown	unknown	true	unknown
ehticsprocw.sbs	unknown	unknown	true	unknown
resinedyw.sbs	unknown	unknown	true	unknown
enlargkiw.sbs	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
droppyrelivei.cfd	true	Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199724331900	false		high
resinedyw.sbs	false		high
enlargkiw.sbs	false		high
allocatinow.sbs	false		high
drawwyobstacw.sbs	false		high
vennurviot.sbs	false		high
ehticsprocw.sbs	false		high
mathcucom.sbs	false		high
condifendteu.sbs	false		high
https://marshal-zhukov.com/api	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	ceFgl3jkkk.exe, 00000002.00000003.1505286993.0000000000D83000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000002.1547815675.0000000002B20000.00000004.00001000.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505501911.0000000000D86000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ntcore.com/files/richsign.htm	ceFgl3jkkk.exe, 00000002.00000003.1523747536.0000000003311000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1523600484.00000000032E3000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000002.1548099724.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1523686303.00000000032F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://auscitte.github.io/systems%20blog/Exception-Directory-pefile#implementation-details	ceFgl3jkkk.exe, 00000002.00000002.1548717939.0000000003430000.00000004.00001000.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1523747536.0000000003311000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1523600484.00000000032E3000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1523686303.00000000032F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.python.org/download/releases/2.3/mro/.	ceFgl3jkkk.exe, 00000002.00000003.1506886633.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1506725417.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000002.1547469415.0000000000F00000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false		high
http://ocsp.thawte.com0	ceFgl3jkkk.exe, 00000000.00000003.1499609486.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	false		high
http://store.steampowered.com/privacy_agreement/	ngentask.exe, 00000003.00000002.1613155400.0000000001312000.00000004.00000020.00020000.00000000.sdmp, ngentask.exe, 00000003.00000002.1613429184.00000000013A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	ceFgl3jkkk.exe, 00000002.00000003.1505557465.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505286993.0000000000D83000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505789755.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1546530228.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505890825.0000000000D4D000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000002.1547030217.0000000000D4D000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505501911.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1546492928.0000000000D33000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.co	ngentask.exe, 00000003.00000002.1613155400.0000000001312000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marshal-zhukov.com/api)	ngentask.exe, 00000003.00000002.1613322725.0000000001342000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.python.org/dev/peps/pep-0205/	ceFgl3jkkk.exe, 00000000.00000003.1503202450.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000002.1548042408.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false		high
http://store.steampowered.com/subscriber_agreement/	ngentask.exe, 00000003.00000002.1613429184.00000000013A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://python.org/dev/peps/pep-0263/	python39.dll.0.dr	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	ceFgl3jkkk.exe, 00000002.00000003.1505557465.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505286993.0000000000D83000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505789755.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1546530228.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505890825.0000000000D4D000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000002.1547030217.0000000000D4D000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505501911.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1546492928.0000000000D33000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl3.digi	ceFgl3jkkk.exe, 00000000.00000003.1498335139.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1498125097.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000000.00000003.1497059480.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?	ngentask.exe, 00000003.00000002.1613155400.0000000001312000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	ceFgl3jkkk.exe, 00000002.00000003.1505557465.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505286993.0000000000D83000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505789755.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1546530228.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505890825.0000000000D4D000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000002.1547030217.0000000000D4D000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1505501911.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1546492928.0000000000D33000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/apis	ngentask.exe, 00000003.00000002.1613322725.0000000001347000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/im	ngentask.exe, 00000003.00000002.1613155400.0000000001312000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	ceFgl3jkkk.exe, 00000000.00000003.1499609486.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=id	ngentask.exe, 00000003.00000002.1613155400.0000000001312000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.openssl.org/H	ceFgl3jkkk.exe, 00000000.00000003.1499874700.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr	false		high
https://marshal-zhukov.com/	ngentask.exe, 00000003.00000002.1613155400.0000000001312000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstati	ngentask.exe, 00000003.00000002.1613155400.0000000001312000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://store.steampowered.com/account/cookiepreferences/	ngentask.exe, 00000003.00000002.1613429184.00000000013A8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl4.digice	ceFgl3jkkk.exe, 00000000.00000003.1502556218.00000000006DA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.mandiant.com/resources/blog/tracking-malware-import-hashing	ceFgl3jkkk.exe, 00000002.00000002.1548717939.0000000003430000.00000004.00001000.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1523747536.0000000003311000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1523600484.00000000032E3000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1523600484.00000000032B1000.00000004.00000020.00020000.00000000.sdmp, ceFgl3jkkk.exe, 00000002.00000003.1523686303.00000000032F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	ceFgl3jkkk.exe, 00000002.00000003.1546492928.0000000000D33000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	ngentask.exe, 00000003.00000002.1613429184.00000000013A8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	marshal-zhukov.com	European Union		13335	CLOUDFLARENETUS	false
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560168
Start date and time:	2024-11-21 13:44:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ceFgl3jkkk.exe renamed because original name is a hash value
Original Sample Name:	857270428d9d88c5da6d8b9d33059d4e29347637879a17975631408c5359b623.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@5/21@11/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 72 Number of non-executed functions: 169
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 40.126.32.72, 40.126.32.133, 20.190.160.22, 40.126.32.134, 40.126.32.136, 20.190.160.17, 20.190.160.20, 40.126.32.76, 52.182.143.212
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, www.tm.v4.a.prd.aadg.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: ceFgl3jkkk.exe

Simulations

Behavior and APIs

Time	Type	Description
07:45:21	API Interceptor	7x Sleep call for process: ngentask.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	www.rgenerousrs.store/o362/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.beylikduzu616161.xyz/2nga/
	Delivery_Notification_00000260791.doc.js	Get hash	malicious	Unknown	Browse	radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45
	ce.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/lxvbq
	Label_00000852555.doc.js	Get hash	malicious	Unknown	Browse	tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25
	PO 20495088.exe	Get hash	malicious	FormBook	Browse	www.ssrnoremt-rise.sbs/3jsc/
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/zWkbOqX7/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	gusetup.exe	Get hash	malicious	Unknown	Browse	www.glarysoft.com/update/glary-utilities/pro/pro50/
	Online Interview Scheduling Form.lnk	Get hash	malicious	Ducktail	Browse	gmtagency.online/api/check
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
marshal-zhukov.com	modest-menu.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	n7ZKbApaa3.dll	Get hash	malicious	LummaC, Xmrig	Browse	188.114.97.3
	JaDheaBFXI.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	ftoHy3FsuB.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	alarmer.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	nlJ2sNaZVi.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Loader.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
s-part-0017.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.45
	Request for Quotation MK FMHS.RFQ.24.11.21.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.246.45
	APPENDIX FORM_N#U00b045013-20241120.com.exe	Get hash	malicious	Remcos, GuLoader	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Payslip-21 November, 2024 ZmPQwjYq1NGSTsWga2.htm	Get hash	malicious	BlackHacker JS Obfuscator	Browse	13.107.246.45
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	CB1.exe	Get hash	malicious	BlackMoon	Browse	13.107.246.45
steamcommunity.com	aHPgKqtKWX.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	23.210.122.61
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	23.197.127.21
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	23.199.218.33
	modest-menu.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Updated Invoice_0755404645-2024_pdf.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	estimate Cost.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	MV BBG MUARA Ship's Particulars.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	CONTRACT COPY PRN00720387_pdf.exe	Get hash	malicious	GuLoader	Browse	188.114.97.3
	https://bitly.cx/aMW9O9	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	Request for Quotation MK FMHS.RFQ.24.11.21.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	PO-841122676_g787.exe	Get hash	malicious	GuLoader	Browse	188.114.97.3
AKAMAI-ASUS	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27
	shell_php00.pdf	Get hash	malicious	Unknown	Browse	104.126.112.182
	96c27caf-3816-d26f-4af5-19e1d76e6c15.eml	Get hash	malicious	HTMLPhisher	Browse	2.19.126.160
	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.57.90.101
	Invoice PSI-3102.msg	Get hash	malicious	Unknown	Browse	23.193.114.18
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.49.251.21
	original.eml	Get hash	malicious	Unknown	Browse	104.79.84.172
	SBAFLA TeamCALL marcia.main__ (lo).msg	Get hash	malicious	HTMLPhisher	Browse	2.19.126.160
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.200.88.30
	aHPgKqtKWX.exe	Get hash	malicious	LummaC	Browse	104.121.10.34

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 104.102.49.254
	MDE_File_Sample_37ce4d95fd579c36340b1d1490e2ef7623af4bb3.zip	Get hash	malicious	LummaC	Browse	188.114.97.3 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3 104.102.49.254
	kXPgmYpAPg.doc	Get hash	malicious	Unknown	Browse	188.114.97.3 104.102.49.254

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI8242\_asyncio.pyd	7b9HZNvZwL.exe	Get hash	malicious	LummaC	Browse
	CatalogApp.exe	Get hash	malicious	LummaC	Browse
	XS_Trade_AI-newest_release_.exe	Get hash	malicious	LummaC	Browse
	bB0yJfzf0t.exe	Get hash	malicious	LummaC	Browse
C:\Users\user\AppData\Local\Temp\_MEI8242\VCRUNTIME140.dll	7b9HZNvZwL.exe	Get hash	malicious	LummaC	Browse
	CatalogApp.exe	Get hash	malicious	LummaC	Browse
	XS_Trade_AI-newest_release_.exe	Get hash	malicious	LummaC	Browse
	bB0yJfzf0t.exe	Get hash	malicious	LummaC	Browse
	https://downloads.linktek.com/LR/SetupLinkReporter.zip	Get hash	malicious	Unknown	Browse
	cb1fcb3a3d30ed68e82b6b2a3499c4d07cf4c73ea4f67.exe	Get hash	malicious	Go Injector, Stealc, Vidar	Browse
	a3.cmd	Get hash	malicious	Unknown	Browse
	ELF2o7c93F.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI8242\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\ceFgl3jkkk.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	76168
Entropy (8bit):	6.763747567766442
Encrypted:	false
SSDEEP:	1536:O6HuqvERNjBwySXtVaSvrgOFw9RxKMnMecbCIdFr:O6HZMRNjKySdLcOiHMecbCId
MD5:	31CE620CB32AC950D31E019E67EFC638
SHA1:	EAF02A203BC11D593A1ADB74C246F7A613E8EF09
SHA-256:	1E0F8F7F13502F5CEE17232E9BEBCA7B44DD6EC29F1842BB61033044C65B2BBF
SHA-512:	603E8DCEDA4CB5B3317020E71F1951D01ACE045468EAF118B422F4F44B8B6B2794F5002EA2E3FE9107C222E4CB55B932ED0D897A1871976D75F8EE10D5D12374
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 7b9HZNvZwL.exe, Detection: malicious, Browse Filename: CatalogApp.exe, Detection: malicious, Browse Filename: XS_Trade_AI-newest_release_.exe, Detection: malicious, Browse Filename: bB0yJfzf0t.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: cb1fcb3a3d30ed68e82b6b2a3499c4d07cf4c73ea4f67.exe, Detection: malicious, Browse Filename: a3.cmd, Detection: malicious, Browse Filename: ELF2o7c93F.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................{.........i.............................................................Rich....................PE..L...J(.`.........."!.........................................................@............@A......................................... ...................#...0.......#..8............................#..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI8242\_asyncio.pyd

Download File

Process:	C:\Users\user\Desktop\ceFgl3jkkk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	59112
Entropy (8bit):	6.494573911771512
Encrypted:	false
SSDEEP:	1536:qufUQUmEd6LO3wKb/Oz+B7RgjtWZhI8YnFcCByjWH:qWzlErbWI7RgjtWZhI8Yn2mH
MD5:	24B4C187E01530FA52F71DA2D158178C
SHA1:	C1AC16956FD2A2AE9209FD83E27D590306F959B0
SHA-256:	62744AA604A54F38EA4C5A5C538B51AB2F81EB14175101EB1D0E4381B33F996B
SHA-512:	DCA850EDC23923E69212A4786CF6CB4B9BA3BB3D931667848232A0975717FB3ED396265D787EC1D4992288C3FEFE2B700AA1FDC41361AD8D568B43EFF29B0A6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 7b9HZNvZwL.exe, Detection: malicious, Browse Filename: CatalogApp.exe, Detection: malicious, Browse Filename: XS_Trade_AI-newest_release_.exe, Detection: malicious, Browse Filename: bB0yJfzf0t.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R?..3Q..3Q..3Q..K...3Q.FP..3Q.FT..3Q.FU..3Q.FR..3Q.hFP..3Q..XP..3Q..3P.3Q.hFY..3Q.hFQ..3Q.hF...3Q.hFS..3Q.Rich.3Q.........................PE..L...d:-a...........!.....f...d.......e..............................................N.....@.............................P...P...d......................................T...........................H...@............................................text...)e.......f.................. ..`.rdata...8.......:...j..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI8242\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\ceFgl3jkkk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	78568
Entropy (8bit):	6.692548823172262
Encrypted:	false
SSDEEP:	1536:2whkLX4/bkMzMIXSycT+ar1AS8bVMS4BpI8MV55CbyjvU:25LEkMzvX2DOlbVMS4BpI8MVeWU
MD5:	9137B258EAF602482EB7DFDEEDFDF795
SHA1:	4AA311984C98ACF024AC446C434905864E7BBBEB
SHA-256:	3FF08CFA9F6687D68D78FE1A5C0AF6E5396E6FE506C14D23C538316CCA71A6AB
SHA-512:	79493AB0254A6CB56F998BBBC63F5D471E0A3F8709E745EE0EB0DF5D8DC6222EF38EA262A97907BB06281B3E8D6572286A0DF5E8D82F984878263720F0FCB8E6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j..:...i...i...i'.wi$..i\|..h,..iH..i-..i\|..h"..i\|..h$..i\|..h,..i...h-..i:..h,..i...is..i...h&..i...h/..i...i/..i...h/..iRich...i........................PE..L....:-a...........!.........L...............................................P............@......................... ...H...h........0.......................@......@...T...............................@............................................text............................... ..`.rdata..X1.......2..................@..@.data...H.... ......................@....rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI8242\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\ceFgl3jkkk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	116968
Entropy (8bit):	6.58820716147258
Encrypted:	false
SSDEEP:	3072:qeLRlXrhZu6mLXV0Q/Z6flqCBAlI8BPW8srEy:qeLrX9JiCQ/Z6fMC6uEy
MD5:	DE2F88B18FABE8586C38074B6FB80873
SHA1:	CF4B533FFEB9792B33516EC05D3375260FF32B98
SHA-256:	F5480114CF3118E561C4DC55CB733F9D06FAE897875D91BB324263B4AEDD31B9
SHA-512:	3D89CCC9F9D6BCA35F2CE5DBDAFF2FD571C3E4C89056AEC4DE97466AEA49D5BD9C7DE0A0D345F249F1A33B43597F9C3A1687DA246F6C832434391638A10DCD04
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{...?\|.?\|.?\|.6.[.9\|.m..=\|.m..4\|.m..5\|.m..:\|....=\|.+..>\|.+..9\|....<\|.?\|..\|.....9\|....>\|...7.>\|....>\|.Rich?\|.................PE..L...y:-a...........!.........................0............................................@..........................f......$g......................................xa..T............................a..@............0...............................text............................... ..`.rdata...N...0...P..................@..@.data................f..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI8242\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\ceFgl3jkkk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	230632
Entropy (8bit):	6.857972259618523
Encrypted:	false
SSDEEP:	6144:7+CdBO+WLvRxuFcQAHe0nDx3tUftGuq6xx3XMW5gZrWCi7:7/7O/LRxuFcQYlDx3taLOWCw
MD5:	334D5A5D7B73C7D157762EB290F3AC48
SHA1:	716AE2CE10270CB474A6B1787E5C98662AE902EC
SHA-256:	0AB918574B6404FC37B577E2FDDA8B1515FBF198E86C10C6011F708E88A79EF7
SHA-512:	E830002BD4DDA7D55A1807EA2380A3A46BEF6CAF7DFA5D5028306076EA3B3BF56446196842B926D77244B8B7571AC489109737D0C5F8855896202D376F39297A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?..c{..0{..0{..0r.:0u..0).1y..0).1w..0).1q..0).1...0..1x..0o.1y..0{..0.0..1t..0..1z..0..V0z..0..1z..0Rich{..0........PE..L...i:-a...........!................................................................AU....@.............................P............`...............h.......p..."...)..T...........................@*..@............................................text.............................. ..`.rdata..............................@..@.data........@.......(..............@....rsrc........`.......:..............@..@.reloc..."...p...$...D..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI8242\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\ceFgl3jkkk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	52456
Entropy (8bit):	6.648093374061067
Encrypted:	false
SSDEEP:	768:GFRegVllNvo/j+X+oOPCGGtQhI8YIHezUl9wJDG4y3hHA:GRegvre+Or6GGChI8YIHr2yFA
MD5:	3AD5E39CBE6354BB1CE82E29D4B2C072
SHA1:	C4A18CE9E803CA6A7E33F1BEF422F5006DF651FF
SHA-256:	EDDEEDD5FD8A1C49ECAAB51FF5117D9FB1FED5637E8CA31F35698BC6D68CA39D
SHA-512:	A9ECAB892469C79B50B7C1C79394BB96FCB10BEAB03114961BE5C0C05622765C0F105856065988ED31A7D21911D91C7A5FCDF4A9D33AC35AB99BA5550E91A823
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................E..............................................>.................).........Rich............................PE..L....:-a...........!.....Z...V.......Y.......p......................................`<....@......................... ...P...p...x...............................$...h...T...............................@............p..0............................text...)Y.......Z.................. ..`.rdata...3...p...4...^..............@..@.data...@...........................@....rsrc...............................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI8242\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\ceFgl3jkkk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	162536
Entropy (8bit):	6.9618412972272035
Encrypted:	false
SSDEEP:	3072:KsdGFMyIenRQWtwjETZZ2lHEH60E9DjX9WAiuwCpMxIl3YxIuG17lzHfq9mNoRGU:Ky56RQWtwjEODjX/gQl3HtiYOc7IqvXu
MD5:	02A95C6BD7852E9E5FAF24A3375D30EA
SHA1:	5DAD699FD8103183B7A5E8B06498D8F6997A8898
SHA-256:	E1B8C6D535E5070BB350799953A86AE7FF25FE90CEC81E20A18834CB6D503465
SHA-512:	CE28BA0A7C6EFF792CC8E2B9A9A9C3357A82AB0FBDC5B02837CED666CF543D41E79503AD1155D96B412D85484174DAE5DDA6B5C33A5EEC62606CCB95720E43F8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,...B...B...B.......B...C...B...G...B...F...B...A...B...C...B...C...B...C...B...J...B...B...B.......B...@...B.Rich..B.................PE..L....:-a...........!................[.....................................................@..........................D..L....D..x....`...............^.......p..D....?..T...........................8@..@............................................text............................... ..`.rdata.............................@..@.data...`....P.......B..............@....rsrc........`.......F..............@..@.reloc..D....p.......P..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI8242\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\ceFgl3jkkk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	27368
Entropy (8bit):	6.549414263488397
Encrypted:	false
SSDEEP:	768:HuDBfF4Cz7UfVqH+JxI8At42uDG4yjc/AdiYhHZ:Hu9fF4CPUfVqH+JxI8At42ayjc/ai8Z
MD5:	DD1C9450E9F4C33E47C364900D9A814D
SHA1:	E0BCD7DE6DF954309F226CA64390E95E41CECC69
SHA-256:	734AC43FD0DB3108D4BF1251F078F8F212B3B9A2DE1C46511AF7D6CA90EAF624
SHA-512:	A084F8119B99977077E3FE7B4E87722A2FE6D2C010604CFE4CE4E7A37AA621C2F974485700C969443E1B6C9AD466858607A239CC6DAD8668ECB7B61AFE98B19A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........pb..1..1..1..1..1...0...1...0..1...0..1...0...1v..0...1...0..1..1...1v..0...1v..0..1v..1..1v..0..1Rich..1........................PE..L...m:-a...........!....."...,......:........@............................................@.........................`J..`....J.......p...............N..........T....E..T............................F..@............@..d............................text...g!.......".................. ..`.rdata.......@.......&..............@..@.data...@....`.......:..............@....rsrc........p.......>..............@..@.reloc..T............H..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI8242\_overlapped.pyd

Download File

Process:	C:\Users\user\Desktop\ceFgl3jkkk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39144
Entropy (8bit):	6.594969794994295
Encrypted:	false
SSDEEP:	768:fSq/1fbtTv2JknGAeTP5M8IYWn06IzLnnI9I8ttQDG4yfGhHl:KmD22nGNTxUn06IzLnI9I8ttcy+l
MD5:	A9E77439A38E66AB21DA99C5C00EE0F0
SHA1:	CD3CC2BEB2C5270F9A01BF95919C3F9C4A1F16D6
SHA-256:	70538FFEFDB2F6FF8C6F29EEAF5EE4197832E83476EAC6A648A4EB14E86E90FF
SHA-512:	5E5B27ECF6850EA7A300267B0B5EEB6F85AD003E9EE8FD13EB9B6350BD520295407D1F99BC33833A4BE1E78F4914B52F8ABC3C1F4297268B151DA1DD31BB10D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h.P..i...i...i..q....i..\|h...i..\|l...i..\|m...i..\|j...i.{\|h...i..bo...i..bh...i...h...i.{\|a...i.{\|i...i.{\|....i.{\|k...i.Rich..i.........PE..L...m:-a...........!.....<...@.......<.......P...........................................@......................... i..X...xi.......................\|..............\d..T............................d..@............P...............................text...o;.......<.................. ..`.rdata...$...P...&...@..............@..@.data...$............f..............@....rsrc................j..............@..@.reloc...............t..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI8242\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\ceFgl3jkkk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26344
Entropy (8bit):	6.465416851591826
Encrypted:	false
SSDEEP:	768:cxz3Uvcqwbv6rhCGJklI8mU5DG4yihH8F:ct3UUqQyhCGJklI8mU7y68F
MD5:	A76C599AEA04E05E0D8FBD3E40C564FF
SHA1:	BD0992D395D4E2FD275C942DFA425A29333663BB
SHA-256:	5A9E30C9B0FC28E192B59930D70D4B212DBD96A14DE31D88B6F7E5C719E7B148
SHA-512:	1E3536C3F5DC439547C6F267A8F7F885E9B7F20F2A480B88DA83CB1336E25132BC4107F3C22F3FB7DE85FE762BC28D57182CF9A8CA881B3512905B1D5F5EAC66
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R..S..R..W..R..V..R..Q..R.h.S..R...S..R..S.R.h.Z..R.h.R..R.h...R.h.P..R.Rich.R.........................PE..L...o:-a...........!.........*...............0.......................................W....@......................... =..L...l=..d....`...............J.......p..l...H8..T............................8..@............0...............................text...9........................... ..`.rdata.......0......."..............@..@.data........P.......8..............@....rsrc........`.......<..............@..@.reloc..l....p.......F..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI8242\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\ceFgl3jkkk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	71912
Entropy (8bit):	6.6304829026661345
Encrypted:	false
SSDEEP:	1536:XxYZ+3edCVrMD9f8+2eJiWnnCz6xlI8Bwvyj+u:BYZLdsMD9f8LeJiWnCz6xlI8Bwru
MD5:	6BA36034BC861F44E90F547C667DA40A
SHA1:	7FC6D70AC9C80E600B14760B47396369F1C3D9BE
SHA-256:	5A3E41A8C91EB5D81AC9D4A7477461414D5431754FFB9D6AD49369238D25FDD4
SHA-512:	AD49EBE8B11592088CCFDA6813DE3629C1C0EF6663D56724B6DB8F5B6B827B8CF28EF71DD7154C223F836059029CD25FF48E57EDB3D9B665157716172443B59F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y...=.=.=.4...9.o...?.o...1.o...7.o...<.....?.)...:.=.......<.....<...q.<.....<.Rich=.........................PE..L....:-a...........!.....x..........4w.......................................0......uJ....@.............................P.................................... ..........T...............................@............................................text....v.......x.................. ..`.rdata...`.......b...\|..............@..@.data...@...........................@....rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI8242\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\ceFgl3jkkk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	143080
Entropy (8bit):	6.491073634171029
Encrypted:	false
SSDEEP:	3072:Dd7tm9Bt+CDEcthX+w0/13yLjqvDWb56j8RpI8M7Y8IVQ:Ddxm9Xr+w0/13+qvDWba8R3LQ
MD5:	EEFFC18404F7E10E6BFC71C5984EA3E5
SHA1:	9291C1DD62135F7FDCD61DDE80EB4B2E8B96CA0A
SHA-256:	52891F8A9751C1DED6DEA7C7313F19287E936A248AFFDBE93BC9C857294C120B
SHA-512:	C4D1FE321B457EF4BA0E79E0B22DF62D3D981C9A42A29FD8370559FEFEE225BFE21F398DE2BB58C0E91468ED87D5FDB804A605B76204B99C9F88713F67A49B41
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J...+...+...+...S$..+...^...+...^...+...^...+...^...+..J^...+...^...+...@...+...+...*..J^...+..J^...+..J^H..+..J^...+..Rich.+..........PE..L....:-a...........!.........P...............................................P............@.............................d...D................................ ..\|#..(...T...............................@............................................text............................... ..`.rdata..............................@..@.data....K.......H..................@....rsrc...............................@..@.reloc..\|#... ...$..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI8242\_uuid.pyd

Download File

Process:	C:\Users\user\Desktop\ceFgl3jkkk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20712
Entropy (8bit):	6.48424389358467
Encrypted:	false
SSDEEP:	384:tD3fFhe0IjmyvNNdeTpI8DwzH6oDG4y8mKFcQhHI4:Jdhe9mTpI8DwzH1DG4yjehHI4
MD5:	2C4DBAA2151C458C8EEA5F37B2CFE673
SHA1:	72AEB5DE5E25E67F8F798AED198718B9C4A5CD97
SHA-256:	99DD17FE2D43ED007B301AA5CE80364F2C7D9BBD033E4CE0166DEFB23140DB38
SHA-512:	399491B8D9736732E404640216C8ECE073795F9966AE6D2ACFD6D64B7C6B35AB63C03287751C0AB46593B072C778E1D4051D667BA693ADBAFE0A15AE6E6019AA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}..9...9...9...0.!.;...k..;...k..2...k..3...k..8......;...-...<...9..........8......8.....M.8......8...Rich9...........................PE..L...x:-a...........!................P........0...............................p......TU....@..........................5..L...,6..x....P...............4.......`..P....1..T...........................p1..@............0...............................text............................... ..`.rdata.......0......................@..@.data........@.......$..............@....rsrc........P.......&..............@..@.reloc..P....`.......0..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip

Download File

Process:	C:\Users\user\Desktop\ceFgl3jkkk.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	799949
Entropy (8bit):	5.485927763898022
Encrypted:	false
SSDEEP:	24576:1K738OQQcosQNRs54PK4ItIVwHLfVEhIESC/:1K738OfcosQNRs54PK4I7q
MD5:	A6277EDD815F1D33215C41309AA0A3B4
SHA1:	0522D880992F2BB46571E27610410A9D99B69984
SHA-256:	A6E24DEAB93CA92BB3118081E10987FB7078B0D249E38911BD0C429563941317
SHA-512:	AE83607B951996CC61BFC07AA6946BC8E6B409BC504AA92355C762420ECE2D69C2E11BB6C88D4CE81C8D0136AC82E1E04157ED02CDCA5B7D945D939D36C4AE39
Malicious:	false
Preview:	PK..........!...#............_bootlocale.pyca.......C.O.o..v.....................@....x...d.Z.d.d.l.Z.d.d.l.Z.e.j...d...r,d.d.d...Z.nHz.e.j...W.n2..e.yh......e.e.d...rZd.d.d...Z.n.d.d.d...Z.Y.n.0.d.d.d...Z.d.S.)...A minimal subset of the locale module used at interpreter startup.(imported by the _io module), in order to reduce startup time...Don't import directly from third-party code; use the `locale` module instead!......N..winTc....................C........t.j.j.r.d.S.t.....d...S.).N..UTF-8.........sys..flags..utf8_mode.._locale.._getdefaultlocale....do_setlocale..r......_bootlocale.py..getpreferredencoding...............r......getandroidapilevelc....................C........d.S.).Nr....r....r....r....r....r....r...............c....................C........t.j.j.r.d.S.d.d.l.}.\|...\|...S.).Nr....r......r....r....r......localer......r....r....r....r....r....r.....................c....................C....6...\|.r.J...t.j.j.r.d.S.t...t.j...}.\|.s2t.j.d.k.r2d.}.\|.S.).Nr......darwin..r....

C:\Users\user\AppData\Local\Temp\_MEI8242\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\ceFgl3jkkk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2265336
Entropy (8bit):	6.107347147299583
Encrypted:	false
SSDEEP:	49152:Tzq7OrIUW5FPdtvxE8IRHKY1CPwDv3uFfJuJy:Xq7OzUdfE8AHKY1CPwDv3uFfJ/
MD5:	31C2130F39942AC41F99C77273969CD7
SHA1:	540EDCFCFA75D0769C94877B451F5D0133B1826C
SHA-256:	DD55258272EEB8F2B91A85082887463D0596E992614213730000B2DBC164BCAD
SHA-512:	CB4E0B90EA86076BD5C904B46F6389D0FD4AFFFE0BD3A903C7FF0338C542797063870498E674F86D58764CDBB73B444D1DF4B4AA64F69F99B224E86DDAF74BB5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.w9g..jg..jg..jn..js..j5..ke..j5..kl..j5..km..j5..km..js..kl..jg..j...j1..k...j1..kf..j1..jf..j1..kf..jRichg..j........................PE..L.....'a...........!.................f.......0................................#......"...@..............................h....!.T.....!.\|............t".......".........8...............................@.............!..............................text...9........................... ..`.rdata...(...0...*..................@..@.data...4Y...`!......B!.............@....idata........!......X!.............@..@.00cfg........!......r!.............@..@.rsrc...\|.....!......t!.............@..@.reloc........"......\|!.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI8242\libffi-7.dll

Download File

Process:	C:\Users\user\Desktop\ceFgl3jkkk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	29208
Entropy (8bit):	6.643623418348
Encrypted:	false
SSDEEP:	384:l69PtXvz8cLBN3gHhY4AFlfIvDzqig2c2LuRRClfW23JLURlV5uH+6nYPLxDG4yG:l65tXvz2CTIvy2c26A35qYvWDG4yG
MD5:	BC20614744EBF4C2B8ACD28D1FE54174
SHA1:	665C0ACC404E13A69800FAE94EFD69A41BDDA901
SHA-256:	0C7EC6DE19C246A23756B8550E6178AC2394B1093E96D0F43789124149486F57
SHA-512:	0C473E7070C72D85AE098D208B8D128B50574ABEBBA874DDA2A7408AEA2AABC6C4B9018801416670AF91548C471B7DD5A709A7B17E3358B053C37433665D3F6B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)..qm.."m.."m.."d.p"o.."?..#o.."...#n.."m.."I.."?..#f.."?..#g.."?..#n.."...#k.."...#l.."...#l.."...#l.."Richm.."................PE..L.....]...........!.....@...........E.......P......................................H.....@.........................pU.......X..P....................X.......p..<....R..............................0R..@............P...............................text...j>.......@.................. ..`.rdata..p....P.......D..............@..@.data........`.......R..............@....reloc..<....p.......T..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI8242\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\ceFgl3jkkk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	544504
Entropy (8bit):	5.7541372304412945
Encrypted:	false
SSDEEP:	12288:OcwAbgOL9BmDy2pMcdmka42bJ8Hh9sa3MU2lvzJp:O4UOBBcF2b0hma8U2lvzJp
MD5:	8471E73A5594C8FBBB3A8B3DF4FB7372
SHA1:	488772CB5BBB50F14A4A9546051EDEF4AE75DD20
SHA-256:	380BB2C4CE42DD1EF77C33086CF95AA4FE50290A30849A3E77A18900141AF793
SHA-512:	24025B8F0CC076A6656EBA288F5850847C75F8581C9C3E36273350DB475050DEEE903D034AD130D56D1DEDE20C0D33B56B567C2EF72EB518F76D887F9254B11B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............^..^..^..E^..^..._..^..._..^..._..^..._..^..._..^..._..^..^9..^..._...^..._..^..)^..^..._..^Rich..^................PE..L...,.'a...........!.........4.......".......................................p...........@.........................`,...N........... ..s............2.......0...6......8...............................@............................................text...y........................... ..`.rdata..jj.......l..................@..@.data....;.......6...p..............@....idata...A.......B..................@..@.00cfg..............................@..@.rsrc...s.... ......................@..@.reloc..$>...0...@..................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI8242\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\ceFgl3jkkk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180968
Entropy (8bit):	6.670082335019216
Encrypted:	false
SSDEEP:	3072:lGGzH3PDa4Wa0hDVgoApEmP/JZR8x4Hm6EJNA3Rui/IddZaUTlI8BhNjV:xzH24Wa01AEa/JZVGDNA3Rui/AaUTbjV
MD5:	46C68BBCA8A86EA6AD9B0279DED140D4
SHA1:	1FA89E41A77C5BD30799B28BBE7B2FF6FCE5183A
SHA-256:	00DF0F266070208D7087D203F5FD06E91C47C9D5C8ED449690B9443F06C8D992
SHA-512:	E75E082FBFF3FA9B9848CA5693DE0D4C5074995F9E03EEDD26FC72C90FBD9D60E257E6ECE93F2A113C6DF6401930451DF462FD8D16D14E0D249A8BEB2055D0CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B...,...,...,.....,...-...,...)...,...(...,.../...,.X.-...,...-...,...-...,.X.$...,.X.,...,.X.....,.X.....,.Rich..,.........PE..L...u:-a...........!................E........ ............................................@..........................j..P...0k...................................$..(f..T............................f..@............ ...............................text............................... ..`.rdata...W... ...X..................@..@.data...h............j..............@....rsrc................v..............@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI8242\python39.dll

Download File

Process:	C:\Users\user\Desktop\ceFgl3jkkk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4497640
Entropy (8bit):	6.725954872872607
Encrypted:	false
SSDEEP:	49152:6UqQgnAHhsvhRLEmgRJEqdaNIuEBIv0BX+dCIqQKHaEMZnFPqYekTr+4mP6umenF:oaWhxKCqBI2O9qTHrMZ0Yu1P7n3zFX
MD5:	5BAFE23107E6DF19DE8F7AC9068ED26E
SHA1:	D2A88BEAF959BD5331948B03330C98FE8FA85C7C
SHA-256:	C1E5A847AE6AA9D9F42B482C7A20DCDC9DFE225F7186B0B01924225AA4E5E581
SHA-512:	1C2372DEBC0E2E53EA281798F15243294430E4E7E4D3B82E4AB998A1B7C77CAD68D50E196E37C6FF7BA83B08A12286AF5D2797BFA707AF5DAD180862CCE7EFC7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................................x................q...................Rich...........PE..L...J:-a...........!......)...........).......)..............................pF.....?<E...@...........................?.......?.\|.....C...............D.......C.0.....>.T.............................>.@.............)..............................text....).......)................. ..`.rdata...6....)..8....).............@..@.data.........@.......?.............@....rsrc.........C.......A.............@..@.reloc..0.....C.......A.............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI8242\select.pyd

Download File

Process:	C:\Users\user\Desktop\ceFgl3jkkk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25320
Entropy (8bit):	6.533727727613444
Encrypted:	false
SSDEEP:	768:KtbCEbBS3sEnqhrVusklI8mGgDG4yjshHZ:8bB4qNVusklI8mGsyjYZ
MD5:	E03B622ACBA9D02DC5A10364824EDE8C
SHA1:	40DB1A1A0D81C5D165D043502B1205B22BC238A4
SHA-256:	DE914028BFDDF19EF7279F04C92EF118C59B1BA8B5E27C76A7932E086BBC7978
SHA-512:	02ABE8C060A2E046E92DB4FDF5EFDEAF6A870703AD313D14D3E8A3A308CCA032C1D7B7AC40B0C346C0D8BF3193C42DFC69BF50450C9545D6BB6704FC0F5D3D5B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............y..y..y......y...x..y...\|..y...}..y...z..y.h.x..y...x..y..x...y.h.q..y.h.y..y.h...y.h.{..y.Rich.y.................PE..L...r:-a...........!.........&...............0.......................................9....@......................... ;..L...l;..x....`...............F.......p......d6..T............................6..@............0...............................text............................... ..`.rdata..6....0......."..............@..@.data........P.......6..............@....rsrc........`.......8..............@..@.reloc.......p.......B..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI8242\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\ceFgl3jkkk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1115880
Entropy (8bit):	5.387181050869946
Encrypted:	false
SSDEEP:	12288:D13VQCb5Pfhnzr0ql9L8kUMmuZ63NKM7IRG5eeIDe6VZyrIBHdQLhfFE+Ck5t:D13jZV0m9suVMMREtIC6Vo4u8k5t
MD5:	FED3EC3AE0C349D65C0E90025B5507E6
SHA1:	3A1864A89C90D2837B77C6A1881263E9764FF8D3
SHA-256:	CE67BBA9B38FC6023D8EFDB06223B823CEB5B7C316DA48EA1EC9E404D05384A4
SHA-512:	87047F4B55C43D59FCD643879CC2CC6D03E18963E36D6C3F49AB37C8B8672B31F61ABD9AC1FAD732778FD02FB3D1E5308572C0297FB51E2FF7C8A26354C54C58
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.eb.f.1.f.1.f.1...1.f.1S..0.f.1S..0.f.1S..0.f.1S..0.f.1...0.f.1...0.f.1.f.1Ff.1...0.f.1...0.f.1...1.f.1...0.f.1Rich.f.1........PE..L...r:-a...........!.....H...........F.......`......................................e.....@.............................X...8...........................................T...........................p...@............`..4............................text...KF.......H.................. ..`.rdata..b~...`.......L..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.993255227216837
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ceFgl3jkkk.exe
File size:	7'166'290 bytes
MD5:	9cf2fcabd10ee683a3652815014b368c
SHA1:	f49914f1cf2b7fbba812eb8fd807b19065008b23
SHA256:	857270428d9d88c5da6d8b9d33059d4e29347637879a17975631408c5359b623
SHA512:	8dcf40e92d40627fb79413c6662e43e87d1dcd23e2825aa87a96e09706cff25e5e894376fdf5570d0e8470c36a4574810fc8afea3c720595fac07b93d0904117
SSDEEP:	196608:e741InG5lNniIbZg4TYc1vR31A4zur5MOjjDDTTVCjE/gsOt0G1:e741ZbPH1AJCY/Ur
TLSH:	2A763319DE51D061E5BB083014B0CB35ED7B6AB10B24847FB6C81DFA4E71AD0B4A6E9F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.pQ)j..)j..)j..=...%j..=....j..=...;j..O...-j..{....j..{...;j..{...;j..=..."j..)j...j......:j......(j..Rich)j.................

File Icon


Icon Hash:	27393d590b2f0f06

Static PE Info

General

Entrypoint:	0x40997c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x670EBB30 [Tue Oct 15 18:57:52 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	bdaa4f11fa75ae7944b223ba584c1f57

Entrypoint Preview

Instruction
call 00007F3C107FCE45h
jmp 00007F3C107FC81Fh
push ebp
mov ebp, esp
push 00000000h
call dword ptr [004230D8h]
push dword ptr [ebp+08h]
call dword ptr [004230D4h]
push C0000409h
call dword ptr [0042309Ch]
push eax
call dword ptr [004230DCh]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call dword ptr [004230E0h]
test eax, eax
je 00007F3C107FC9A7h
push 00000002h
pop ecx
int 29h
mov dword ptr [0043ED48h], eax
mov dword ptr [0043ED44h], ecx
mov dword ptr [0043ED40h], edx
mov dword ptr [0043ED3Ch], ebx
mov dword ptr [0043ED38h], esi
mov dword ptr [0043ED34h], edi
mov word ptr [0043ED60h], ss
mov word ptr [0043ED54h], cs
mov word ptr [0043ED30h], ds
mov word ptr [0043ED2Ch], es
mov word ptr [0043ED28h], fs
mov word ptr [0043ED24h], gs
pushfd
pop dword ptr [0043ED58h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0043ED4Ch], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [0043ED50h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0043ED5Ch], eax
mov eax, dword ptr [ebp-00000324h]
mov dword ptr [0043EC98h], 00010001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2f35c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40000	0x6280	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x47000	0x1afc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2e90c	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2e928	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x1ec	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x21248	0x21400	3f1efcb5e498393bd3521b7da7842c97	False	0.5795788298872181	MPEG-4 LOAS	6.630648810716619	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0xcea8	0xd000	b3e94a3575b62e3aad2f6189c023817e	False	0.5223294771634616	data	5.97383677665431	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x30000	0xf874	0xc00	fa712c3d503d1593515a35e4bc75a27b	False	0.1318359375	data	1.67626223661243	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x40000	0x6280	0x6400	6f8dd20db08fe009e3df837566485a74	False	0.4543359375	data	4.879978248372994	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x47000	0x1afc	0x1c00	3a6614674722dad462885b32e542d3cb	False	0.7931082589285714	data	6.57465318049585	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x40384	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0, resolution 2835 x 2835 px/m	English	United States	0.6854693140794224
RT_ICON	0x40c2c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0, resolution 2835 x 2835 px/m	English	United States	0.5039868667917449
RT_ICON	0x41cd4	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0, resolution 2835 x 2835 px/m	English	United States	0.5101156069364162
RT_ICON	0x4223c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0, resolution 2835 x 2835 px/m	English	United States	0.6631205673758865
RT_ICON	0x426a4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0, resolution 2835 x 2835 px/m	English	United States	0.4566390041493776
RT_STRING	0x44c4c	0x2f2	data			0.35543766578249336
RT_STRING	0x44f40	0x30c	data			0.3871794871794872
RT_STRING	0x4524c	0x2ce	data			0.42618384401114207
RT_STRING	0x4551c	0x68	data			0.75
RT_STRING	0x45584	0xb4	data			0.6277777777777778
RT_STRING	0x45638	0xae	data			0.5344827586206896
RT_RCDATA	0x456e8	0x2c	data			1.2045454545454546
RT_GROUP_ICON	0x45714	0x4c	data	English	United States	0.7894736842105263
RT_VERSION	0x45760	0x4f4	data	English	United States	0.277602523659306
RT_MANIFEST	0x45c54	0x62c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4240506329113924

Imports

DLL	Import
USER32.dll	CreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongW, GetWindowLongW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, FlushFileBuffers, GetCurrentDirectoryW, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, GetProcAddress, GetEnvironmentStringsW, GetEnvironmentVariableW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, GetCommandLineW, RtlUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, DecodePointer, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, RaiseException, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindClose, FindFirstFileExW, FindNextFileW, SetStdHandle, SetConsoleCtrlHandler, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-21T13:45:22.256926+0100	2056570	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mathcucom .sbs)	1	192.168.2.9	57919	1.1.1.1	53	UDP
2024-11-21T13:45:22.503700+0100	2056568	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (allocatinow .sbs)	1	192.168.2.9	64895	1.1.1.1	53	UDP
2024-11-21T13:45:22.773752+0100	2056566	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (enlargkiw .sbs)	1	192.168.2.9	61039	1.1.1.1	53	UDP
2024-11-21T13:45:23.031762+0100	2056564	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (resinedyw .sbs)	1	192.168.2.9	59111	1.1.1.1	53	UDP
2024-11-21T13:45:23.292257+0100	2056562	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vennurviot .sbs)	1	192.168.2.9	53627	1.1.1.1	53	UDP
2024-11-21T13:45:23.539228+0100	2056560	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ehticsprocw .sbs)	1	192.168.2.9	60602	1.1.1.1	53	UDP
2024-11-21T13:45:23.786678+0100	2056558	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (condifendteu .sbs)	1	192.168.2.9	49306	1.1.1.1	53	UDP
2024-11-21T13:45:24.034227+0100	2056556	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawwyobstacw .sbs)	1	192.168.2.9	61384	1.1.1.1	53	UDP
2024-11-21T13:45:26.060652+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49765	104.102.49.254	443	TCP
2024-11-21T13:45:26.878290+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.9	49765	104.102.49.254	443	TCP
2024-11-21T13:45:27.114029+0100	2057415	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (marshal-zhukov .com)	1	192.168.2.9	63122	1.1.1.1	53	UDP
2024-11-21T13:45:28.616606+0100	2057416	ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI)	1	192.168.2.9	49776	188.114.97.3	443	TCP
2024-11-21T13:45:28.616606+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49776	188.114.97.3	443	TCP
2024-11-21T13:45:29.330441+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49776	188.114.97.3	443	TCP
2024-11-21T13:45:29.330441+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49776	188.114.97.3	443	TCP
2024-11-21T13:45:29.977517+0100	2057416	ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI)	1	192.168.2.9	49780	188.114.97.3	443	TCP
2024-11-21T13:45:29.977517+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49780	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 13:45:24.515242100 CET	49765	443	192.168.2.9	104.102.49.254
Nov 21, 2024 13:45:24.515281916 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:24.515763998 CET	49765	443	192.168.2.9	104.102.49.254
Nov 21, 2024 13:45:24.518544912 CET	49765	443	192.168.2.9	104.102.49.254
Nov 21, 2024 13:45:24.518553972 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:26.060585022 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:26.060652018 CET	49765	443	192.168.2.9	104.102.49.254
Nov 21, 2024 13:45:26.068897963 CET	49765	443	192.168.2.9	104.102.49.254
Nov 21, 2024 13:45:26.068924904 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:26.069195032 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:26.117918015 CET	49765	443	192.168.2.9	104.102.49.254
Nov 21, 2024 13:45:26.122486115 CET	49765	443	192.168.2.9	104.102.49.254
Nov 21, 2024 13:45:26.163336039 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:26.878411055 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:26.878463984 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:26.878480911 CET	49765	443	192.168.2.9	104.102.49.254
Nov 21, 2024 13:45:26.878495932 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:26.878508091 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:26.878525019 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:26.878540993 CET	49765	443	192.168.2.9	104.102.49.254
Nov 21, 2024 13:45:26.878555059 CET	49765	443	192.168.2.9	104.102.49.254
Nov 21, 2024 13:45:26.878556967 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:26.878604889 CET	49765	443	192.168.2.9	104.102.49.254
Nov 21, 2024 13:45:26.878604889 CET	49765	443	192.168.2.9	104.102.49.254
Nov 21, 2024 13:45:26.878607035 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:26.930429935 CET	49765	443	192.168.2.9	104.102.49.254
Nov 21, 2024 13:45:27.097150087 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:27.097162962 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:27.097188950 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:27.097212076 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:27.098473072 CET	49765	443	192.168.2.9	104.102.49.254
Nov 21, 2024 13:45:27.098473072 CET	49765	443	192.168.2.9	104.102.49.254
Nov 21, 2024 13:45:27.098493099 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:27.098746061 CET	49765	443	192.168.2.9	104.102.49.254
Nov 21, 2024 13:45:27.105298996 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:27.105727911 CET	49765	443	192.168.2.9	104.102.49.254
Nov 21, 2024 13:45:27.110918045 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:27.111236095 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:27.112019062 CET	49765	443	192.168.2.9	104.102.49.254
Nov 21, 2024 13:45:27.112019062 CET	49765	443	192.168.2.9	104.102.49.254
Nov 21, 2024 13:45:27.112019062 CET	49765	443	192.168.2.9	104.102.49.254
Nov 21, 2024 13:45:27.112369061 CET	49765	443	192.168.2.9	104.102.49.254
Nov 21, 2024 13:45:27.112380981 CET	443	49765	104.102.49.254	192.168.2.9
Nov 21, 2024 13:45:27.351062059 CET	49776	443	192.168.2.9	188.114.97.3
Nov 21, 2024 13:45:27.351098061 CET	443	49776	188.114.97.3	192.168.2.9
Nov 21, 2024 13:45:27.351341963 CET	49776	443	192.168.2.9	188.114.97.3
Nov 21, 2024 13:45:27.351722002 CET	49776	443	192.168.2.9	188.114.97.3
Nov 21, 2024 13:45:27.351743937 CET	443	49776	188.114.97.3	192.168.2.9
Nov 21, 2024 13:45:28.616449118 CET	443	49776	188.114.97.3	192.168.2.9
Nov 21, 2024 13:45:28.616605997 CET	49776	443	192.168.2.9	188.114.97.3
Nov 21, 2024 13:45:28.618345022 CET	49776	443	192.168.2.9	188.114.97.3
Nov 21, 2024 13:45:28.618355989 CET	443	49776	188.114.97.3	192.168.2.9
Nov 21, 2024 13:45:28.618606091 CET	443	49776	188.114.97.3	192.168.2.9
Nov 21, 2024 13:45:28.619815111 CET	49776	443	192.168.2.9	188.114.97.3
Nov 21, 2024 13:45:28.619844913 CET	49776	443	192.168.2.9	188.114.97.3
Nov 21, 2024 13:45:28.619899988 CET	443	49776	188.114.97.3	192.168.2.9
Nov 21, 2024 13:45:29.330446959 CET	443	49776	188.114.97.3	192.168.2.9
Nov 21, 2024 13:45:29.330547094 CET	443	49776	188.114.97.3	192.168.2.9
Nov 21, 2024 13:45:29.330702066 CET	49776	443	192.168.2.9	188.114.97.3
Nov 21, 2024 13:45:29.330847979 CET	49776	443	192.168.2.9	188.114.97.3
Nov 21, 2024 13:45:29.330862999 CET	443	49776	188.114.97.3	192.168.2.9
Nov 21, 2024 13:45:29.330939054 CET	49776	443	192.168.2.9	188.114.97.3
Nov 21, 2024 13:45:29.330944061 CET	443	49776	188.114.97.3	192.168.2.9
Nov 21, 2024 13:45:29.389620066 CET	49780	443	192.168.2.9	188.114.97.3
Nov 21, 2024 13:45:29.389658928 CET	443	49780	188.114.97.3	192.168.2.9
Nov 21, 2024 13:45:29.389746904 CET	49780	443	192.168.2.9	188.114.97.3
Nov 21, 2024 13:45:29.390088081 CET	49780	443	192.168.2.9	188.114.97.3
Nov 21, 2024 13:45:29.390104055 CET	443	49780	188.114.97.3	192.168.2.9
Nov 21, 2024 13:45:29.977516890 CET	49780	443	192.168.2.9	188.114.97.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 13:45:22.011275053 CET	55500	53	192.168.2.9	1.1.1.1
Nov 21, 2024 13:45:22.253149033 CET	53	55500	1.1.1.1	192.168.2.9
Nov 21, 2024 13:45:22.256926060 CET	57919	53	192.168.2.9	1.1.1.1
Nov 21, 2024 13:45:22.498781919 CET	53	57919	1.1.1.1	192.168.2.9
Nov 21, 2024 13:45:22.503700018 CET	64895	53	192.168.2.9	1.1.1.1
Nov 21, 2024 13:45:22.744905949 CET	53	64895	1.1.1.1	192.168.2.9
Nov 21, 2024 13:45:22.773751974 CET	61039	53	192.168.2.9	1.1.1.1
Nov 21, 2024 13:45:23.016148090 CET	53	61039	1.1.1.1	192.168.2.9
Nov 21, 2024 13:45:23.031761885 CET	59111	53	192.168.2.9	1.1.1.1
Nov 21, 2024 13:45:23.274560928 CET	53	59111	1.1.1.1	192.168.2.9
Nov 21, 2024 13:45:23.292257071 CET	53627	53	192.168.2.9	1.1.1.1
Nov 21, 2024 13:45:23.535934925 CET	53	53627	1.1.1.1	192.168.2.9
Nov 21, 2024 13:45:23.539227962 CET	60602	53	192.168.2.9	1.1.1.1
Nov 21, 2024 13:45:23.783781052 CET	53	60602	1.1.1.1	192.168.2.9
Nov 21, 2024 13:45:23.786678076 CET	49306	53	192.168.2.9	1.1.1.1
Nov 21, 2024 13:45:24.032608032 CET	53	49306	1.1.1.1	192.168.2.9
Nov 21, 2024 13:45:24.034226894 CET	61384	53	192.168.2.9	1.1.1.1
Nov 21, 2024 13:45:24.278294086 CET	53	61384	1.1.1.1	192.168.2.9
Nov 21, 2024 13:45:24.281472921 CET	57240	53	192.168.2.9	1.1.1.1
Nov 21, 2024 13:45:24.508641005 CET	53	57240	1.1.1.1	192.168.2.9
Nov 21, 2024 13:45:27.114028931 CET	63122	53	192.168.2.9	1.1.1.1
Nov 21, 2024 13:45:27.349638939 CET	53	63122	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 13:45:22.011275053 CET	192.168.2.9	1.1.1.1	0xcdb9	Standard query (0)	droppyrelivei.cfd	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:22.256926060 CET	192.168.2.9	1.1.1.1	0xc1cb	Standard query (0)	mathcucom.sbs	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:22.503700018 CET	192.168.2.9	1.1.1.1	0x8738	Standard query (0)	allocatinow.sbs	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:22.773751974 CET	192.168.2.9	1.1.1.1	0x83d6	Standard query (0)	enlargkiw.sbs	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:23.031761885 CET	192.168.2.9	1.1.1.1	0x60fd	Standard query (0)	resinedyw.sbs	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:23.292257071 CET	192.168.2.9	1.1.1.1	0x202b	Standard query (0)	vennurviot.sbs	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:23.539227962 CET	192.168.2.9	1.1.1.1	0xf2d2	Standard query (0)	ehticsprocw.sbs	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:23.786678076 CET	192.168.2.9	1.1.1.1	0x824a	Standard query (0)	condifendteu.sbs	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:24.034226894 CET	192.168.2.9	1.1.1.1	0xbafc	Standard query (0)	drawwyobstacw.sbs	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:24.281472921 CET	192.168.2.9	1.1.1.1	0xd211	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:27.114028931 CET	192.168.2.9	1.1.1.1	0x99e4	Standard query (0)	marshal-zhukov.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 13:44:59.116725922 CET	1.1.1.1	192.168.2.9	0x5269	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 13:44:59.116725922 CET	1.1.1.1	192.168.2.9	0x5269	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:22.253149033 CET	1.1.1.1	192.168.2.9	0xcdb9	Name error (3)	droppyrelivei.cfd	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:22.498781919 CET	1.1.1.1	192.168.2.9	0xc1cb	Name error (3)	mathcucom.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:22.744905949 CET	1.1.1.1	192.168.2.9	0x8738	Name error (3)	allocatinow.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:23.016148090 CET	1.1.1.1	192.168.2.9	0x83d6	Name error (3)	enlargkiw.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:23.274560928 CET	1.1.1.1	192.168.2.9	0x60fd	Name error (3)	resinedyw.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:23.535934925 CET	1.1.1.1	192.168.2.9	0x202b	Name error (3)	vennurviot.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:23.783781052 CET	1.1.1.1	192.168.2.9	0xf2d2	Name error (3)	ehticsprocw.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:24.032608032 CET	1.1.1.1	192.168.2.9	0x824a	Name error (3)	condifendteu.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:24.278294086 CET	1.1.1.1	192.168.2.9	0xbafc	Name error (3)	drawwyobstacw.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:24.508641005 CET	1.1.1.1	192.168.2.9	0xd211	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:27.349638939 CET	1.1.1.1	192.168.2.9	0x99e4	No error (0)	marshal-zhukov.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:45:27.349638939 CET	1.1.1.1	192.168.2.9	0x99e4	No error (0)	marshal-zhukov.com		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

marshal-zhukov.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49765	104.102.49.254	443	2976	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 12:45:26 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-11-21 12:45:26 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 21 Nov 2024 12:45:26 GMT Content-Length: 35604 Connection: close Set-Cookie: sessionid=38400b1f7eb6985721b07fb4; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C820d04e8bfee2ac1774d9f20f79a4923; Path=/; Secure; HttpOnly; SameSite=None
2024-11-21 12:45:26 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-11-21 12:45:27 UTC	16384	IN	Data Raw: 0d 0a 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 6d 61 72 6b 65 74 2f 22 3e 0d 0a 09 09 09 09 09 09 4d 61 72 6b 65 74 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0d 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 Data Ascii: Workshop</a><a class="submenuitem" href="https://steamcommunity.com/market/">Market</a><a class="submenuitem" href="https://steamcommunity.com/?subsection=broadcasts">Broadcasts
2024-11-21 12:45:27 UTC	3768	IN	Data Raw: 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 70 65 72 73 6f 6e 61 5f 6c 65 76 65 6c 5f 62 74 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 70 72 6f 66 69 6c 65 73 2f 37 36 35 36 31 31 39 39 37 32 34 33 33 31 39 30 30 2f 62 61 64 67 65 73 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 20 70 65 72 73 6f 6e 61 5f 6c 65 76 65 6c 22 3e 4c 65 Data Ascii: <a data-panel="{"focusable":true,"clickOnActivate":true}" class="persona_level_btn" href="https://steamcommunity.com/profiles/76561199724331900/badges"><div class="persona_name persona_level">Le
2024-11-21 12:45:27 UTC	973	IN	Data Raw: 75 6e 69 74 79 2e 63 6f 6d 2f 6c 69 6e 6b 66 69 6c 74 65 72 2f 3f 75 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 77 2e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 20 6e 6f 6f 70 65 6e 65 72 22 3e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 3c 2f 61 3e 2e 09 09 09 09 09 3c 62 72 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 76 61 6c 76 65 5f 6c 69 6e 6b 73 22 3e 0d 0a 09 09 09 09 09 09 09 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 70 72 69 76 61 63 79 5f 61 67 72 65 65 6d 65 6e 74 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 50 72 69 76 61 63 79 20 50 6f 6c 69 63 79 3c 2f 61 3e 0d Data Ascii: unity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org" target="_blank" rel=" noopener">geonames.org</a>.<br><span class="valve_links"><a href="http://store.steampowered.com/privacy_agreement/" target="_blank">Privacy Policy</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49776	188.114.97.3	443	2976	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 12:45:28 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: marshal-zhukov.com
2024-11-21 12:45:28 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-21 12:45:29 UTC	996	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 12:45:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4tog8l1sa2o4p5umdlb4j6jduo; expires=Mon, 17-Mar-2025 06:32:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5FNXsAT213ebUZ6c%2Bkonky1fjRZwSz7%2FwnN30erQV8I4O1%2BRWZSiPBgLXhemZr%2BehZGXrRTgA%2Fhf2yYAW0d2cjaABZgMdcgtX7CVRD0tLQiKe4N4zTDdwwFmIbjFgAgWRzy%2BISc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e60c6ef9fd4440d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1594&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=909&delivery_rate=1855146&cwnd=191&unsent_bytes=0&cid=b00b79f4cf7c4bd4&ts=725&x=0"
2024-11-21 12:45:29 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-21 12:45:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	07:45:17
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\ceFgl3jkkk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ceFgl3jkkk.exe"
Imagebase:	0xf50000
File size:	7'166'290 bytes
MD5 hash:	9CF2FCABD10EE683A3652815014B368C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:45:18
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\ceFgl3jkkk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ceFgl3jkkk.exe"
Imagebase:	0xf50000
File size:	7'166'290 bytes
MD5 hash:	9CF2FCABD10EE683A3652815014B368C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:45:20
Start date:	21/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngentask.exe
Imagebase:	0xc40000
File size:	79'816 bytes
MD5 hash:	AE933850C93D3B3001AB21BB65C3EFA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	127

Executed Functions

Function 00F6D933 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNELBASE(?,?,00000000,?,?,00000000,?,?,?,?,?,?,00F6DB54,?,?,00000000), ref: 00F6D9A5
_free.LIBCMT ref: 00F6D993

Part of subcall function 00F63B77: RtlFreeHeap.NTDLL(00000000,00000000,?,00F62C8E), ref: 00F63B8D
Part of subcall function 00F63B77: GetLastError.KERNEL32(?,?,00F62C8E), ref: 00F63B9F

_free.LIBCMT ref: 00F6DB5D

Strings

Eastern Standard Time, xrefs: 00F6DA3E
Eastern Summer Time, xrefs: 00F6DA52

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 2155170405-239921721
Opcode ID: 45c5749a6ab7fccdc540e9746cd5d4ba24649f470c1dd7bc3f9fa6649ea75e72
Instruction ID: 04cdd94319d99f13b46b070cb419296252cf97df02765f477dc7c1855cc33a78
Opcode Fuzzy Hash: 45c5749a6ab7fccdc540e9746cd5d4ba24649f470c1dd7bc3f9fa6649ea75e72
Instruction Fuzzy Hash: 3D512C72E00219AFDB10BFB4DC05AAE7B78EF45320F114265F814A7162E7749E44FB91

Function 00F603E2 Relevance: 6.2, APIs: 4, Instructions: 194
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileExW.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 00F6042B
GetLastError.KERNEL32 ref: 00F60438

Part of subcall function 00F60624: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,00F604A8,?), ref: 00F60649
Part of subcall function 00F60624: SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,00F604A8,?,?,?,?,00F604A8,?), ref: 00F6065D

FindNextFileW.KERNELBASE(?,?,?), ref: 00F6055A
GetLastError.KERNEL32 ref: 00F60564

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: Time$File$ErrorFindLastSystem$FirstLocalNextSpecific
String ID:
API String ID: 3693236040-0
Opcode ID: 1ef43ae719ea4d41e39593a6c510343d3422047d9851d5b72f8589d419d356f9
Instruction ID: 0ae6789b775f2cab069fe7cd0f2c318e5b4abd73dd0ef3a09e83c59c552c8d7b
Opcode Fuzzy Hash: 1ef43ae719ea4d41e39593a6c510343d3422047d9851d5b72f8589d419d356f9
Instruction Fuzzy Hash: E551D7B19006189FCB35EFB4CC85AABB7E8AF44314F240A56E516C7281EF78DE44AF50

Function 00F627A5 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00F627A4,?,?,?,?,?,00F5C00A), ref: 00F627C7
TerminateProcess.KERNEL32(00000000,?,00F627A4,?,?,?,?,?,00F5C00A), ref: 00F627CE
ExitProcess.KERNEL32 ref: 00F627E0

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0b6b6f1089981358f8e89a7c8722e8e47401efdfd1f8d5fa4a1b7ba3537c6626
Instruction ID: ed649b7f3ef905d911cfbafec6c0ba88809bbd567e01d6bedf1300f94c5e6612
Opcode Fuzzy Hash: 0b6b6f1089981358f8e89a7c8722e8e47401efdfd1f8d5fa4a1b7ba3537c6626
Instruction Fuzzy Hash: 4FE04631400548EFCF11AF24CC48D083B68EB00351B004520F80A8A532CB39EE81FB91

Function 00F6A500 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900c08fc981e5ef944cc89794b80ef5ed10540dc5ba515face4f6b17785decd5
Instruction ID: 50dbc74f2589089a0f664e743bf123a00f88265fa4325fb2003e0b7cffeda9f2
Opcode Fuzzy Hash: 900c08fc981e5ef944cc89794b80ef5ed10540dc5ba515face4f6b17785decd5
Instruction Fuzzy Hash: 00E0EC72A15228EBCB25DB98CE5499AF3ECEB45B54B154496F502E3211C274DE00DBD1

Function 00F51740 Relevance: 21.2, APIs: 2, Strings: 10, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 00F517ED
__fread_nolock.LIBCMT ref: 00F518B8

Strings

malloc, xrefs: 00F5188E
MEI, xrefs: 00F51778
Could not read full TOC!, xrefs: 00F518C5
Failed to seek to cookie position!, xrefs: 00F517BC
Could not allocate buffer for TOC!, xrefs: 00F51889
fread, xrefs: 00F517FF
Cannot read Table of Contents., xrefs: 00F5193C
Failed to read cookie!, xrefs: 00F517FA
Error on file., xrefs: 00F518E6
fseek, xrefs: 00F517C1

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: __fread_nolock
String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 2638373210-4158440160
Opcode ID: 16c3acf06c030273789f5fab58a663d5feaed36387aa3a9e0eff2e242480517d
Instruction ID: 5ecc2a3e2051054b1bfb9eef16c1b2163bd7af2362ac5ce5d6a4da7e54919e3e
Opcode Fuzzy Hash: 16c3acf06c030273789f5fab58a663d5feaed36387aa3a9e0eff2e242480517d
Instruction Fuzzy Hash: 2F51E771A007009BC718DF28DC46A16B7E1BF48322F548A2DFA4EC3691E675E54CEB43

Function 00F51420 Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00F51528
Failed to extract %s: failed to open archive file!, xrefs: 00F514A5
fopen, xrefs: 00F5146B
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00F51523
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00F514D7
Failed to extract %s: failed to read data chunk!, xrefs: 00F515BE
fread, xrefs: 00F515C3
Failed to extract %s: failed to open target file!, xrefs: 00F51466
Failed to extract %s: failed to write data chunk!, xrefs: 00F515AE
fwrite, xrefs: 00F515B3
fseek, xrefs: 00F514DC

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 0-666925554
Opcode ID: 1e6bf7b924d69f67a83b75b114bc6609f55c22b1bb81876c1e645a4ed79d867f
Instruction ID: 96207dbf7a00217aa2da507d7a371771fc96c37ba47a9ff36addc99ef167012b
Opcode Fuzzy Hash: 1e6bf7b924d69f67a83b75b114bc6609f55c22b1bb81876c1e645a4ed79d867f
Instruction Fuzzy Hash: AB4149B2E0030177EB20AE646C46B6B3655BBC0766F084625FF19562C2F775EB0CB293

Function 00F56830 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000008,?,00000000,?), ref: 00F5686E
OpenProcessToken.ADVAPI32(00000000), ref: 00F56875
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 00F5688C
GetLastError.KERNEL32 ref: 00F56896
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,?,?,?,?,?,00F5142E,?,00000000,00F52AFF,?,?,?,?), ref: 00F568C5
ConvertSidToStringSidW.ADVAPI32(00000000,?), ref: 00F568D6
CloseHandle.KERNEL32(00000000,?,?,00F5142E,?,00000000,00F52AFF,?,?,?,?,00000000), ref: 00F568EE
LocalFree.KERNEL32(?,?,?,?,?,?,?,00F5142E,?,00000000,00F52AFF,?,?,?,?,00000000), ref: 00F5691B
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,?,?,00000001), ref: 00F5693F
CreateDirectoryW.KERNELBASE(?,?,?), ref: 00F5694E

Strings

S-1-3-4, xrefs: 00F568F8, 00F56902
D:(A;;FA;;;%s), xrefs: 00F56903

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: fd31dcb2908cc6c3d9558a4040b8aaa2d2ee05368cea22a8aeaecb99b00890dc
Instruction ID: 366b5da641f052b7a0655d211586edbde62c037c87c26d97b55c3eede81fffbe
Opcode Fuzzy Hash: fd31dcb2908cc6c3d9558a4040b8aaa2d2ee05368cea22a8aeaecb99b00890dc
Instruction Fuzzy Hash: AF31A271504315ABE720DF20DC49B9BBBE8EF48361F840919FA68D2191D774DA4CEBA3

Function 00F644F5 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00F6477D

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: aea0334473c4d0b6b232e3e03ae3b2abd8ea6ab403e7d246086e65437f25ec74
Instruction ID: a7a0e8eb29fb076b53c19a031dd8d6fd14bd5957a19ae675367737c91044f0fd
Opcode Fuzzy Hash: aea0334473c4d0b6b232e3e03ae3b2abd8ea6ab403e7d246086e65437f25ec74
Instruction Fuzzy Hash: B2C11575E04249AFCF15EFA8CC80BBDBBB0AF4A310F144159E9159B292C734AE41EB21

Function 00F6E4D6 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F6E21D: CreateFileW.KERNELBASE(00000000,00000000,?,00F6E57F,?,?,00000000,?,00F6E57F,00000000,0000000C), ref: 00F6E23A

GetLastError.KERNEL32 ref: 00F6E5EA
__dosmaperr.LIBCMT ref: 00F6E5F1
GetFileType.KERNELBASE(00000000), ref: 00F6E5FD
GetLastError.KERNEL32 ref: 00F6E607
__dosmaperr.LIBCMT ref: 00F6E610
CloseHandle.KERNEL32(00000000), ref: 00F6E630
CloseHandle.KERNEL32(00000000), ref: 00F6E77D
GetLastError.KERNEL32 ref: 00F6E7AF
__dosmaperr.LIBCMT ref: 00F6E7B6

Strings

H, xrefs: 00F6E73B

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 431752f102ec7e2622de3b71c8dc9f2c8d2e66beb5f2d40c5df46ba4aa6496fc
Instruction ID: a4914d0f7dfa9b9710d8b369e1f4e1515fb203e412ab33096a17686aa72cbc8c
Opcode Fuzzy Hash: 431752f102ec7e2622de3b71c8dc9f2c8d2e66beb5f2d40c5df46ba4aa6496fc
Instruction Fuzzy Hash: 69A14637A101189FCF19DF68DC51BEE3BA1AB06324F28015DE812EF292DB358D16EB51

Function 00F6D692 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 330
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 00F6D74F
_free.LIBCMT ref: 00F6D91B
_free.LIBCMT ref: 00F6D993
GetTimeZoneInformation.KERNELBASE(?,?,00000000,?,?,00000000,?,?,?,?,?,?,00F6DB54,?,?,00000000), ref: 00F6D9A5

Strings

Eastern Standard Time, xrefs: 00F6DA3E
Eastern Summer Time, xrefs: 00F6DA52

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _free$InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 597776487-239921721
Opcode ID: 11cb2e2517ef357f9062740e4738fe95859ca88b223a66d30342b10233e8c4f6
Instruction ID: d825624d30430361a82a9d734e65692aca9072600b93619af88ae2d7305dddf3
Opcode Fuzzy Hash: 11cb2e2517ef357f9062740e4738fe95859ca88b223a66d30342b10233e8c4f6
Instruction Fuzzy Hash: 26A12472F00219AFDB10AFB4DC42ABE7BB8EF44720F144169E904A7191EB349E45FB91

Function 00F51040 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00F510B6, 00F510E8
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00F5107E
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00F510B1
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00F511DE
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00F510E3
1.2.11, xrefs: 00F5104D

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID: 1.2.11$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 0-1060636955
Opcode ID: 92f3772ba986257c0679539743479cca398b2f2067041c74c234505cf22c2d4e
Instruction ID: 7f51e05d369b6216dd8425dd802cdf752b2134067000c3176bb48a8794fd94db
Opcode Fuzzy Hash: 92f3772ba986257c0679539743479cca398b2f2067041c74c234505cf22c2d4e
Instruction Fuzzy Hash: 1B51F771D043005BD3109F689C82B5BBBE8BF45762F04096DFF48D6282E765EA0CA793

Function 00F560F0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 100
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F56990: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,00F5246C,?,?,00000400,?,00000000,00000800), ref: 00F569A8

Part of subcall function 00F60F12: SetConsoleCtrlHandler.KERNEL32(00F60B95,00000001,00F7EE98,00000018,00000003,00F7EEB8), ref: 00F6102A

Part of subcall function 00F60F12: GetLastError.KERNEL32 ref: 00F61044

GetStartupInfoW.KERNEL32(?), ref: 00F5616B
GetCommandLineW.KERNEL32(?,00000000,00000001,00000000,00000000,00000000,?,?), ref: 00F561FC
CreateProcessW.KERNELBASE(?,00000000), ref: 00F5620B
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00F5621B
GetExitCodeProcess.KERNELBASE(?,00000000), ref: 00F56229

Strings

CreateProcessW, xrefs: 00F5624C
Error creating child process!, xrefs: 00F56247

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: Process$ByteCharCodeCommandConsoleCreateCtrlErrorExitHandlerInfoLastLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 1248179626-3524285272
Opcode ID: 19799a9b8f928aa4837bc36d50b763cdeff8f77d1e4a50297e7cf5be1b7ba8e5
Instruction ID: 07dea62a8891e7f97d8b8b6f8fcdbe468af907573e13a5ce9da34248cc774f38
Opcode Fuzzy Hash: 19799a9b8f928aa4837bc36d50b763cdeff8f77d1e4a50297e7cf5be1b7ba8e5
Instruction Fuzzy Hash: DB319370A08344ABEB10EFA0CC4AB4B77E8AF44705F504919B694961C2DBFDD558EB53

Function 00F670E9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ext-ms-, xrefs: 00F67154
api-ms-, xrefs: 00F67140

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: a0932203a1c304cb69444c85e3e16df8b7be7887f7c26664a1fdd71369748fb6
Instruction ID: 378f146946c2a4c7c8d676ad1a4221bf3766984b1555ba7ffe014a561a214a2b
Opcode Fuzzy Hash: a0932203a1c304cb69444c85e3e16df8b7be7887f7c26664a1fdd71369748fb6
Instruction Fuzzy Hash: E1210A32E09325BBDB22AB349C44B5A77599F437BCF250523ED09A7292D630DE01F6E1

Function 00F6565B Relevance: 4.7, APIs: 3, Instructions: 170
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F64DEE: GetConsoleOutputCP.KERNEL32(?,00000000,?), ref: 00F64E36

WriteFile.KERNELBASE(?,?,?,00F7F0D8,00000000,00000000,00000000,00000000,?,00F7F0D8,00000010,00F5BEDB,00000000,00000000,00000000), ref: 00F657A1
GetLastError.KERNEL32(?,00000000,?,00000000), ref: 00F657AB
__dosmaperr.LIBCMT ref: 00F657EA

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite__dosmaperr
String ID:
API String ID: 910155933-0
Opcode ID: 03ed0484e48cbcc678d9981a216c154793af50b87f5802fc9fdd5145aaa10335
Instruction ID: bfd6f87ddc29423d1a46e34305079589e954682fe9c9ef9748d07abdeb478683
Opcode Fuzzy Hash: 03ed0484e48cbcc678d9981a216c154793af50b87f5802fc9fdd5145aaa10335
Instruction Fuzzy Hash: 2751D076D00A0AEBDF15DFA4CC05BEE7BB9AF55B24F180045E800BB152D635DA41FB61

Function 00F6DA8D Relevance: 4.6, APIs: 3, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 00F6DB5D

Part of subcall function 00F6D933: _free.LIBCMT ref: 00F6D993
Part of subcall function 00F6D933: GetTimeZoneInformation.KERNELBASE(?,?,00000000,?,?,00000000,?,?,?,?,?,?,00F6DB54,?,?,00000000), ref: 00F6D9A5

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: 5bffe0377b4ab1e74b585ff2c536d2b0c79aa92047fce57eb19db8f887b452ea
Instruction ID: 95a12717d86a764bc90b88dd0a09c79ca27be616c30bf853eacc21f9e10e9777
Opcode Fuzzy Hash: 5bffe0377b4ab1e74b585ff2c536d2b0c79aa92047fce57eb19db8f887b452ea
Instruction Fuzzy Hash: C1212673E00319A6CB20AB358C45EBA73BCDFC0324F224265E565A7192EF749E45B650

Function 00F63CCA Relevance: 4.6, APIs: 3, Instructions: 61
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,00F63BF8,?,00F7F038,0000000C,00F63CAA,?,?,?), ref: 00F63D20
GetLastError.KERNEL32(?,00F63BF8,?,00F7F038,0000000C,00F63CAA,?,?,?), ref: 00F63D2A
__dosmaperr.LIBCMT ref: 00F63D55

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: cbeec3b724bd6bc1322411d6eb8fdfbf1c073c406e7141d9b3868d8ea3b7b297
Instruction ID: 1675435a84074543a518818187f7684e68433e5bb0626e246cdd708320fd5a51
Opcode Fuzzy Hash: cbeec3b724bd6bc1322411d6eb8fdfbf1c073c406e7141d9b3868d8ea3b7b297
Instruction Fuzzy Hash: CD018E33F0026C1BC2205374DC06B7E77884F82774F38025DF818971C2DE698E817290

Function 00F64B46 Relevance: 4.5, APIs: 3, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00000002,00000000,00000000,?,00000000,00000000,00000000,?,00F64BF3,00000000,00000000,00000002,00000000), ref: 00F64B7F
GetLastError.KERNEL32(?,00F64BF3,00000000,00000000,00000002,00000000,?,00F656E7,00000000,00000000,00000000,00000002,00000000,00000000,00000000,?), ref: 00F64B89
__dosmaperr.LIBCMT ref: 00F64B90

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: bb3a9f583bf9ebc3ca19c95d4aa6e6f5b1be245641caa32a89aacbf4ed7b3c77
Instruction ID: ad79fd64dd8721ce693d9f515998a546d84c12524825a32f6cd3a6de087449d8
Opcode Fuzzy Hash: bb3a9f583bf9ebc3ca19c95d4aa6e6f5b1be245641caa32a89aacbf4ed7b3c77
Instruction Fuzzy Hash: DA01D833610518BBCB059B99DC45DAE3B29DBC5330B340248F952971D1EA74EE41B750

Function 00F610D1 Relevance: 4.5, APIs: 3, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 00F610D9
GetLastError.KERNEL32 ref: 00F610E3
__dosmaperr.LIBCMT ref: 00F610EA

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID:
API String ID: 1545401867-0
Opcode ID: b24f01813a618321da0e741e1eef1aefe3d8761d1631a537e620f0965bca4775
Instruction ID: 18a8b2e30c9783e7a95101a8ebf6dcacd5fef14d15b700ce70444c4cd6b8b048
Opcode Fuzzy Hash: b24f01813a618321da0e741e1eef1aefe3d8761d1631a537e620f0965bca4775
Instruction Fuzzy Hash: 81D0123250825C7B8F102BF5BD098177B5D9B803797140665FA3CC54A0EE35CAD0B551

Function 00F603BA Relevance: 4.5, APIs: 3, Instructions: 17COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE(?), ref: 00F603C2
GetLastError.KERNEL32 ref: 00F603CC
__dosmaperr.LIBCMT ref: 00F603D3

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: DirectoryErrorLastRemove__dosmaperr
String ID:
API String ID: 4061612599-0
Opcode ID: 6c33a79fcf4f3ecaf10a6158a32c432eea0fa7ead880a7e4e351e019804ece17
Instruction ID: bc3f5f78d97fb18341b9472c24dbc48779b83f0f0ebfcadf0163253676f1f3cc
Opcode Fuzzy Hash: 6c33a79fcf4f3ecaf10a6158a32c432eea0fa7ead880a7e4e351e019804ece17
Instruction Fuzzy Hash: A3D0123250420C778F002BF6BC098177F5C9B817797240651F62CC51E0FE75CA90F551

Function 00F5E7ED Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 743a8a1489fe49b5f73c151042bfa6c5f9fdb502205f960bb9f56359e76b3a77
Instruction ID: d83dc877b67e1c5f115108f63999c206d2d7de3ed9e3405fb0ce5b1450cdb9ff
Opcode Fuzzy Hash: 743a8a1489fe49b5f73c151042bfa6c5f9fdb502205f960bb9f56359e76b3a77
Instruction Fuzzy Hash: A8210A32D00218BBEB156B689C46B9F37689F4237BF110361FE282B1D1D7745F0AB661

Function 00F68EB6 Relevance: 3.1, APIs: 2, Instructions: 86COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F68F25
_free.LIBCMT ref: 00F68F54

Part of subcall function 00F63002: IsProcessorFeaturePresent.KERNEL32(00000017,00F66310,?,?,?,00F5C00A,?,?,?), ref: 00F6301E

Part of subcall function 00F63B43: IsProcessorFeaturePresent.KERNEL32(00000017,00F63B32,?,?,?,00F5C00A,?,?,?,00F63B3F,00000000,00000000,00000000,00000000,00000000,00F60DAF), ref: 00F63B45
Part of subcall function 00F63B43: GetCurrentProcess.KERNEL32(C0000417,?,?), ref: 00F63B68
Part of subcall function 00F63B43: TerminateProcess.KERNEL32(00000000,?,?), ref: 00F63B6F

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: FeaturePresentProcessProcessor_free$CurrentTerminate
String ID:
API String ID: 1729132349-0
Opcode ID: 441ab995d3c5caf028862ac26d7383f3f313465e48e2e461208a5307e5e935de
Instruction ID: a41578ee7816f8ae14b1c5ee55acb9d6c29581c8e0ef8f381aeb53bb3a751986
Opcode Fuzzy Hash: 441ab995d3c5caf028862ac26d7383f3f313465e48e2e461208a5307e5e935de
Instruction Fuzzy Hash: BB21F676A04201ABDF289FA8CC41A7AB7AADF94754B28826CE905C7105FB72DD42E710

Function 00F60624 Relevance: 3.0, APIs: 2, Instructions: 49timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,00F604A8,?), ref: 00F60649
SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,00F604A8,?,?,?,?,00F604A8,?), ref: 00F6065D

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 5e2cdabac6e38a3707160d2a36151df2deffaec7139b2f7b059ccfe555783e28
Instruction ID: 5f6e0dac4d4abf261634e50b92306f4d84aac1ac4468647992b2ef7bcfa1738a
Opcode Fuzzy Hash: 5e2cdabac6e38a3707160d2a36151df2deffaec7139b2f7b059ccfe555783e28
Instruction Fuzzy Hash: 40016961A00108AACB10DB9ACD04BBFB3FCAB4C711F604151F955E60C0EA78DE90E731

Function 00F615D8 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f6b945254909cfc76e1310d7d940492520b8a62310ebc3fcd86163cea8f9bd5
Instruction ID: 66cdf32264a3599041b57c3d7030ed707ed2f402daca8f1a3faeac4a5d9ac512
Opcode Fuzzy Hash: 9f6b945254909cfc76e1310d7d940492520b8a62310ebc3fcd86163cea8f9bd5
Instruction Fuzzy Hash: 2B410375E00208AFDB14DF58CC81AA97BB2FB89364F2C8168F8499B351D771DE42EB50

Function 00F562C0 Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00F56381

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: bcf2554fb0783684e5168670dd69d47ebba68a10aac5036646c0b279e9b13442
Instruction ID: f97fec9e9f030ba093166362ebcd9374224453f0d446ef39276d318ccc1e00ff
Opcode Fuzzy Hash: bcf2554fb0783684e5168670dd69d47ebba68a10aac5036646c0b279e9b13442
Instruction Fuzzy Hash: D0410972E0470157D7208A288C4171BBB92AF9533AFA94724FEB4D33C5EB25EC8D5292

Function 00F671B0 Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbdc0820e60ef6b5c02852c9838e6dbde2c219231d4c2634b3c3e2098b1b19d0
Instruction ID: d33b6fc810dc9a0516b7e832264c5b719ef5d9e796f19fcaff3039d439cc8d82
Opcode Fuzzy Hash: cbdc0820e60ef6b5c02852c9838e6dbde2c219231d4c2634b3c3e2098b1b19d0
Instruction Fuzzy Hash: BD0128377083195F9F11AE6DED50AAB3396EBC53383248120FA14CB158EA30C801BB50

Function 00F60100 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F6017A

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 91ea42b288042c1d6eea06cba602b4fbfa602196ec093dd552887068233722f2
Instruction ID: 2d79281d3b0fe42ce6dd1f4e422fa2f12d739a569e18cfeca0a449173623daec
Opcode Fuzzy Hash: 91ea42b288042c1d6eea06cba602b4fbfa602196ec093dd552887068233722f2
Instruction Fuzzy Hash: 340126379086186ADA261A69BC02BBB33A9CF83770F30432AF428871D1CF744941B790

Function 00F683F9 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00F68433

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 2fe2e3197cdd298c95c29f29c8ab82eb04910d717c57a7ffdefd5c7d3e99af51
Instruction ID: b47e434e2d21b111a8465f1b092a3887b98e016366cb9959fc3150357e01a7d9
Opcode Fuzzy Hash: 2fe2e3197cdd298c95c29f29c8ab82eb04910d717c57a7ffdefd5c7d3e99af51
Instruction Fuzzy Hash: A3115AB1A0010AAFCF05DF58E94199F7BF4EF48304F044069F804EB251DA30DA12DB64

Function 00F5B5E5 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d8cb16c0ed68794755dee3499a829f3980c3b08fb60c41143e5e71e23a383f7
Instruction ID: 100c7452f0deb6b0d23e240a3caaaeb17fbaae67ae8569e991c19c1506b6a2a0
Opcode Fuzzy Hash: 0d8cb16c0ed68794755dee3499a829f3980c3b08fb60c41143e5e71e23a383f7
Instruction Fuzzy Hash: C9F0FC32901E145AD7213B6ADC05B5B36E88F81376F140755FE38931D1CB7DE90ABBA1

Function 00F67024 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00F663F6,00000001,00000364,00000006,000000FF,?,?,00F5E61E,00F63B9D,?,?,00F62C8E), ref: 00F67065

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4f595e8d34d4b131a741000f2197e8a270a8dbc5d6f4d5ba275a44650c1a2156
Instruction ID: dfc755ca9c7628ede7eaa05474e3197fa3aad0c210fd61459e14adb2f4c8c4f3
Opcode Fuzzy Hash: 4f595e8d34d4b131a741000f2197e8a270a8dbc5d6f4d5ba275a44650c1a2156
Instruction Fuzzy Hash: F8F0BE32A08329B6EB317B629C15B6B37589B817B8B244121FC08AA1C0CB24D841B6F0

Function 00F65BA2 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00F60F97,00F7EE98,00000018,00000003,00F7EEB8), ref: 00F65BD4

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 81edc46d480ececd6ba9d3873fcde259bf81b5642f897dd4fd5ae207ff66cab5
Instruction ID: fc02fb2bba9634e03361d370ad02d32b42a880e516708c6aca3ca04088f08efa
Opcode Fuzzy Hash: 81edc46d480ececd6ba9d3873fcde259bf81b5642f897dd4fd5ae207ff66cab5
Instruction Fuzzy Hash: 53E0E531904A3857E62126629C01B5E36589BC2BF0F590021EC08B20C0DF50DC0072E5

Function 00F63ECC Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F63EF0

Part of subcall function 00F63B77: RtlFreeHeap.NTDLL(00000000,00000000,?,00F62C8E), ref: 00F63B8D
Part of subcall function 00F63B77: GetLastError.KERNEL32(?,?,00F62C8E), ref: 00F63B9F

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: d506a703889d1df9b84338a8fc89d2461505e676fc6750c7c70b1ee1d0b25cda
Instruction ID: 68d517dbbbab155f516ebd410f7eab8e7d3e5845cae8cc1f0d9716a8d14d35cf
Opcode Fuzzy Hash: d506a703889d1df9b84338a8fc89d2461505e676fc6750c7c70b1ee1d0b25cda
Instruction Fuzzy Hash: B4F06D375502059F8724CE6CD900A82BBE4EF993217108529E89DD3220D330F912CB80

Function 00F6E21D Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00F6E57F,?,?,00000000,?,00F6E57F,00000000,0000000C), ref: 00F6E23A

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7981c14998fc25a05b7d19db6cf91c22a0eae49ebeeaf885383825aaae4742d4
Instruction ID: f10a66afa7e949adf7d90b9b5c31a54a8b797fbcd415b6d70d92198432e69040
Opcode Fuzzy Hash: 7981c14998fc25a05b7d19db6cf91c22a0eae49ebeeaf885383825aaae4742d4
Instruction Fuzzy Hash: F6D06C3210010DBBDF028F84DC06EDA3BAAFB4C714F018000FA5856020C772E961EB91

Function 00F5E365 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F5E378

Part of subcall function 00F63B77: RtlFreeHeap.NTDLL(00000000,00000000,?,00F62C8E), ref: 00F63B8D
Part of subcall function 00F63B77: GetLastError.KERNEL32(?,?,00F62C8E), ref: 00F63B9F

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: cb0e52e07d19aed88f44ef5871020cea48750a9e516630401a30a74b753e8c05
Instruction ID: 2de662f20f6b9d75b6e0769f2c72da5dfc320ee6b1c78629d1e5ea01de47a5b6
Opcode Fuzzy Hash: cb0e52e07d19aed88f44ef5871020cea48750a9e516630401a30a74b753e8c05
Instruction Fuzzy Hash: 97C04C71500248BBDB059B45D907E5E7BB9DB80364F204054F41557261DBB5EF44A690

Function 00F56460 Relevance: 1.4, APIs: 1, Instructions: 106sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 00F5657F

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5d037b7396cf98bd72f949f132a1c114faf31c8eb87b27607e9f51cac269a884
Instruction ID: 83793a0b79842f7b78785cada9dd7548e86e8ab0253ec17c622fd13013a9f867
Opcode Fuzzy Hash: 5d037b7396cf98bd72f949f132a1c114faf31c8eb87b27607e9f51cac269a884
Instruction Fuzzy Hash: F8310662A0024556EB24EF20CC017FB73A6EFA4765FC84925EE56C7209F772DA48E261

Non-executed Functions

Function 00F55270 Relevance: 164.9, APIs: 31, Strings: 63, Instructions: 443libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00F531FD,Tcl_Init), ref: 00F55282
GetProcAddress.KERNEL32(00F531FD,Tcl_CreateInterp), ref: 00F552AB

Part of subcall function 00F52290: GetLastError.KERNEL32(?,00000000), ref: 00F522AD

Strings

Tcl_GetVar2, xrefs: 00F5550C
Tcl_CreateInterp, xrefs: 00F552A5
Failed to get address for Tcl_SetVar2Ex, xrefs: 00F55613
Failed to get address for Tcl_DoOneEvent, xrefs: 00F55308
Failed to get address for Tcl_Alloc, xrefs: 00F556E0
Failed to get address for Tcl_Finalize, xrefs: 00F55331
Tcl_MutexLock, xrefs: 00F553ED
Tcl_FinalizeThread, xrefs: 00F55349
Failed to get address for Tcl_GetString, xrefs: 00F55598
Failed to get address for Tcl_MutexUnlock, xrefs: 00F55427
Tcl_GetString, xrefs: 00F55587
Tcl_ThreadAlert, xrefs: 00F554E3
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00F554CB
Failed to get address for Tcl_DeleteInterp, xrefs: 00F55383
Tcl_SetVar2, xrefs: 00F55535
Failed to get address for Tk_GetNumMainWindows, xrefs: 00F5575F
Tcl_NewStringObj, xrefs: 00F555B0
Tcl_FindExecutable, xrefs: 00F552CE
Failed to get address for Tcl_ConditionNotify, xrefs: 00F55479
Tcl_Init, xrefs: 00F5527C
Tcl_ThreadQueueEvent, xrefs: 00F554BA
Failed to get address for Tcl_MutexLock, xrefs: 00F553FE
Tcl_ConditionFinalize, xrefs: 00F5543F
GetProcAddress, xrefs: 00F55292, 00F552BB, 00F552E4, 00F5530D, 00F55336, 00F5535F, 00F55388, 00F553B1, 00F553DA, 00F55403, 00F5542C, 00F55455, 00F5547E, 00F554A7, 00F554D0, 00F554F9, 00F55522, 00F5554B, 00F55574, 00F5559D, 00F555C6, 00F555EF, 00F55618, 00F55641, 00F5566A, 00F55693, 00F556BC, 00F556E5, 00F5570E, 00F5573B, 00F55764
Tcl_DeleteInterp, xrefs: 00F55372
Failed to get address for Tcl_ThreadAlert, xrefs: 00F554F4
Failed to get address for Tcl_NewStringObj, xrefs: 00F555C1
Failed to get address for Tcl_CreateInterp, xrefs: 00F552B6
Failed to get address for Tcl_ConditionWait, xrefs: 00F554A2
Tk_GetNumMainWindows, xrefs: 00F5574E
Failed to get address for Tcl_Init, xrefs: 00F5528D
Failed to get address for Tcl_CreateObjCommand, xrefs: 00F5556F
Tcl_EvalEx, xrefs: 00F5567D
Tcl_ConditionWait, xrefs: 00F55491
Tcl_CreateObjCommand, xrefs: 00F5555E
Failed to get address for Tcl_CreateThread, xrefs: 00F553AC
Tcl_SetVar2Ex, xrefs: 00F55602
Tcl_Finalize, xrefs: 00F55320
Failed to get address for Tcl_FindExecutable, xrefs: 00F552DF
Tcl_EvalObjv, xrefs: 00F556A6
Tcl_EvalFile, xrefs: 00F55654
Failed to get address for Tcl_GetObjResult, xrefs: 00F5563C
Failed to get address for Tk_Init, xrefs: 00F55736
Tcl_GetObjResult, xrefs: 00F5562B
Tcl_Alloc, xrefs: 00F556CF
Tcl_ConditionNotify, xrefs: 00F55468
Tcl_MutexUnlock, xrefs: 00F55416
Failed to get address for Tcl_ConditionFinalize, xrefs: 00F55450
Failed to get address for Tcl_GetCurrentThread, xrefs: 00F553D5
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00F555EA
Failed to get address for Tcl_EvalFile, xrefs: 00F55665
Failed to get address for Tcl_FinalizeThread, xrefs: 00F5535A
Failed to get address for Tcl_Free, xrefs: 00F55709
Tcl_Free, xrefs: 00F556F8
Tk_Init, xrefs: 00F55725
Failed to get address for Tcl_SetVar2, xrefs: 00F55546
Failed to get address for Tcl_EvalObjv, xrefs: 00F556B7
Failed to get address for Tcl_GetVar2, xrefs: 00F5551D
Tcl_CreateThread, xrefs: 00F5539B
Failed to get address for Tcl_EvalEx, xrefs: 00F5568E
Tcl_DoOneEvent, xrefs: 00F552F7
Tcl_NewByteArrayObj, xrefs: 00F555D9
Tcl_GetCurrentThread, xrefs: 00F553C4

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 4214558900-2208601799
Opcode ID: a0fc877d171adfd2ed7000cb62b6bb94d57ecf5a4a5ecd5408dc674aacfad696
Instruction ID: 7c67fa0a043817b5edd0f48540477e452df1304ebb6fe0ebe541d920b6d020c0
Opcode Fuzzy Hash: a0fc877d171adfd2ed7000cb62b6bb94d57ecf5a4a5ecd5408dc674aacfad696
Instruction Fuzzy Hash: 7DB1AF76F94B1A215640273D7C529A93B984ED2F377008337FA28E81D1FBD1C68976A3

Function 00F565B0 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00F522E9,00000000,?,?,?,00000400,?,00000000,?), ref: 00F565D3

Part of subcall function 00F56A30: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,00000000,00F5663C,00F8DC48,?,00001000,?,?), ref: 00F56A4A

FormatMessageW.KERNEL32(00001000,00000000,?,00000400,00000000,00001000,00000000,00F522E9,00000000,?,?,?,00000400,?,00000000,?), ref: 00F565F2

Strings

PyInstaller: FormatMessageW failed., xrefs: 00F5660E
FormatMessageW, xrefs: 00F56601
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00F5663F
No error messages generated., xrefs: 00F565FC

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ByteCharErrorFormatLastMessageMultiWide
String ID: FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.
API String ID: 1653872744-3268588819
Opcode ID: 42593e158f0bc9da27985fb996c9089100ffdbc07e085c1daaa7614a98c21f87
Instruction ID: 1f636125cce33de7bb2841f722e93ae9be730101c59c41b42e1ff931251e752b
Opcode Fuzzy Hash: 42593e158f0bc9da27985fb996c9089100ffdbc07e085c1daaa7614a98c21f87
Instruction Fuzzy Hash: 110188747443446BF61C97149C47BAA32D69F98B46F80841DBB0DCA1C2FAE49908E757

Function 00F6BBE8 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1427COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00F6BDA4

Strings

1#QNAN, xrefs: 00F6D095
1#INF, xrefs: 00F6D09F
1#SNAN, xrefs: 00F6D08B
1#IND, xrefs: 00F6D081

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 31bddd25ef988d42195047e260be9a90d60eeb1339fe58c71b416d3390005237
Instruction ID: d0c60955b4020fd4e79d8298c73a818d04f00eff26d98e20405c8752c9d3db2c
Opcode Fuzzy Hash: 31bddd25ef988d42195047e260be9a90d60eeb1339fe58c71b416d3390005237
Instruction Fuzzy Hash: CDD25D72E042288FDB64CF28DD407EAB7B5EB45315F1441EAD88DE7241E778AE819F81

Function 00F59EE1 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00F59EED
IsDebuggerPresent.KERNEL32 ref: 00F59FB9
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00F59FD9
UnhandledExceptionFilter.KERNEL32(?), ref: 00F59FE3

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 166596d5fdfb0bf12ea1267aad2eb40ab6bfda72bbee71e74c74db34677bfb63
Instruction ID: 57b4577b6469121106d9eba3259d8e8c36f7b6ef624ed7648801377cda07a101
Opcode Fuzzy Hash: 166596d5fdfb0bf12ea1267aad2eb40ab6bfda72bbee71e74c74db34677bfb63
Instruction Fuzzy Hash: AB315A75D0521DDBDB10DF64D9897CCBBF8AF08305F1041AAE50CA7250EB709B88AF45

Function 00F63987 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00F63A7F
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00F63A89
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00F63A96

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 99e068338fdfb188ccbf361c6db9b7c65d1154e185b5af4405e77d063c9fdee2
Instruction ID: 597588b231c1284917b79211d58b2166d00f5ea3b7753d7fa41be14169c1ece5
Opcode Fuzzy Hash: 99e068338fdfb188ccbf361c6db9b7c65d1154e185b5af4405e77d063c9fdee2
Instruction Fuzzy Hash: 1831F675D0121CABCB21DF64DD897DCBBB4AF08310F5042EAE91CA6290E7749B859F45

Function 00F6B750 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46166389e0388ca0ff4ba6b97f8c4c2a363f53e28c5701a6d8115969bb3379e6
Instruction ID: e130c17e2deb04b3f7d3b1ef14d50f350dee2b43d76a3943a43adf5042f11564
Opcode Fuzzy Hash: 46166389e0388ca0ff4ba6b97f8c4c2a363f53e28c5701a6d8115969bb3379e6
Instruction Fuzzy Hash: B9F15F71E002199FDF14CFA9C8906ADB7B1FF88324F25826AD919E7345D731AE41DB90

Function 00F576B4 Relevance: 2.1, Strings: 1, Instructions: 822COMMON

Download Yara Rule

Strings

F?, xrefs: 00F5783E

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID: F?
API String ID: 0-1369233217
Opcode ID: 66b311e0f01ee47d20eb624f5baad60106ce02e71437bb0330fec54fbd3afbef
Instruction ID: d3e7864cc90eb04975ab81b5de72082324f1be033769026bd15b96b206e14d95
Opcode Fuzzy Hash: 66b311e0f01ee47d20eb624f5baad60106ce02e71437bb0330fec54fbd3afbef
Instruction Fuzzy Hash: 8A62AAB1A083128FC708DF18D49062AFBF1FF85311F15466EEA8A9B752D734D889DB91

Function 00F7169D Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00F71698,?,?,00000008,?,?,00F71330,00000000), ref: 00F718CA

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 80802daa4e454bb4460077d8c177d77407033ece8855255a8ae71eb8595b9e86
Instruction ID: 16ea9f67530a005856df9ee0d7bbd36c1e75bd456f6abb1e5d51600064049539
Opcode Fuzzy Hash: 80802daa4e454bb4460077d8c177d77407033ece8855255a8ae71eb8595b9e86
Instruction Fuzzy Hash: 73B17836A106088FD718CF2CC486B657BB0FF05364F29C659E99ACF2A1C335E986DB41

Function 00F5A185 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00F5A19B

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 9ed023f614f7975d3764c91f5dc5652633bcf2eb31cf8ea0271b3966ed07a214
Instruction ID: 340a964e07cfc57064a93e436a2982e6d1b4189eefd85567cd80627a7c71679c
Opcode Fuzzy Hash: 9ed023f614f7975d3764c91f5dc5652633bcf2eb31cf8ea0271b3966ed07a214
Instruction Fuzzy Hash: 3351E1B1E006098FDB15CF95E8863AEBBF0FB48325F28866ACA05EB250D3759D14DF51

Function 00F699B3 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 502e56714ea894dc8e0d7a776c4f43a8ae1e9f19758d7316c965af9a70537d58
Instruction ID: d066f6516482d4e6c5f8a659fd1da8a84285fc1ffc16f59efcfeb460100b7e40
Opcode Fuzzy Hash: 502e56714ea894dc8e0d7a776c4f43a8ae1e9f19758d7316c965af9a70537d58
Instruction Fuzzy Hash: EB310772904219AFCB24DFA9CC89DBBB7BDEBC5320F14416CF90593241EA74AE40DB50

Function 00F5A075 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000A081,00F597F3), ref: 00F5A07A

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4eadec2b7463ee021d70d5d548b95922fae4430339f042cb89c187404f0d46ce
Instruction ID: 9d03b19d6cdf1bd1fb0dbd4752e6ebf632f6edd52d24b26d891a976005e7636f
Opcode Fuzzy Hash: 4eadec2b7463ee021d70d5d548b95922fae4430339f042cb89c187404f0d46ce
Instruction Fuzzy Hash:

Function 00F5D3E5 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

0, xrefs: 00F5D575

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 593a0cd6aa8736ad58a0ffc874488f869682809a1d29d77a7ed37d01ef09473d
Instruction ID: 06d1690ac2723ecd84513e9d756f36dbc4d0a871bfc65b5d2066a9c3741dc043
Opcode Fuzzy Hash: 593a0cd6aa8736ad58a0ffc874488f869682809a1d29d77a7ed37d01ef09473d
Instruction Fuzzy Hash: 56618A31E0220857DF38EA28884177E73A5AF5172AF58042AEF46DB281E735ED4EF345

Function 00F5D1B3 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00F5D32F

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: a9b831c9eb5ab7d80c48fd822a90cc7f624ed1246a07fb820aa91358121c724c
Instruction ID: 4acdddbd5be2c6d111cd79d1bfa47d329b2c3dbc7eecaa513433c69a5c7a140b
Opcode Fuzzy Hash: a9b831c9eb5ab7d80c48fd822a90cc7f624ed1246a07fb820aa91358121c724c
Instruction Fuzzy Hash: 7E519871E0374856EB389A6888967BEBB9A9B02323F04011DDF82D7682D614DE4DB343

Function 00F6AD03 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00F6AD03

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: cc7526d854ad8f7662b9f0862939c3dc6225456ac86b0713d13411c2c0d58546
Instruction ID: ff36aac22196be87bad8686e352508dc342918a018d009be649d166fd5b2b871
Opcode Fuzzy Hash: cc7526d854ad8f7662b9f0862939c3dc6225456ac86b0713d13411c2c0d58546
Instruction Fuzzy Hash: 92A011302002888FA3008F30AE0820C3AEAAA082803200028A00AC0020EA208288BB03

Function 00F56C00 Relevance: .7, Instructions: 717COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6cde7032b3b54ae2fbca3cd6ebca70bf8f2090d3bf51866ea5989577b955065
Instruction ID: a900e311527ca70494ef744c96dc33666807465853b5d1e94181e69a49196678
Opcode Fuzzy Hash: c6cde7032b3b54ae2fbca3cd6ebca70bf8f2090d3bf51866ea5989577b955065
Instruction Fuzzy Hash: 4E52AFB0A083028FD714CF18D58472AFBE0BF84355F4546ADEE899B292C774D989EBD1

Function 00F592A0 Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b92c1fa106590b30003f6ad49192c8baab49145ca7dad3145f387e97963235a8
Instruction ID: 51f00b3491a9797f2372f238b3383a3b0d445b3f081cfd2eb50c85fb0d829c55
Opcode Fuzzy Hash: b92c1fa106590b30003f6ad49192c8baab49145ca7dad3145f387e97963235a8
Instruction Fuzzy Hash: FFE1923160C3418FC708CF28C590629BBE2EFD9315F188A6DEAD58B746D3B5D90ADB51

Function 00F58A40 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 578dff67d0bd1fb38226035e0b82f3b03d717ba914f4f5e0f1515193ffd2139c
Instruction ID: 8bcea94df28b630adb5b761d56ab17231dba8f96c7c925dd47b0b8facdf20601
Opcode Fuzzy Hash: 578dff67d0bd1fb38226035e0b82f3b03d717ba914f4f5e0f1515193ffd2139c
Instruction Fuzzy Hash: 567129312205694FC748CF2DFCD0436BBE1E3CA365385461DEA85CB395C634E56AEBA1

Function 00F6FE8C Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88edde3d661aeb0907d8479d0cb2829038e94fc427e293e9e61b0e5d8d02d0f5
Instruction ID: 763629cf4504e37fafa3876de49236daa4dd62947f01e679c6f8631cdab411e5
Opcode Fuzzy Hash: 88edde3d661aeb0907d8479d0cb2829038e94fc427e293e9e61b0e5d8d02d0f5
Instruction Fuzzy Hash: 9521B373F204394B7B0CC47E8C532BDB6E1C68C601745823AE8A6EA2C1D968D917E2E4

Function 00F6FD6C Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78305762445aa2024c9ca9e9afcb942f742c082f492b61bed92a4f3fb3f7214
Instruction ID: 5d6e0ced38b44cb4de9fca92ae1dd29c779d7989d1452ae117211086e7ed2a9d
Opcode Fuzzy Hash: d78305762445aa2024c9ca9e9afcb942f742c082f492b61bed92a4f3fb3f7214
Instruction Fuzzy Hash: B911CA33F30C255B675C816D8C132BEA1D2EBD824030F533AD826E7284E994DE13D390

Function 00F51AD0 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 192windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00F51B0B
MulDiv.KERNEL32(?,00000032,00000004), ref: 00F51B21
MulDiv.KERNEL32(00000000,0000000E,00000008), ref: 00F51B32
SystemParametersInfoW.USER32(00000029,000001F8,000001F8,00000000), ref: 00F51B7B
CreateFontIndirectW.GDI32(?), ref: 00F51B8D
#380.COMCTL32(00000000,00007F01,00000001,?), ref: 00F51BAD
CreateWindowExW.USER32(00000000,STATIC,00000000,50000003,80000000,80000000,80000000,80000000,?,00000000,?,00000000), ref: 00F51BE4
CreateWindowExW.USER32(00000000,STATIC,00000000,50000000,80000000,80000000,80000000,80000000,?,00000000,?,00000000), ref: 00F51C17
CreateWindowExW.USER32(00000200,EDIT,00000000,50300884,80000000,80000000,80000000,80000000,?,00000000,?,00000000), ref: 00F51C4D
CreateWindowExW.USER32(00000000,BUTTON,Close,50000001,80000000,80000000,80000000,80000000,?,00000001,?,00000000), ref: 00F51C83
SendMessageW.USER32(?,00000080,00000000,?), ref: 00F51C9D
SendMessageW.USER32(?,00000080,00000001,?), ref: 00F51CAB
SendMessageW.USER32(?,00000172,00000001,?), ref: 00F51CBC
SendMessageW.USER32(?,00000030,?,00000001), ref: 00F51CD0
SendMessageW.USER32(?,00000030,?,00000001), ref: 00F51CE2
SendMessageW.USER32(?,00000030,?,00000001), ref: 00F51CF4
SendMessageW.USER32(?,00000030,?,00000001), ref: 00F51D06
SendMessageW.USER32(?,0000000C,00000000,?), ref: 00F51D13
SendMessageW.USER32(?,0000000C,00000000,?), ref: 00F51D22
GetClientRect.USER32(?,?), ref: 00F51D2C

Part of subcall function 00F51E30: GetDC.USER32(?), ref: 00F51E50
Part of subcall function 00F51E30: SelectObject.GDI32(00000000,?), ref: 00F51EA0
Part of subcall function 00F51E30: DrawTextW.USER32(00000000,?,000000FF,?,00002550), ref: 00F51EB5
Part of subcall function 00F51E30: SelectObject.GDI32(00000000,00000000), ref: 00F51EC6
Part of subcall function 00F51E30: ReleaseDC.USER32(?,00000000), ref: 00F51ECF
Part of subcall function 00F51E30: MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?,?,?,?,?,00000032,00000004), ref: 00F51F1C
Part of subcall function 00F51E30: MoveWindow.USER32(?,?,?,?,00000014,00000001,?,?,?,?,?,?,?,00000032,00000004), ref: 00F51F4B

Strings

@U=u, xrefs: 00F51C87
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00F51AF8
STATIC, xrefs: 00F51BDD, 00F51C10
Close, xrefs: 00F51C77
BUTTON, xrefs: 00F51C7C
EDIT, xrefs: 00F51C43

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: MessageSend$Window$Create$MoveObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: @U=u$BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 4195728924-25750965
Opcode ID: 3c18f9affd25c9dc881479f8d8ce43079b7ba192e61f58d354c1a3a554b129e7
Instruction ID: 6898291b3241382566754ad895d9d568f41699417e5133de9651262db7700f52
Opcode Fuzzy Hash: 3c18f9affd25c9dc881479f8d8ce43079b7ba192e61f58d354c1a3a554b129e7
Instruction Fuzzy Hash: 83612F31680314FAFB315F508C8AF967F65EF08B01F244166BF087D1E6D6B1A524EB6A

Function 00F68975 Relevance: 25.9, APIs: 17, Instructions: 411COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00F6899F
_free.LIBCMT ref: 00F68A78
_free.LIBCMT ref: 00F68AA5

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: da27715f46624157067c84503290f6c51094a312082043ba96508b01c9737b4e
Instruction ID: 7eebc7faafd60e2475b944ebb65371d9c55c0f583b754b6d4413a7724ec5b1a3
Opcode Fuzzy Hash: da27715f46624157067c84503290f6c51094a312082043ba96508b01c9737b4e
Instruction Fuzzy Hash: 7DD108B1D00305AFDB24AFA48C42A7E77B4EF513A4F04436DE915A7281EF759902FB61

Function 00F524F0 Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 314COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00F5254A

Strings

malloc, xrefs: 00F5281E
Error opening archive %s, xrefs: 00F52819
%s%s%s%s%s%s%s, xrefs: 00F52629
Archive not found: %s, xrefs: 00F52839, 00F5284F, 00F5290A
%s%s%s.pkg, xrefs: 00F5269C
Archive path exceeds PATH_MAX, xrefs: 00F528EF
Error extracting %s, xrefs: 00F528D7
%s%s%s.exe, xrefs: 00F526C3
Error copying %s, xrefs: 00F5265F
%s%s%s, xrefs: 00F526EA
%s%s%s%s%s, xrefs: 00F525C5

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ___from_strstr_to_strchr
String ID: %s%s%s$%s%s%s%s%s$%s%s%s%s%s%s%s$%s%s%s.exe$%s%s%s.pkg$Archive not found: %s$Archive path exceeds PATH_MAX$Error copying %s$Error extracting %s$Error opening archive %s$malloc
API String ID: 601868998-2292630174
Opcode ID: 95fdfbe431a48bd0e541fa71c2891248da0206687d180c950dbde6f5693ccf93
Instruction ID: 1037d075f602eea2b7624eb9bc4f1bdeb171a943359c180db230c02fa46f2082
Opcode Fuzzy Hash: 95fdfbe431a48bd0e541fa71c2891248da0206687d180c950dbde6f5693ccf93
Instruction Fuzzy Hash: EDA12CB29043407AD731D6609C82FBB739CAF56312F444A16FE89C6182E735E60DB6A3

Function 00F6A979 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00F6A9BD

Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A573
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A585
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A597
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A5A9
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A5BB
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A5CD
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A5DF
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A5F1
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A603
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A615
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A627
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A639
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A64B

_free.LIBCMT ref: 00F6A9B2

Part of subcall function 00F63B77: RtlFreeHeap.NTDLL(00000000,00000000,?,00F62C8E), ref: 00F63B8D
Part of subcall function 00F63B77: GetLastError.KERNEL32(?,?,00F62C8E), ref: 00F63B9F

_free.LIBCMT ref: 00F6A9D4
_free.LIBCMT ref: 00F6A9E9
_free.LIBCMT ref: 00F6A9F4
_free.LIBCMT ref: 00F6AA16
_free.LIBCMT ref: 00F6AA29
_free.LIBCMT ref: 00F6AA37
_free.LIBCMT ref: 00F6AA42
_free.LIBCMT ref: 00F6AA7A
_free.LIBCMT ref: 00F6AA81
_free.LIBCMT ref: 00F6AA9E
_free.LIBCMT ref: 00F6AAB6

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 9e2d21f223b1bf30d39df4c90266986528b70c7ce6b36e366706a4ddff4833e0
Instruction ID: e88cd75c6dfd204880a4730d51d68dcdc0daebf378c8f37d7e13b59bb38a45cb
Opcode Fuzzy Hash: 9e2d21f223b1bf30d39df4c90266986528b70c7ce6b36e366706a4ddff4833e0
Instruction Fuzzy Hash: E6313D31A00701DFEB21AA79DD46B6673F9EF40360F25442AE099E7162DF79BD80EB11

Function 00F6613C Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F66152

Part of subcall function 00F63B77: RtlFreeHeap.NTDLL(00000000,00000000,?,00F62C8E), ref: 00F63B8D
Part of subcall function 00F63B77: GetLastError.KERNEL32(?,?,00F62C8E), ref: 00F63B9F

_free.LIBCMT ref: 00F6615E
_free.LIBCMT ref: 00F66169
_free.LIBCMT ref: 00F66174
_free.LIBCMT ref: 00F6617F
_free.LIBCMT ref: 00F6618A
_free.LIBCMT ref: 00F66195
_free.LIBCMT ref: 00F661A0
_free.LIBCMT ref: 00F661AB
_free.LIBCMT ref: 00F661B9

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 37834a7e49c7c2683572fd89d82a79cfd57187240c9370364524ab39d5d94135
Instruction ID: 5e8c8626dd12c0caeb55a6d46a736fc720485e1b6ae1456b399be6d4d573e1fb
Opcode Fuzzy Hash: 37834a7e49c7c2683572fd89d82a79cfd57187240c9370364524ab39d5d94135
Instruction Fuzzy Hash: EB219676900108AFCB41EFA4CC82DEE7BB9EF48344F0041A6B6159B572DB75EB44DB80

Function 00F55A90 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00001000,?,?,?,?,?,00F55A66,?,00000000,?,pyi-runtime-tmpdir), ref: 00F55B1D
GetCurrentProcessId.KERNEL32 ref: 00F55B23

Part of subcall function 00F55C60: GetEnvironmentVariableW.KERNEL32(00000000,?,00002000,?,00F52FD8,_MEIPASS2), ref: 00F55C96
Part of subcall function 00F55C60: ExpandEnvironmentStringsW.KERNEL32(?,?,00002000,?,00002000,?,00F52FD8,_MEIPASS2), ref: 00F55CB2

Part of subcall function 00F5E365: _free.LIBCMT ref: 00F5E378

SetEnvironmentVariableW.KERNEL32(00000000,00000000,00000000,TMP,00000000,?,?,?,?,?,00F5142E,?,00000000,00F52AFF,?,?), ref: 00F55BBC

Strings

TMP, xrefs: 00F55AE2
LOADER: Failed to set the TMP environment variable., xrefs: 00F55AFB
_MEI%d, xrefs: 00F55B29
TMP, xrefs: 00F55AC2, 00F55B73, 00F55BED

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: Environment$Variable$CurrentExpandPathProcessStringsTemp_free
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 2771213846-1116378104
Opcode ID: e7948cbcb1fb161e5b368f9127e37bc7903ade06f7b8869d148dd58859a56d2e
Instruction ID: d16658bbfa68dbafc81acae506a429a1a9cdd191604794c0d045671d2a34e217
Opcode Fuzzy Hash: e7948cbcb1fb161e5b368f9127e37bc7903ade06f7b8869d148dd58859a56d2e
Instruction Fuzzy Hash: 1C41D372A00B04B7E16076B05C4BF6F35989F85F53F440835FF45A7182FAA8AA0C72A7

Function 00F512A0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 142COMMON

Download Yara Rule

Strings

malloc, xrefs: 00F51341
Failed to extract %s: failed to open archive file!, xrefs: 00F512CF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00F51306
Failed to extract %s: failed to read data chunk!, xrefs: 00F513F2
fread, xrefs: 00F513F7
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00F5133C
fseek, xrefs: 00F5130B

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 0-3659356012
Opcode ID: 82c815cc3be57cd793d1eb46e07e4510217462924ac646523b198752caf069e2
Instruction ID: df981358432b7b6d3fcdab9b1473859f20f81adb5b91decf0455604aad4387c6
Opcode Fuzzy Hash: 82c815cc3be57cd793d1eb46e07e4510217462924ac646523b198752caf069e2
Instruction Fuzzy Hash: 5A412B72E003116BEB14AF648C91B2B7798FF40766F048565FE049B642E775FA0CB293

Function 00F55780 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 127COMMON

Download Yara Rule

APIs

Part of subcall function 00F56990: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,00F5246C,?,?,00000400,?,00000000,00000800), ref: 00F569A8

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000,?,00F5142E,?,00000000,00F52AFF,?,?,?,?,00000000), ref: 00F557E4

Strings

LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00F55855
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00F557F9
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00F557B3

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 2001182103-3498232454
Opcode ID: 5ee21e0b03b93b25bef8ac72ef4e73b9d88e21dff718041967e82cd7cddf670f
Instruction ID: 0775316f8e7b2361801366cbb119a9c9085e343a939174f261a955557ce3968e
Opcode Fuzzy Hash: 5ee21e0b03b93b25bef8ac72ef4e73b9d88e21dff718041967e82cd7cddf670f
Instruction Fuzzy Hash: D2311CB2A406006BE6247374AC47FAB72989F84B12F440535FF09D7282F978E50C92D7

Function 00F51E30 Relevance: 13.6, APIs: 9, Instructions: 139COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00F51E50
SelectObject.GDI32(00000000,?), ref: 00F51EA0
DrawTextW.USER32(00000000,?,000000FF,?,00002550), ref: 00F51EB5
SelectObject.GDI32(00000000,00000000), ref: 00F51EC6
ReleaseDC.USER32(?,00000000), ref: 00F51ECF
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?,?,?,?,?,00000032,00000004), ref: 00F51F1C
MoveWindow.USER32(?,?,?,?,00000014,00000001,?,?,?,?,?,?,?,00000032,00000004), ref: 00F51F4B
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?,00000014,00000001), ref: 00F51F95
MoveWindow.USER32(?,?,00000000,?,?,00000001,?,?,?,00000014,00000001), ref: 00F51FCA

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID:
API String ID: 2147705588-0
Opcode ID: a541af4a0bd3edb6ee3ccae4f94c33fe04acaef8439d3bec591122df70117b51
Instruction ID: e3f4b86dfca041221862fb3933a24816087f14b65d557c3100a17000a34a8018
Opcode Fuzzy Hash: a541af4a0bd3edb6ee3ccae4f94c33fe04acaef8439d3bec591122df70117b51
Instruction Fuzzy Hash: 69418C71604310AFD724DF2DCC889BBB7E9FB88701F41052EF98AC2291E675AD44E761

Function 00F52F30 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 336COMMON

Download Yara Rule

APIs

Part of subcall function 00F534A0: GetModuleFileNameW.KERNEL32(00000000,?,00001000,?,00F52F89,?,?), ref: 00F534CC

SetDllDirectoryW.KERNEL32(?), ref: 00F531C1

Part of subcall function 00F55C60: GetEnvironmentVariableW.KERNEL32(00000000,?,00002000,?,00F52FD8,_MEIPASS2), ref: 00F55C96
Part of subcall function 00F55C60: ExpandEnvironmentStringsW.KERNEL32(?,?,00002000,?,00002000,?,00F52FD8,_MEIPASS2), ref: 00F55CB2

Strings

MEI, xrefs: 00F530FC
Cannot side-load external archive %s (code %d)!, xrefs: 00F530F0, 00F5313F
_PYI_ONEDIR_MODE, xrefs: 00F52FEC, 00F53031
Failed to convert DLL search path!, xrefs: 00F531A7
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00F5309B
_MEIPASS2, xrefs: 00F52FCE, 00F53053, 00F5331D, 00F53327

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: 4c4b0b2153d90a0d14d1e2cb2daf23b9758db266b787e27807be679d8d8190bf
Instruction ID: ed3398947a25329c485e641722581280a5255d89ddfcac71a0405a9ef43fc0bf
Opcode Fuzzy Hash: 4c4b0b2153d90a0d14d1e2cb2daf23b9758db266b787e27807be679d8d8190bf
Instruction Fuzzy Hash: 0EB13B72D087416BC711AA749C42BAF77DCAF5475AF040529FF8882142E769E70CB7A3

Function 00F566B0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 105COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00F56709
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00F5673E

Strings

Out of memory., xrefs: 00F56767
Failed to encode wchar_t as UTF-8., xrefs: 00F56760
win32_utils_to_utf8, xrefs: 00F5676C
Failed to get UTF-8 buffer size., xrefs: 00F56773
WideCharToMultiByte, xrefs: 00F56778

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: ec28fa44013c6e1e09b884fb896ab70a358caffb35033fcf37c5922c6e83dc82
Instruction ID: 3b749cbd0952adfff472b126a4938a46b6872cbf4caadd73a4212a003a757894
Opcode Fuzzy Hash: ec28fa44013c6e1e09b884fb896ab70a358caffb35033fcf37c5922c6e83dc82
Instruction Fuzzy Hash: DF313C71644305ABDB106E64BC82F1677D4EB44B26F500536FF54EB2C0EAA5E90CA263

Function 00F56A30 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 65COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,00000000,00F5663C,00F8DC48,?,00001000,?,?), ref: 00F56A4A

Part of subcall function 00F52290: GetLastError.KERNEL32(?,00000000), ref: 00F522AD

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,00000000,00000000,?,00000000,00F5663C,00F8DC48,?,00001000,?,?), ref: 00F56AAF

Strings

Out of memory., xrefs: 00F56A81
Failed to encode wchar_t as UTF-8., xrefs: 00F56AB9
win32_utils_to_utf8, xrefs: 00F56A86
Failed to get UTF-8 buffer size., xrefs: 00F56A56
WideCharToMultiByte, xrefs: 00F56A5B, 00F56ABE

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 1717984340-27947307
Opcode ID: 6f52a251bf29f1bf449b33a4b3293576c740d20072ae93535e9e485171440620
Instruction ID: fe01976edd1574eceb9f11c660a5b0c0080faa7e6646e9a9a67f5b95292af34c
Opcode Fuzzy Hash: 6f52a251bf29f1bf449b33a4b3293576c740d20072ae93535e9e485171440620
Instruction Fuzzy Hash: D401E137B45221B6DA6061697C06F8B3A99CB86F72F154222FF1CE62C0E190E90671A3

Function 00F5ADC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00F5ADF7
___except_validate_context_record.LIBVCRUNTIME ref: 00F5ADFF
_ValidateLocalCookies.LIBCMT ref: 00F5AE88
__IsNonwritableInCurrentImage.LIBCMT ref: 00F5AEB3
_ValidateLocalCookies.LIBCMT ref: 00F5AF08

Strings

csm, xrefs: 00F5AE9D

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: bc6629a90984b088dfea3498b4301f573e68f9f55ff78c0580e79afcbc2f16e7
Instruction ID: 25227c0d234729539fdd7d9042b3328721c1a038aee64d02ba9f913a7ff1b066
Opcode Fuzzy Hash: bc6629a90984b088dfea3498b4301f573e68f9f55ff78c0580e79afcbc2f16e7
Instruction Fuzzy Hash: AC41E330E002089BCF00DF69CC85A9EBBB1AF05325F148255EE185B352D735DA29EB92

Function 00F56AE0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 102COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,00000000,?,?), ref: 00F56B35
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 00F56B66

Strings

Out of memory., xrefs: 00F56B8F
win32_utils_from_utf8, xrefs: 00F56B94
Failed to get wchar_t buffer size., xrefs: 00F56B9B
Failed to decode wchar_t from UTF-8, xrefs: 00F56B88
MultiByteToWideChar, xrefs: 00F56BA0

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 626452242-876015163
Opcode ID: 53cae9a9c7cf728b0d509f7a7bdf7aacd45a71f69e4a6ecb6d1fa079dfe46698
Instruction ID: 991e8fc00a0d3e23406f830713655dbb03e6d62a53b6a6bfcae64e0ee9683035
Opcode Fuzzy Hash: 53cae9a9c7cf728b0d509f7a7bdf7aacd45a71f69e4a6ecb6d1fa079dfe46698
Instruction Fuzzy Hash: 08313E72A443057BD7106E54AC41F1A7BD4EB84722F84063AFF58E72C0E6B5D90CB653

Function 00F6A6F5 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F6A6BD: _free.LIBCMT ref: 00F6A6E2

_free.LIBCMT ref: 00F6A743

Part of subcall function 00F63B77: RtlFreeHeap.NTDLL(00000000,00000000,?,00F62C8E), ref: 00F63B8D
Part of subcall function 00F63B77: GetLastError.KERNEL32(?,?,00F62C8E), ref: 00F63B9F

_free.LIBCMT ref: 00F6A74E
_free.LIBCMT ref: 00F6A759
_free.LIBCMT ref: 00F6A7AD
_free.LIBCMT ref: 00F6A7B8
_free.LIBCMT ref: 00F6A7C3
_free.LIBCMT ref: 00F6A7CE

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b82a83029192d2ac4a41a466b2bc48d6a5028a36daab7583f2bc1eaf857da398
Instruction ID: 8fc6fa305b51e44683b88a40dd04d519f63c6a23ae65a0e050bc05da06ccaf52
Opcode Fuzzy Hash: b82a83029192d2ac4a41a466b2bc48d6a5028a36daab7583f2bc1eaf857da398
Instruction Fuzzy Hash: D011FE71940B04FAD620BBB0CC47FDB77ECEF46700F444815B29ABA162DB6AB614AB51

Function 00F56990 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 61COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,00F5246C,?,?,00000400,?,00000000,00000800), ref: 00F569A8

Part of subcall function 00F52290: GetLastError.KERNEL32(?,00000000), ref: 00F522AD

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,?,?,00F5246C,?,?,00000400,?,00000000,00000800), ref: 00F56A09

Strings

Out of memory., xrefs: 00F569DF
win32_utils_from_utf8, xrefs: 00F569E4
Failed to get wchar_t buffer size., xrefs: 00F569B4
Failed to decode wchar_t from UTF-8, xrefs: 00F56A13
MultiByteToWideChar, xrefs: 00F569B9, 00F56A18

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 1717984340-876015163
Opcode ID: 2c3675797e2d5a051f0bdd890d8dab492bf35425fdd33ac874b4b0ce718b0c17
Instruction ID: f6b8689687b20ebc945d1b9d33434f2a923bd80851c786a8e18e79a5d1098dfa
Opcode Fuzzy Hash: 2c3675797e2d5a051f0bdd890d8dab492bf35425fdd33ac874b4b0ce718b0c17
Instruction Fuzzy Hash: E7012237B8422237D66065657C06D8B7B948B91F73F054232FF2CE21C0E5A0C94A71E3

Function 00F64DEE Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000000,?), ref: 00F64E36
__fassign.LIBCMT ref: 00F6501B
__fassign.LIBCMT ref: 00F65038
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F65080
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00F650C0
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F65168

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 1a7edef9a2e473f89dde81f5d3efe6b78d59d84f00e00641ad273451c57e4397
Instruction ID: ec4ae302011906a40fe076b6a8c749e50aa35ce109be9874808602e1185343b7
Opcode Fuzzy Hash: 1a7edef9a2e473f89dde81f5d3efe6b78d59d84f00e00641ad273451c57e4397
Instruction Fuzzy Hash: 3BC19C75D002589FCF15CFE8C880AEDBBB5AF09314F28416AE855FB242D631AE46DF60

Function 00F5B231 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00F5B228,00F5B05F,00F5A0C5), ref: 00F5B23F
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00F5B24D
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F5B266
SetLastError.KERNEL32(00000000,00F5B228,00F5B05F,00F5A0C5), ref: 00F5B2B8

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 08a37047ff1fd771ca22d188fb9ec271642c244e2bc4993d5d393c4872d5bfb4
Instruction ID: 03de621223e499726134e827d4034e8e59c40bb8064c5b55b12ee0099b1d9d96
Opcode Fuzzy Hash: 08a37047ff1fd771ca22d188fb9ec271642c244e2bc4993d5d393c4872d5bfb4
Instruction Fuzzy Hash: E101B5329192156DE6162AB4BC95A6E3B54EB117B7F300229FF24451E1EF55480DB360

Function 00F51FE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,?,00000000,00000000,00F5218F,00000000,00000000,Failed to obtain/convert traceback!,?,?,?,00000000,00F52EDE,?,?), ref: 00F52013
DialogBoxIndirectParamW.USER32(00000000,?,00000000,00F51D70,?), ref: 00F520CB

Part of subcall function 00F5E365: _free.LIBCMT ref: 00F5E378

DeleteObject.GDI32(?), ref: 00F520FD
DestroyIcon.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000102), ref: 00F5210F

Strings

Unhandled exception in script, xrefs: 00F5203C

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam_free
String ID: Unhandled exception in script
API String ID: 4039461714-2699770090
Opcode ID: a942a2babffe53eb3c506c841fe05688f6c63c5a514333ca0b0eed9924e70194
Instruction ID: 8a8f955bf7b9ae801b611a4617f04d003c3cf147d6d57f131e030d0f9d71f4fe
Opcode Fuzzy Hash: a942a2babffe53eb3c506c841fe05688f6c63c5a514333ca0b0eed9924e70194
Instruction Fuzzy Hash: 81311C71508344ABD724AF64CC4DB9FB7E8BF89705F00092ABB8893252D7789509EB53

Function 00F5B3A3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,00F5B464,00000000,00000FA0,00F8EFD4,00000000,?,00F5B58F,00000004,InitializeCriticalSectionEx,00F78F9C,InitializeCriticalSectionEx,00000000), ref: 00F5B433

Strings

api-ms-, xrefs: 00F5B3F3

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 5ce524a4036252aee3644ccc48d6ac4964de901009f9fce16c89eba327acfaab
Instruction ID: bfb00436f6f58c1fa964ffd32e11ea06ce6c322b2e68ff0c89c4159eed4c28ea
Opcode Fuzzy Hash: 5ce524a4036252aee3644ccc48d6ac4964de901009f9fce16c89eba327acfaab
Instruction Fuzzy Hash: EA11C232E41635ABDB32CF689C49B6D73A4AF01775F250120EE19E7281D770EE05B6D2

Function 00F627E7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00F627DC,?,?,00F627A4,?,?,?), ref: 00F627FC
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00F6280F
FreeLibrary.KERNEL32(00000000,?,?,00F627DC,?,?,00F627A4,?,?,?), ref: 00F62832

Strings

CorExitProcess, xrefs: 00F62807
mscoree.dll, xrefs: 00F627F5

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 4f4aa37cbaba804fbb56d89cbb37c302ac2ac7de3fe95a4277c523cc798622ee
Instruction ID: e653d90eb1f1f895340e8867e863371b1b11f3a331b6608098028bd9cbe03460
Opcode Fuzzy Hash: 4f4aa37cbaba804fbb56d89cbb37c302ac2ac7de3fe95a4277c523cc798622ee
Instruction Fuzzy Hash: 92F01C3194161CFBDB129BA0DD0AB9D7B79EB44766F144161E809A21A0CBB18F40FAD6

Function 00F5E955 Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00F5E887), ref: 00F5E977
GetFileInformationByHandle.KERNEL32(?,?), ref: 00F5E9D1
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00F5E887,?,000000FF,00000000,00000000), ref: 00F5EA5F
__dosmaperr.LIBCMT ref: 00F5EA66
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 00F5EAA3

Part of subcall function 00F5ED82: __dosmaperr.LIBCMT ref: 00F5EDB7

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: 76df95aa1384317f23b8c27d8ed51c292bc12d5cbdd1203b9e776b3204b55880
Instruction ID: f01c8a9091c9dd72ccf263a5a549be62fff9529a95c31a63c779c003bd53733b
Opcode Fuzzy Hash: 76df95aa1384317f23b8c27d8ed51c292bc12d5cbdd1203b9e776b3204b55880
Instruction Fuzzy Hash: E3416F75900204ABCB28DFB5DC459AFBBF9FF89311B00451DFA56D3211E7389A48EB10

Function 00F51D70 Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000002), ref: 00F51D8E
GetWindowLongW.USER32(?,00000008), ref: 00F51DA4
InvalidateRect.USER32(?,00000000,00000000), ref: 00F51DC3
SetWindowLongW.USER32(?,00000008,?), ref: 00F51DDE
EndDialog.USER32(?,?), ref: 00F51E17

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: DialogLongWindow$InvalidateRect
String ID:
API String ID: 1200242243-0
Opcode ID: 35951174aebc355fe0551280336abf48a79be2e1335c63e11f7031759b64025a
Instruction ID: 72ef2eb52f5dba8eb74be57d405bb46dd8eddc84c8882c28aa4925ad534eed54
Opcode Fuzzy Hash: 35951174aebc355fe0551280336abf48a79be2e1335c63e11f7031759b64025a
Instruction Fuzzy Hash: 5011E0359042147BE6209B14EC0AFAF77A4FB45322F108C15FE85D62D1C6A5FCC5E6A2

Function 00F6A654 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F6A66C

Part of subcall function 00F63B77: RtlFreeHeap.NTDLL(00000000,00000000,?,00F62C8E), ref: 00F63B8D
Part of subcall function 00F63B77: GetLastError.KERNEL32(?,?,00F62C8E), ref: 00F63B9F

_free.LIBCMT ref: 00F6A67E
_free.LIBCMT ref: 00F6A690
_free.LIBCMT ref: 00F6A6A2
_free.LIBCMT ref: 00F6A6B4

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b70929b96e95927e7c76b1533aa10232e646dffb323cb7073ccf7f308a75ed94
Instruction ID: 8ce288f14cc29528a7c818f92535e100ec2e2837f3179d362b4bb0b382ad8418
Opcode Fuzzy Hash: b70929b96e95927e7c76b1533aa10232e646dffb323cb7073ccf7f308a75ed94
Instruction Fuzzy Hash: B4F03032904244AB8660EB68EC86C7A73EDEE407207A94805F018E7521CB75FCC0AFA5

Function 00F54BB0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00F53630: _strncat.LIBCMT ref: 00F5368D

_strncpy.LIBCMT ref: 00F54D1D

Part of subcall function 00F53630: _strncat.LIBCMT ref: 00F536B2

_strncpy.LIBCMT ref: 00F54D46

Part of subcall function 00F533E0: _strrchr.LIBCMT ref: 00F533E8
Part of subcall function 00F533E0: _strrchr.LIBCMT ref: 00F533F7

Strings

SPLASH: Cannot extract requirement %s., xrefs: 00F54CD8
SPLASH: Cannot find requirement %s in archive., xrefs: 00F54D8B

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _strncat_strncpy_strrchr
String ID: SPLASH: Cannot extract requirement %s.$SPLASH: Cannot find requirement %s in archive.
API String ID: 4078740465-4094522769
Opcode ID: 5b4eebd5182f27e1bdaa872d5fcffac365495ca491ba9b012dc0650558483d65
Instruction ID: 2511db4ecb3df59b33a62026420ee0334ea4d0a9160cdb3665004b1fa753839f
Opcode Fuzzy Hash: 5b4eebd5182f27e1bdaa872d5fcffac365495ca491ba9b012dc0650558483d65
Instruction Fuzzy Hash: 0851C472404340ABDB21DF54CC85ADF77ECAF85359F000519FE8997202D775A64DEBA2

Function 00F54F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 00F54FE2
_strncpy.LIBCMT ref: 00F54FF4
_strncpy.LIBCMT ref: 00F55006

Strings

Cannot allocate memory for necessary files., xrefs: 00F550E1

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _strncpy
String ID: Cannot allocate memory for necessary files.
API String ID: 2961919466-2795144771
Opcode ID: d7c7a0e83be8ce285f4e944021e370b58d5a93e31adb349cfac03723dcf3749c
Instruction ID: 3936028c1cdd2d8b150a77e956c7a3298e567c6c718c49ac081f34ed32a26dd4
Opcode Fuzzy Hash: d7c7a0e83be8ce285f4e944021e370b58d5a93e31adb349cfac03723dcf3749c
Instruction Fuzzy Hash: 6241D4B2500205ABDB10DE68DC84EA63398BF44316F080975FF0CCB582D775E598A7B1

Function 00F61D83 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\ceFgl3jkkk.exe, xrefs: 00F61DC1, 00F61DC8, 00F61DFC

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\ceFgl3jkkk.exe
API String ID: 0-2340494698
Opcode ID: 1ee21537f8899424de46d14492487d68d136b9319ad74834ea4bb9b305180722
Instruction ID: 769c05011eb38cc9b8a535f25af5ba234d1ecafb8155463702d38078dff943d7
Opcode Fuzzy Hash: 1ee21537f8899424de46d14492487d68d136b9319ad74834ea4bb9b305180722
Instruction Fuzzy Hash: 46319171E00218EFCB21DF99CC819EEBBB8FF99310B144166E804E7211D7B59E44EBA0

Function 00F612F7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F613AF

Strings

TMP, xrefs: 00F61305

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _free
String ID: TMP
API String ID: 269201875-3125297090
Opcode ID: 2b6dec763d7ffd3746eac685c2f9a38739514d2a48c56df694a6c88b8f74af37
Instruction ID: fa3d2acf416d4f7a16f8131d253360dda85099e39a6b30d901fd219c02cec381
Opcode Fuzzy Hash: 2b6dec763d7ffd3746eac685c2f9a38739514d2a48c56df694a6c88b8f74af37
Instruction Fuzzy Hash: FD21937790420A6E5725AA1A9C83D7F73EDEAC277432D802AFC0A9B741EF74DD017261

Function 00F534A0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00001000,?,00F52F89,?,?), ref: 00F534CC

Part of subcall function 00F52290: GetLastError.KERNEL32(?,00000000), ref: 00F522AD

Strings

Failed to convert executable path to UTF-8., xrefs: 00F53517
Failed to get executable path., xrefs: 00F534D6
GetModuleFileNameW, xrefs: 00F534DB

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2776309574-1977442011
Opcode ID: 7203b36ba09c081e13841837aa3e3abb5763877b420da7cbadbee37e8c27ccf3
Instruction ID: 4b6baa833ee212b6c71ae0a493299a779dbd1518df30678c6390aaa1cfa8743d
Opcode Fuzzy Hash: 7203b36ba09c081e13841837aa3e3abb5763877b420da7cbadbee37e8c27ccf3
Instruction Fuzzy Hash: 6901DD757143006BF618A7249C8B7EB33C9AF54701F804455BF4DC2182F5AC9A0CE697

Function 00F66605 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00F6668F

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 3e2da1a130bff8e067e98c8726f26c942e917486e4e2f1078dcd2f7c3124a5e2
Instruction ID: 623d3f7e87e38a1deec7359d066e732d88ff50c55bf4223ad5eb84214dfbaf4b
Opcode Fuzzy Hash: 3e2da1a130bff8e067e98c8726f26c942e917486e4e2f1078dcd2f7c3124a5e2
Instruction Fuzzy Hash: 90B13772D002859FDB11CF38C851BEEBBF5EF55354F2481AAE845EB242D6399D01EBA0

Function 00F7007E Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F7014E
_free.LIBCMT ref: 00F70177
SetEndOfFile.KERNEL32(00000000,00F6E4B2,00000000,00F68438,?,?,?,?,?,?,?,00F6E4B2,00F68438,00000000), ref: 00F701A9
GetLastError.KERNEL32(?,?,?,?,?,?,?,00F6E4B2,00F68438,00000000,?,?,?,?,00000000), ref: 00F701C5

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 38b34470736f929ddddc942577d3d0716d7d75d946fcd3805a5bfe3ddab8f019
Instruction ID: 13ddb5071b192cfb74f8b1ca9e122d77cae321ad4dff42bc04ff47a7b393d20d
Opcode Fuzzy Hash: 38b34470736f929ddddc942577d3d0716d7d75d946fcd3805a5bfe3ddab8f019
Instruction Fuzzy Hash: 8E412832900204EBDB15ABB8DC42B9E37B5EF443B0F644552F91CE72A1DEB8D954B722

Function 00F66254 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00F5C84E,?,?,?,?,00F5C00A,?,?,?), ref: 00F66259
_free.LIBCMT ref: 00F662B6
_free.LIBCMT ref: 00F662EC
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,00F5C00A,?,?,?), ref: 00F662F7

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 0a328ae28c16c738952a67607553d029ee42de488aa70b80dd4b02acec98e26e
Instruction ID: 136cb0932026ed6828fda241b995760918b02c09c823bb6373c1d24061a6b29d
Opcode Fuzzy Hash: 0a328ae28c16c738952a67607553d029ee42de488aa70b80dd4b02acec98e26e
Instruction Fuzzy Hash: F11182326046443ADF5137B89CD7E7B3A59DBC1778B340224F924C72E2DEB58D097220

Function 00F663AB Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00F5E61E,00F63B9D,?,?,00F62C8E), ref: 00F663B0
_free.LIBCMT ref: 00F6640D
_free.LIBCMT ref: 00F66443
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00F5E61E,00F63B9D,?,?,00F62C8E), ref: 00F6644E

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: c6a07b6bf22a65b253cad5691fbdbe7150554be9579b9deafa7ae28fb5c45217
Instruction ID: ad61a686e0009904b778177c8fe733baf8bba1387840896059b781d75bd600b9
Opcode Fuzzy Hash: c6a07b6bf22a65b253cad5691fbdbe7150554be9579b9deafa7ae28fb5c45217
Instruction Fuzzy Hash: F711A5326046147AD7117AB5AC87E7B3659DBC1774B240334F528D33E1DEB58C457311

Function 00F5F1CC Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,00F5F2C8,00000000,?,00F67FB9,00000000,00000000,00F5F2C8,?,?,00000000,00000000,00000001), ref: 00F5F1E2
GetLastError.KERNEL32(?,00F67FB9,00000000,00000000,00F5F2C8,?,?,00000000,00000000,00000001,00000000,00000000,?,00F5F2C8,00000000,00000104), ref: 00F5F1EC
__dosmaperr.LIBCMT ref: 00F5F1F3

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: b2929e8e3de4c27899dfb58b33ef189809aac49330ff89cc93e7d278efb7e2b0
Instruction ID: ac1cbd61f767423f856330e0a65cf455ee27284160f5922c561c3f7546230a5b
Opcode Fuzzy Hash: b2929e8e3de4c27899dfb58b33ef189809aac49330ff89cc93e7d278efb7e2b0
Instruction Fuzzy Hash: E9F06D36A00115BBCB202FA2DC08D5AFF69EF457B270445A1FA19C6420D731E969FBD0

Function 00F5F163 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,00F5F2C8,00000000,?,00F6802E,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 00F5F179
GetLastError.KERNEL32(?,00F6802E,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,00F5F2C8,00000000,00000104,?), ref: 00F5F183
__dosmaperr.LIBCMT ref: 00F5F18A

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: d9a54613b5a475e994f8ec2bc3b85c782482a97b510cc08c41ed2cf40d44f248
Instruction ID: 86f8cb9fd64ca095aeac8cc7ba234300bac01f384a57444d162aadc13a297d2a
Opcode Fuzzy Hash: d9a54613b5a475e994f8ec2bc3b85c782482a97b510cc08c41ed2cf40d44f248
Instruction Fuzzy Hash: 88F06932A00915FBCB202BA2DC08D5ABF6AEF443A27154562FA1DC6420D731E968FBD0

Function 00F6F667 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,00F6B50E,00000000,00000001,00000000,00000000,?,00F651C5,?,?,00000000), ref: 00F6F67E
GetLastError.KERNEL32(?,00F6B50E,00000000,00000001,00000000,00000000,?,00F651C5,?,?,00000000,?,00000000,?,00F65711,?), ref: 00F6F68A

Part of subcall function 00F6F650: CloseHandle.KERNEL32(FFFFFFFE,00F6F69A,?,00F6B50E,00000000,00000001,00000000,00000000,?,00F651C5,?,?,00000000,?,00000000), ref: 00F6F660

___initconout.LIBCMT ref: 00F6F69A

Part of subcall function 00F6F612: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00F6F641,00F6B4FB,00000000,?,00F651C5,?,?,00000000,?), ref: 00F6F625

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,00F6B50E,00000000,00000001,00000000,00000000,?,00F651C5,?,?,00000000,?), ref: 00F6F6AF

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: de70cf53483ed63e81c22757a3f055b67df80735369e5c45ac841450481bd5ff
Instruction ID: 44d623b026365f8bbcac9ade9d576851d5f63ffecef2259d229fc677b74173b4
Opcode Fuzzy Hash: de70cf53483ed63e81c22757a3f055b67df80735369e5c45ac841450481bd5ff
Instruction Fuzzy Hash: EAF03937400128BBCF222F95ED099DA7F66FF197A0B404020FA0C96170CB338964BB91

Function 00F62DCC Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F62DD5

Part of subcall function 00F63B77: RtlFreeHeap.NTDLL(00000000,00000000,?,00F62C8E), ref: 00F63B8D
Part of subcall function 00F63B77: GetLastError.KERNEL32(?,?,00F62C8E), ref: 00F63B9F

_free.LIBCMT ref: 00F62DE8
_free.LIBCMT ref: 00F62DF9
_free.LIBCMT ref: 00F62E0A

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 00ab3fef0f48faab1170fbd163fd7754a07a314bb970dfdf4ea34aaeb44ff74e
Instruction ID: cbf15a8db23bfed0f43eb8ecd8a3a98e53ff0e54d82640f23c8a9c4b1b90513c
Opcode Fuzzy Hash: 00ab3fef0f48faab1170fbd163fd7754a07a314bb970dfdf4ea34aaeb44ff74e
Instruction Fuzzy Hash: 57E0BF714001689E8711AF25FC028F63B75E7887207514027F414A2232C7B5165DFFD1

Function 00F54310 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

_mbstowcs.LIBCMT ref: 00F543D2

Strings

Failed to convert Wflag %s using mbstowcs (invalid multibyte string), xrefs: 00F544DA
pyi-, xrefs: 00F5438B

Memory Dump Source

Source File: 00000000.00000002.1552781712.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1552644504.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552882128.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552907895.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1552984840.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _mbstowcs
String ID: Failed to convert Wflag %s using mbstowcs (invalid multibyte string)$pyi-
API String ID: 686213805-3625900369
Opcode ID: 1eec3864be578206728606b48d12121a23e467f040a6e6459063817da859d417
Instruction ID: fa3554216c446def08ab37fcb0b8a6d9cd0deafa84d4ecbccc4e2728118b1d6d
Opcode Fuzzy Hash: 1eec3864be578206728606b48d12121a23e467f040a6e6459063817da859d417
Instruction Fuzzy Hash: 6341E8B69403006BD754EF64EC47F6637A8AB0031AF440950FF0497293EABDB55CB7A2

Analysis Process: ceFgl3jkkk.exePID: 7008, Parent PID: 824COMMON

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	36

Executed Functions

Function 00F627A5 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00F627A4,?,?,?,?,?,00F5C00A), ref: 00F627C7
TerminateProcess.KERNEL32(00000000,?,00F627A4,?,?,?,?,?,00F5C00A), ref: 00F627CE
ExitProcess.KERNEL32 ref: 00F627E0

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0b6b6f1089981358f8e89a7c8722e8e47401efdfd1f8d5fa4a1b7ba3537c6626
Instruction ID: ed649b7f3ef905d911cfbafec6c0ba88809bbd567e01d6bedf1300f94c5e6612
Opcode Fuzzy Hash: 0b6b6f1089981358f8e89a7c8722e8e47401efdfd1f8d5fa4a1b7ba3537c6626
Instruction Fuzzy Hash: 4FE04631400548EFCF11AF24CC48D083B68EB00351B004520F80A8A532CB39EE81FB91

Function 00F51740 Relevance: 21.2, APIs: 2, Strings: 10, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 00F517ED
__fread_nolock.LIBCMT ref: 00F518B8

Strings

Failed to read cookie!, xrefs: 00F517FA
Failed to seek to cookie position!, xrefs: 00F517BC
fseek, xrefs: 00F517C1
fread, xrefs: 00F517FF
Error on file., xrefs: 00F518E6
Could not allocate buffer for TOC!, xrefs: 00F51889
Cannot read Table of Contents., xrefs: 00F5193C
malloc, xrefs: 00F5188E
Could not read full TOC!, xrefs: 00F518C5
MEI, xrefs: 00F51778

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: __fread_nolock
String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 2638373210-4158440160
Opcode ID: abff41bf91693fff641e96be83e4bc90fc6b55b5d6f9cea76ec7c316db1b3975
Instruction ID: 5ecc2a3e2051054b1bfb9eef16c1b2163bd7af2362ac5ce5d6a4da7e54919e3e
Opcode Fuzzy Hash: abff41bf91693fff641e96be83e4bc90fc6b55b5d6f9cea76ec7c316db1b3975
Instruction Fuzzy Hash: 2F51E771A007009BC718DF28DC46A16B7E1BF48322F548A2DFA4EC3691E675E54CEB43

Function 00F644F5 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00F6477D

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: aea0334473c4d0b6b232e3e03ae3b2abd8ea6ab403e7d246086e65437f25ec74
Instruction ID: a7a0e8eb29fb076b53c19a031dd8d6fd14bd5957a19ae675367737c91044f0fd
Opcode Fuzzy Hash: aea0334473c4d0b6b232e3e03ae3b2abd8ea6ab403e7d246086e65437f25ec74
Instruction Fuzzy Hash: B2C11575E04249AFCF15EFA8CC80BBDBBB0AF4A310F144159E9159B292C734AE41EB21

Function 00F6E4D6 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F6E21D: CreateFileW.KERNELBASE(00000000,00000000,?,00F6E57F,?,?,00000000,?,00F6E57F,00000000,0000000C), ref: 00F6E23A

GetLastError.KERNEL32 ref: 00F6E5EA
__dosmaperr.LIBCMT ref: 00F6E5F1
GetFileType.KERNELBASE(00000000), ref: 00F6E5FD
GetLastError.KERNEL32 ref: 00F6E607
__dosmaperr.LIBCMT ref: 00F6E610
CloseHandle.KERNEL32(00000000), ref: 00F6E630
CloseHandle.KERNEL32(00000000), ref: 00F6E77D
GetLastError.KERNEL32 ref: 00F6E7AF
__dosmaperr.LIBCMT ref: 00F6E7B6

Strings

H, xrefs: 00F6E73B

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 431752f102ec7e2622de3b71c8dc9f2c8d2e66beb5f2d40c5df46ba4aa6496fc
Instruction ID: a4914d0f7dfa9b9710d8b369e1f4e1515fb203e412ab33096a17686aa72cbc8c
Opcode Fuzzy Hash: 431752f102ec7e2622de3b71c8dc9f2c8d2e66beb5f2d40c5df46ba4aa6496fc
Instruction Fuzzy Hash: 69A14637A101189FCF19DF68DC51BEE3BA1AB06324F28015DE812EF292DB358D16EB51

Function 00F512A0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00F512CF
fseek, xrefs: 00F5130B
fread, xrefs: 00F513F7
Failed to extract %s: failed to read data chunk!, xrefs: 00F513F2
malloc, xrefs: 00F51341
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00F5133C
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00F51306

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 0-3659356012
Opcode ID: e105c710dacc578b9eab87afd29fb1470a40d89bbb1de6cb1f786e4433316a98
Instruction ID: df981358432b7b6d3fcdab9b1473859f20f81adb5b91decf0455604aad4387c6
Opcode Fuzzy Hash: e105c710dacc578b9eab87afd29fb1470a40d89bbb1de6cb1f786e4433316a98
Instruction Fuzzy Hash: 5A412B72E003116BEB14AF648C91B2B7798FF40766F048565FE049B642E775FA0CB293

Function 00F52F30 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 336
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F534A0: GetModuleFileNameW.KERNEL32(00000000,?,00001000,?,00F52F89,?,?), ref: 00F534CC

SetDllDirectoryW.KERNEL32(?), ref: 00F531C1

Part of subcall function 00F55C60: GetEnvironmentVariableW.KERNEL32(00000000,?,00002000,?,00F52FD8,_MEIPASS2), ref: 00F55C96
Part of subcall function 00F55C60: ExpandEnvironmentStringsW.KERNEL32(?,?,00002000,?,00002000,?,00F52FD8,_MEIPASS2), ref: 00F55CB2

Strings

_MEIPASS2, xrefs: 00F52FCE, 00F53053, 00F5331D, 00F53327
Failed to convert DLL search path!, xrefs: 00F531A7
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00F5309B
Cannot side-load external archive %s (code %d)!, xrefs: 00F530F0, 00F5313F
_PYI_ONEDIR_MODE, xrefs: 00F52FEC, 00F53031
MEI, xrefs: 00F530FC

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: 734a7e3a4ae3d4b4580960101363d7ce885150d757c2e64e8ff0aa277c0216fd
Instruction ID: ed3398947a25329c485e641722581280a5255d89ddfcac71a0405a9ef43fc0bf
Opcode Fuzzy Hash: 734a7e3a4ae3d4b4580960101363d7ce885150d757c2e64e8ff0aa277c0216fd
Instruction Fuzzy Hash: 0EB13B72D087416BC711AA749C42BAF77DCAF5475AF040529FF8882142E769E70CB7A3

Function 00F51040 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1.2.11, xrefs: 00F5104D
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00F510B1
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00F511DE
malloc, xrefs: 00F510B6, 00F510E8
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00F510E3
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00F5107E

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID: 1.2.11$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 0-1060636955
Opcode ID: b83f119209401e4dc65f829dccba4ae24f1bec04eb59fdc36accf4d6ceb2c2c0
Instruction ID: 7f51e05d369b6216dd8425dd802cdf752b2134067000c3176bb48a8794fd94db
Opcode Fuzzy Hash: b83f119209401e4dc65f829dccba4ae24f1bec04eb59fdc36accf4d6ceb2c2c0
Instruction Fuzzy Hash: 1B51F771D043005BD3109F689C82B5BBBE8BF45762F04096DFF48D6282E765EA0CA793

Function 00F670E9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ext-ms-, xrefs: 00F67154
api-ms-, xrefs: 00F67140

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: a0932203a1c304cb69444c85e3e16df8b7be7887f7c26664a1fdd71369748fb6
Instruction ID: 378f146946c2a4c7c8d676ad1a4221bf3766984b1555ba7ffe014a561a214a2b
Opcode Fuzzy Hash: a0932203a1c304cb69444c85e3e16df8b7be7887f7c26664a1fdd71369748fb6
Instruction Fuzzy Hash: E1210A32E09325BBDB22AB349C44B5A77599F437BCF250523ED09A7292D630DE01F6E1

Function 00F63CCA Relevance: 4.6, APIs: 3, Instructions: 61
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,00F63BF8,?,00F7F038,0000000C,00F63CAA,?,?,?), ref: 00F63D20
GetLastError.KERNEL32(?,00F63BF8,?,00F7F038,0000000C,00F63CAA,?,?,?), ref: 00F63D2A
__dosmaperr.LIBCMT ref: 00F63D55

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: cbeec3b724bd6bc1322411d6eb8fdfbf1c073c406e7141d9b3868d8ea3b7b297
Instruction ID: 1675435a84074543a518818187f7684e68433e5bb0626e246cdd708320fd5a51
Opcode Fuzzy Hash: cbeec3b724bd6bc1322411d6eb8fdfbf1c073c406e7141d9b3868d8ea3b7b297
Instruction Fuzzy Hash: CD018E33F0026C1BC2205374DC06B7E77884F82774F38025DF818971C2DE698E817290

Function 00F64B46 Relevance: 4.5, APIs: 3, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00000002,00000000,00000000,?,00000000,00000000,00000000,?,00F64BF3,00000000,00000000,00000002,00000000), ref: 00F64B7F
GetLastError.KERNEL32(?,00F64BF3,00000000,00000000,00000002,00000000,?,00F656E7,00000000,00000000,00000000,00000002,00000000,00000000,00000000,?), ref: 00F64B89
__dosmaperr.LIBCMT ref: 00F64B90

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: bb3a9f583bf9ebc3ca19c95d4aa6e6f5b1be245641caa32a89aacbf4ed7b3c77
Instruction ID: ad79fd64dd8721ce693d9f515998a546d84c12524825a32f6cd3a6de087449d8
Opcode Fuzzy Hash: bb3a9f583bf9ebc3ca19c95d4aa6e6f5b1be245641caa32a89aacbf4ed7b3c77
Instruction Fuzzy Hash: DA01D833610518BBCB059B99DC45DAE3B29DBC5330B340248F952971D1EA74EE41B750

Function 00F5E7ED Relevance: 3.1, APIs: 2, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 743a8a1489fe49b5f73c151042bfa6c5f9fdb502205f960bb9f56359e76b3a77
Instruction ID: d83dc877b67e1c5f115108f63999c206d2d7de3ed9e3405fb0ce5b1450cdb9ff
Opcode Fuzzy Hash: 743a8a1489fe49b5f73c151042bfa6c5f9fdb502205f960bb9f56359e76b3a77
Instruction Fuzzy Hash: A8210A32D00218BBEB156B689C46B9F37689F4237BF110361FE282B1D1D7745F0AB661

Function 00F615D8 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f6b945254909cfc76e1310d7d940492520b8a62310ebc3fcd86163cea8f9bd5
Instruction ID: 66cdf32264a3599041b57c3d7030ed707ed2f402daca8f1a3faeac4a5d9ac512
Opcode Fuzzy Hash: 9f6b945254909cfc76e1310d7d940492520b8a62310ebc3fcd86163cea8f9bd5
Instruction Fuzzy Hash: 2B410375E00208AFDB14DF58CC81AA97BB2FB89364F2C8168F8499B351D771DE42EB50

Function 00F562C0 Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00F56381

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 5acec9a429ba90609930334b44af4e936b8faf020c2940179ccbef0e36a064b9
Instruction ID: f97fec9e9f030ba093166362ebcd9374224453f0d446ef39276d318ccc1e00ff
Opcode Fuzzy Hash: 5acec9a429ba90609930334b44af4e936b8faf020c2940179ccbef0e36a064b9
Instruction Fuzzy Hash: D0410972E0470157D7208A288C4171BBB92AF9533AFA94724FEB4D33C5EB25EC8D5292

Function 00F671B0 Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbdc0820e60ef6b5c02852c9838e6dbde2c219231d4c2634b3c3e2098b1b19d0
Instruction ID: d33b6fc810dc9a0516b7e832264c5b719ef5d9e796f19fcaff3039d439cc8d82
Opcode Fuzzy Hash: cbdc0820e60ef6b5c02852c9838e6dbde2c219231d4c2634b3c3e2098b1b19d0
Instruction Fuzzy Hash: BD0128377083195F9F11AE6DED50AAB3396EBC53383248120FA14CB158EA30C801BB50

Function 00F683F9 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00F68433

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 2fe2e3197cdd298c95c29f29c8ab82eb04910d717c57a7ffdefd5c7d3e99af51
Instruction ID: b47e434e2d21b111a8465f1b092a3887b98e016366cb9959fc3150357e01a7d9
Opcode Fuzzy Hash: 2fe2e3197cdd298c95c29f29c8ab82eb04910d717c57a7ffdefd5c7d3e99af51
Instruction Fuzzy Hash: A3115AB1A0010AAFCF05DF58E94199F7BF4EF48304F044069F804EB251DA30DA12DB64

Function 00F5B5E5 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d8cb16c0ed68794755dee3499a829f3980c3b08fb60c41143e5e71e23a383f7
Instruction ID: 100c7452f0deb6b0d23e240a3caaaeb17fbaae67ae8569e991c19c1506b6a2a0
Opcode Fuzzy Hash: 0d8cb16c0ed68794755dee3499a829f3980c3b08fb60c41143e5e71e23a383f7
Instruction Fuzzy Hash: C9F0FC32901E145AD7213B6ADC05B5B36E88F81376F140755FE38931D1CB7DE90ABBA1

Function 00F67024 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00F663F6,00000001,00000364,00000006,000000FF,?,?,00F5E61E,00F63B9D,?,?,00F62C8E), ref: 00F67065

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4f595e8d34d4b131a741000f2197e8a270a8dbc5d6f4d5ba275a44650c1a2156
Instruction ID: dfc755ca9c7628ede7eaa05474e3197fa3aad0c210fd61459e14adb2f4c8c4f3
Opcode Fuzzy Hash: 4f595e8d34d4b131a741000f2197e8a270a8dbc5d6f4d5ba275a44650c1a2156
Instruction Fuzzy Hash: F8F0BE32A08329B6EB317B629C15B6B37589B817B8B244121FC08AA1C0CB24D841B6F0

Function 00F65BA2 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00F60F97,00F7EE98,00000018,00000003,00F7EEB8), ref: 00F65BD4

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 81edc46d480ececd6ba9d3873fcde259bf81b5642f897dd4fd5ae207ff66cab5
Instruction ID: fc02fb2bba9634e03361d370ad02d32b42a880e516708c6aca3ca04088f08efa
Opcode Fuzzy Hash: 81edc46d480ececd6ba9d3873fcde259bf81b5642f897dd4fd5ae207ff66cab5
Instruction Fuzzy Hash: 53E0E531904A3857E62126629C01B5E36589BC2BF0F590021EC08B20C0DF50DC0072E5

Function 00F63ECC Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F63EF0

Part of subcall function 00F63B77: RtlFreeHeap.NTDLL(00000000,00000000,?,00F62C8E), ref: 00F63B8D
Part of subcall function 00F63B77: GetLastError.KERNEL32(?,?,00F62C8E), ref: 00F63B9F

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: d506a703889d1df9b84338a8fc89d2461505e676fc6750c7c70b1ee1d0b25cda
Instruction ID: 68d517dbbbab155f516ebd410f7eab8e7d3e5845cae8cc1f0d9716a8d14d35cf
Opcode Fuzzy Hash: d506a703889d1df9b84338a8fc89d2461505e676fc6750c7c70b1ee1d0b25cda
Instruction Fuzzy Hash: B4F06D375502059F8724CE6CD900A82BBE4EF993217108529E89DD3220D330F912CB80

Function 00F56290 Relevance: 1.5, APIs: 1, Instructions: 20libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F56990: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,00F5246C,?,?,00000400,?,00000000,00000800), ref: 00F569A8

LoadLibraryExW.KERNEL32(00000000,00000000,00000008,?,00F542A0,?,?,?,?,?,00F532CB,00000000,00000000), ref: 00F562A9

Part of subcall function 00F5E365: _free.LIBCMT ref: 00F5E378

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide_free
String ID:
API String ID: 2186588979-0
Opcode ID: 033691ccf5149d40cb841d55adc04927bfbf128c4c070bcb14c755458dadf0a9
Instruction ID: d53d8e0c70de29091bbc44167acdf27ef22b9d8e3a3adfc621b8985a03366562
Opcode Fuzzy Hash: 033691ccf5149d40cb841d55adc04927bfbf128c4c070bcb14c755458dadf0a9
Instruction Fuzzy Hash: CBD0A773B4021033F52062B53C0BF1B79649BD1F52F040438FB08DB1C1E564690963A3

Function 00F6E21D Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00F6E57F,?,?,00000000,?,00F6E57F,00000000,0000000C), ref: 00F6E23A

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7981c14998fc25a05b7d19db6cf91c22a0eae49ebeeaf885383825aaae4742d4
Instruction ID: f10a66afa7e949adf7d90b9b5c31a54a8b797fbcd415b6d70d92198432e69040
Opcode Fuzzy Hash: 7981c14998fc25a05b7d19db6cf91c22a0eae49ebeeaf885383825aaae4742d4
Instruction Fuzzy Hash: F6D06C3210010DBBDF028F84DC06EDA3BAAFB4C714F018000FA5856020C772E961EB91

Function 00F5E365 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F5E378

Part of subcall function 00F63B77: RtlFreeHeap.NTDLL(00000000,00000000,?,00F62C8E), ref: 00F63B8D
Part of subcall function 00F63B77: GetLastError.KERNEL32(?,?,00F62C8E), ref: 00F63B9F

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: cb0e52e07d19aed88f44ef5871020cea48750a9e516630401a30a74b753e8c05
Instruction ID: 2de662f20f6b9d75b6e0769f2c72da5dfc320ee6b1c78629d1e5ea01de47a5b6
Opcode Fuzzy Hash: cb0e52e07d19aed88f44ef5871020cea48750a9e516630401a30a74b753e8c05
Instruction Fuzzy Hash: 97C04C71500248BBDB059B45D907E5E7BB9DB80364F204054F41557261DBB5EF44A690

Non-executed Functions

Function 00F603E2 Relevance: 6.2, APIs: 4, Instructions: 194fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 00F6042B
GetLastError.KERNEL32 ref: 00F60438

Part of subcall function 00F60624: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,00F604A8,?), ref: 00F60649
Part of subcall function 00F60624: SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,00F604A8,?,?,?,?,00F604A8,?), ref: 00F6065D

FindNextFileW.KERNEL32(?,?,?), ref: 00F6055A
GetLastError.KERNEL32 ref: 00F60564

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: Time$File$ErrorFindLastSystem$FirstLocalNextSpecific
String ID:
API String ID: 3693236040-0
Opcode ID: 1b5a516881bae2cec06a0d0043463566a7af8e0656e9601bdf979be2eb493b4e
Instruction ID: 0ae6789b775f2cab069fe7cd0f2c318e5b4abd73dd0ef3a09e83c59c552c8d7b
Opcode Fuzzy Hash: 1b5a516881bae2cec06a0d0043463566a7af8e0656e9601bdf979be2eb493b4e
Instruction Fuzzy Hash: E551D7B19006189FCB35EFB4CC85AABB7E8AF44314F240A56E516C7281EF78DE44AF50

Function 00F59EE1 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00F59EED
IsDebuggerPresent.KERNEL32 ref: 00F59FB9
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00F59FD9
UnhandledExceptionFilter.KERNEL32(?), ref: 00F59FE3

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 166596d5fdfb0bf12ea1267aad2eb40ab6bfda72bbee71e74c74db34677bfb63
Instruction ID: 57b4577b6469121106d9eba3259d8e8c36f7b6ef624ed7648801377cda07a101
Opcode Fuzzy Hash: 166596d5fdfb0bf12ea1267aad2eb40ab6bfda72bbee71e74c74db34677bfb63
Instruction Fuzzy Hash: AB315A75D0521DDBDB10DF64D9897CCBBF8AF08305F1041AAE50CA7250EB709B88AF45

Function 00F55270 Relevance: 164.9, APIs: 31, Strings: 63, Instructions: 443libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00F531FD,Tcl_Init), ref: 00F55282
GetProcAddress.KERNEL32(00F531FD,Tcl_CreateInterp), ref: 00F552AB

Part of subcall function 00F52290: GetLastError.KERNEL32(?,00000000), ref: 00F522AD

Strings

Tcl_GetObjResult, xrefs: 00F5562B
Tcl_Free, xrefs: 00F556F8
Tcl_NewStringObj, xrefs: 00F555B0
Failed to get address for Tcl_Free, xrefs: 00F55709
Tcl_NewByteArrayObj, xrefs: 00F555D9
Tcl_DeleteInterp, xrefs: 00F55372
Tcl_FinalizeThread, xrefs: 00F55349
Tcl_CreateThread, xrefs: 00F5539B
Failed to get address for Tcl_GetObjResult, xrefs: 00F5563C
Failed to get address for Tcl_CreateInterp, xrefs: 00F552B6
Failed to get address for Tcl_FinalizeThread, xrefs: 00F5535A
Tk_Init, xrefs: 00F55725
GetProcAddress, xrefs: 00F55292, 00F552BB, 00F552E4, 00F5530D, 00F55336, 00F5535F, 00F55388, 00F553B1, 00F553DA, 00F55403, 00F5542C, 00F55455, 00F5547E, 00F554A7, 00F554D0, 00F554F9, 00F55522, 00F5554B, 00F55574, 00F5559D, 00F555C6, 00F555EF, 00F55618, 00F55641, 00F5566A, 00F55693, 00F556BC, 00F556E5, 00F5570E, 00F5573B, 00F55764
Failed to get address for Tcl_ConditionWait, xrefs: 00F554A2
Tcl_ConditionNotify, xrefs: 00F55468
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00F554CB
Failed to get address for Tk_GetNumMainWindows, xrefs: 00F5575F
Failed to get address for Tcl_CreateThread, xrefs: 00F553AC
Tcl_Finalize, xrefs: 00F55320
Tcl_EvalEx, xrefs: 00F5567D
Failed to get address for Tcl_DeleteInterp, xrefs: 00F55383
Tcl_ThreadQueueEvent, xrefs: 00F554BA
Failed to get address for Tcl_GetCurrentThread, xrefs: 00F553D5
Failed to get address for Tcl_DoOneEvent, xrefs: 00F55308
Tcl_ConditionWait, xrefs: 00F55491
Tcl_EvalObjv, xrefs: 00F556A6
Failed to get address for Tcl_GetString, xrefs: 00F55598
Failed to get address for Tcl_MutexLock, xrefs: 00F553FE
Failed to get address for Tk_Init, xrefs: 00F55736
Tcl_CreateObjCommand, xrefs: 00F5555E
Failed to get address for Tcl_Init, xrefs: 00F5528D
Tcl_SetVar2Ex, xrefs: 00F55602
Failed to get address for Tcl_NewStringObj, xrefs: 00F555C1
Tcl_GetCurrentThread, xrefs: 00F553C4
Failed to get address for Tcl_GetVar2, xrefs: 00F5551D
Failed to get address for Tcl_EvalFile, xrefs: 00F55665
Tcl_EvalFile, xrefs: 00F55654
Failed to get address for Tcl_ThreadAlert, xrefs: 00F554F4
Failed to get address for Tcl_ConditionNotify, xrefs: 00F55479
Failed to get address for Tcl_CreateObjCommand, xrefs: 00F5556F
Tcl_FindExecutable, xrefs: 00F552CE
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00F555EA
Failed to get address for Tcl_SetVar2, xrefs: 00F55546
Tcl_ThreadAlert, xrefs: 00F554E3
Tcl_Init, xrefs: 00F5527C
Tcl_MutexLock, xrefs: 00F553ED
Failed to get address for Tcl_EvalObjv, xrefs: 00F556B7
Tcl_SetVar2, xrefs: 00F55535
Failed to get address for Tcl_MutexUnlock, xrefs: 00F55427
Tcl_GetVar2, xrefs: 00F5550C
Failed to get address for Tcl_ConditionFinalize, xrefs: 00F55450
Tcl_ConditionFinalize, xrefs: 00F5543F
Failed to get address for Tcl_SetVar2Ex, xrefs: 00F55613
Tcl_Alloc, xrefs: 00F556CF
Tcl_MutexUnlock, xrefs: 00F55416
Failed to get address for Tcl_Alloc, xrefs: 00F556E0
Failed to get address for Tcl_EvalEx, xrefs: 00F5568E
Tcl_CreateInterp, xrefs: 00F552A5
Tcl_DoOneEvent, xrefs: 00F552F7
Tk_GetNumMainWindows, xrefs: 00F5574E
Tcl_GetString, xrefs: 00F55587
Failed to get address for Tcl_Finalize, xrefs: 00F55331
Failed to get address for Tcl_FindExecutable, xrefs: 00F552DF

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 4214558900-2208601799
Opcode ID: a0fc877d171adfd2ed7000cb62b6bb94d57ecf5a4a5ecd5408dc674aacfad696
Instruction ID: 7c67fa0a043817b5edd0f48540477e452df1304ebb6fe0ebe541d920b6d020c0
Opcode Fuzzy Hash: a0fc877d171adfd2ed7000cb62b6bb94d57ecf5a4a5ecd5408dc674aacfad696
Instruction Fuzzy Hash: 7DB1AF76F94B1A215640273D7C529A93B984ED2F377008337FA28E81D1FBD1C68976A3

Function 00F51AD0 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 192windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00F51B0B
MulDiv.KERNEL32(?,00000032,00000004), ref: 00F51B21
MulDiv.KERNEL32(00000000,0000000E,00000008), ref: 00F51B32
SystemParametersInfoW.USER32(00000029,000001F8,000001F8,00000000), ref: 00F51B7B
CreateFontIndirectW.GDI32(?), ref: 00F51B8D
#380.COMCTL32(00000000,00007F01,00000001,?), ref: 00F51BAD
CreateWindowExW.USER32(00000000,STATIC,00000000,50000003,80000000,80000000,80000000,80000000,?,00000000,?,00000000), ref: 00F51BE4
CreateWindowExW.USER32(00000000,STATIC,00000000,50000000,80000000,80000000,80000000,80000000,?,00000000,?,00000000), ref: 00F51C17
CreateWindowExW.USER32(00000200,EDIT,00000000,50300884,80000000,80000000,80000000,80000000,?,00000000,?,00000000), ref: 00F51C4D
CreateWindowExW.USER32(00000000,BUTTON,Close,50000001,80000000,80000000,80000000,80000000,?,00000001,?,00000000), ref: 00F51C83
SendMessageW.USER32(?,00000080,00000000,?), ref: 00F51C9D
SendMessageW.USER32(?,00000080,00000001,?), ref: 00F51CAB
SendMessageW.USER32(?,00000172,00000001,?), ref: 00F51CBC
SendMessageW.USER32(?,00000030,?,00000001), ref: 00F51CD0
SendMessageW.USER32(?,00000030,?,00000001), ref: 00F51CE2
SendMessageW.USER32(?,00000030,?,00000001), ref: 00F51CF4
SendMessageW.USER32(?,00000030,?,00000001), ref: 00F51D06
SendMessageW.USER32(?,0000000C,00000000,?), ref: 00F51D13
SendMessageW.USER32(?,0000000C,00000000,?), ref: 00F51D22
GetClientRect.USER32(?,?), ref: 00F51D2C

Part of subcall function 00F51E30: GetDC.USER32(?), ref: 00F51E50
Part of subcall function 00F51E30: SelectObject.GDI32(00000000,?), ref: 00F51EA0
Part of subcall function 00F51E30: DrawTextW.USER32(00000000,?,000000FF,?,00002550), ref: 00F51EB5
Part of subcall function 00F51E30: SelectObject.GDI32(00000000,00000000), ref: 00F51EC6
Part of subcall function 00F51E30: ReleaseDC.USER32(?,00000000), ref: 00F51ECF
Part of subcall function 00F51E30: MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?,?,?,?,?,00000032,00000004), ref: 00F51F1C
Part of subcall function 00F51E30: MoveWindow.USER32(?,?,?,?,00000014,00000001,?,?,?,?,?,?,?,00000032,00000004), ref: 00F51F4B

Strings

EDIT, xrefs: 00F51C43
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00F51AF8
BUTTON, xrefs: 00F51C7C
@U=u, xrefs: 00F51C87
Close, xrefs: 00F51C77
STATIC, xrefs: 00F51BDD, 00F51C10

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: MessageSend$Window$Create$MoveObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: @U=u$BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 4195728924-25750965
Opcode ID: 3c18f9affd25c9dc881479f8d8ce43079b7ba192e61f58d354c1a3a554b129e7
Instruction ID: 6898291b3241382566754ad895d9d568f41699417e5133de9651262db7700f52
Opcode Fuzzy Hash: 3c18f9affd25c9dc881479f8d8ce43079b7ba192e61f58d354c1a3a554b129e7
Instruction Fuzzy Hash: 83612F31680314FAFB315F508C8AF967F65EF08B01F244166BF087D1E6D6B1A524EB6A

Function 00F68975 Relevance: 25.9, APIs: 17, Instructions: 411COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00F6899F
_free.LIBCMT ref: 00F68A78
_free.LIBCMT ref: 00F68AA5

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: ed6bcccc665aa8bb5381d8e38cae2c9e33cd55fdc12e65e2b80ebb1c3a9ae4fa
Instruction ID: 7eebc7faafd60e2475b944ebb65371d9c55c0f583b754b6d4413a7724ec5b1a3
Opcode Fuzzy Hash: ed6bcccc665aa8bb5381d8e38cae2c9e33cd55fdc12e65e2b80ebb1c3a9ae4fa
Instruction Fuzzy Hash: 7DD108B1D00305AFDB24AFA48C42A7E77B4EF513A4F04436DE915A7281EF759902FB61

Function 00F524F0 Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 314COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00F5254A

Strings

%s%s%s.exe, xrefs: 00F526C3
%s%s%s, xrefs: 00F526EA
%s%s%s.pkg, xrefs: 00F5269C
Archive path exceeds PATH_MAX, xrefs: 00F528EF
Archive not found: %s, xrefs: 00F52839, 00F5284F, 00F5290A
%s%s%s%s%s, xrefs: 00F525C5
%s%s%s%s%s%s%s, xrefs: 00F52629
malloc, xrefs: 00F5281E
Error copying %s, xrefs: 00F5265F
Error opening archive %s, xrefs: 00F52819
Error extracting %s, xrefs: 00F528D7

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ___from_strstr_to_strchr
String ID: %s%s%s$%s%s%s%s%s$%s%s%s%s%s%s%s$%s%s%s.exe$%s%s%s.pkg$Archive not found: %s$Archive path exceeds PATH_MAX$Error copying %s$Error extracting %s$Error opening archive %s$malloc
API String ID: 601868998-2292630174
Opcode ID: 95fdfbe431a48bd0e541fa71c2891248da0206687d180c950dbde6f5693ccf93
Instruction ID: 1037d075f602eea2b7624eb9bc4f1bdeb171a943359c180db230c02fa46f2082
Opcode Fuzzy Hash: 95fdfbe431a48bd0e541fa71c2891248da0206687d180c950dbde6f5693ccf93
Instruction Fuzzy Hash: EDA12CB29043407AD731D6609C82FBB739CAF56312F444A16FE89C6182E735E60DB6A3

Function 00F51420 Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 170COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00F514A5
Failed to extract %s: failed to open target file!, xrefs: 00F51466
fopen, xrefs: 00F5146B
fseek, xrefs: 00F514DC
fwrite, xrefs: 00F515B3
Failed to extract %s: failed to write data chunk!, xrefs: 00F515AE
fread, xrefs: 00F515C3
Failed to extract %s: failed to read data chunk!, xrefs: 00F515BE
malloc, xrefs: 00F51528
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00F51523
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00F514D7

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 0-666925554
Opcode ID: 84c7c56ec003c0006220f5202060ebf03f1dac103cd222ddd43c5e16c525bf37
Instruction ID: 96207dbf7a00217aa2da507d7a371771fc96c37ba47a9ff36addc99ef167012b
Opcode Fuzzy Hash: 84c7c56ec003c0006220f5202060ebf03f1dac103cd222ddd43c5e16c525bf37
Instruction Fuzzy Hash: AB4149B2E0030177EB20AE646C46B6B3655BBC0766F084625FF19562C2F775EB0CB293

Function 00F56830 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,00000000,?), ref: 00F5686E
OpenProcessToken.ADVAPI32(00000000), ref: 00F56875
GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 00F5688C
GetLastError.KERNEL32 ref: 00F56896
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,?,?,?,?,?,00F5142E,?,00000000,00F52AFF,?,?,?,?), ref: 00F568C5
ConvertSidToStringSidW.ADVAPI32(00000000,?), ref: 00F568D6
CloseHandle.KERNEL32(00000000,?,?,00F5142E,?,00000000,00F52AFF,?,?,?,?,00000000), ref: 00F568EE
LocalFree.KERNEL32(?,?,?,?,?,?,?,00F5142E,?,00000000,00F52AFF,?,?,?,?,00000000), ref: 00F5691B
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,?,?,00000001), ref: 00F5693F
CreateDirectoryW.KERNEL32(?,?,?), ref: 00F5694E

Strings

S-1-3-4, xrefs: 00F568F8, 00F56902
D:(A;;FA;;;%s), xrefs: 00F56903

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: 3d558238f5bbcad218a05df146b9678661422c7d866df12e05eba4deaa4dbde3
Instruction ID: 366b5da641f052b7a0655d211586edbde62c037c87c26d97b55c3eede81fffbe
Opcode Fuzzy Hash: 3d558238f5bbcad218a05df146b9678661422c7d866df12e05eba4deaa4dbde3
Instruction Fuzzy Hash: AF31A271504315ABE720DF20DC49B9BBBE8EF48361F840919FA68D2191D774DA4CEBA3

Function 00F6A979 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00F6A9BD

Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A573
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A585
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A597
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A5A9
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A5BB
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A5CD
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A5DF
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A5F1
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A603
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A615
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A627
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A639
Part of subcall function 00F6A556: _free.LIBCMT ref: 00F6A64B

_free.LIBCMT ref: 00F6A9B2

Part of subcall function 00F63B77: RtlFreeHeap.NTDLL(00000000,00000000,?,00F62C8E), ref: 00F63B8D
Part of subcall function 00F63B77: GetLastError.KERNEL32(?,?,00F62C8E), ref: 00F63B9F

_free.LIBCMT ref: 00F6A9D4
_free.LIBCMT ref: 00F6A9E9
_free.LIBCMT ref: 00F6A9F4
_free.LIBCMT ref: 00F6AA16
_free.LIBCMT ref: 00F6AA29
_free.LIBCMT ref: 00F6AA37
_free.LIBCMT ref: 00F6AA42
_free.LIBCMT ref: 00F6AA7A
_free.LIBCMT ref: 00F6AA81
_free.LIBCMT ref: 00F6AA9E
_free.LIBCMT ref: 00F6AAB6

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 9e2d21f223b1bf30d39df4c90266986528b70c7ce6b36e366706a4ddff4833e0
Instruction ID: e88cd75c6dfd204880a4730d51d68dcdc0daebf378c8f37d7e13b59bb38a45cb
Opcode Fuzzy Hash: 9e2d21f223b1bf30d39df4c90266986528b70c7ce6b36e366706a4ddff4833e0
Instruction Fuzzy Hash: E6313D31A00701DFEB21AA79DD46B6673F9EF40360F25442AE099E7162DF79BD80EB11

Function 00F6613C Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F66152

Part of subcall function 00F63B77: RtlFreeHeap.NTDLL(00000000,00000000,?,00F62C8E), ref: 00F63B8D
Part of subcall function 00F63B77: GetLastError.KERNEL32(?,?,00F62C8E), ref: 00F63B9F

_free.LIBCMT ref: 00F6615E
_free.LIBCMT ref: 00F66169
_free.LIBCMT ref: 00F66174
_free.LIBCMT ref: 00F6617F
_free.LIBCMT ref: 00F6618A
_free.LIBCMT ref: 00F66195
_free.LIBCMT ref: 00F661A0
_free.LIBCMT ref: 00F661AB
_free.LIBCMT ref: 00F661B9

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 37834a7e49c7c2683572fd89d82a79cfd57187240c9370364524ab39d5d94135
Instruction ID: 5e8c8626dd12c0caeb55a6d46a736fc720485e1b6ae1456b399be6d4d573e1fb
Opcode Fuzzy Hash: 37834a7e49c7c2683572fd89d82a79cfd57187240c9370364524ab39d5d94135
Instruction Fuzzy Hash: EB219676900108AFCB41EFA4CC82DEE7BB9EF48344F0041A6B6159B572DB75EB44DB80

Function 00F55A90 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00001000,?,?,?,?,?,00F55A66,?,00000000,?,pyi-runtime-tmpdir), ref: 00F55B1D
GetCurrentProcessId.KERNEL32 ref: 00F55B23

Part of subcall function 00F55C60: GetEnvironmentVariableW.KERNEL32(00000000,?,00002000,?,00F52FD8,_MEIPASS2), ref: 00F55C96
Part of subcall function 00F55C60: ExpandEnvironmentStringsW.KERNEL32(?,?,00002000,?,00002000,?,00F52FD8,_MEIPASS2), ref: 00F55CB2

Part of subcall function 00F5E365: _free.LIBCMT ref: 00F5E378

SetEnvironmentVariableW.KERNEL32(00000000,00000000,00000000,TMP,00000000,?,?,?,?,?,00F5142E,?,00000000,00F52AFF,?,?), ref: 00F55BBC

Strings

TMP, xrefs: 00F55AE2
_MEI%d, xrefs: 00F55B29
LOADER: Failed to set the TMP environment variable., xrefs: 00F55AFB
TMP, xrefs: 00F55AC2, 00F55B73, 00F55BED

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: Environment$Variable$CurrentExpandPathProcessStringsTemp_free
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 2771213846-1116378104
Opcode ID: b7bf23547188db4e522a5bf995c5c5adca4588be2d199e066606ee6521600048
Instruction ID: d16658bbfa68dbafc81acae506a429a1a9cdd191604794c0d045671d2a34e217
Opcode Fuzzy Hash: b7bf23547188db4e522a5bf995c5c5adca4588be2d199e066606ee6521600048
Instruction Fuzzy Hash: 1C41D372A00B04B7E16076B05C4BF6F35989F85F53F440835FF45A7182FAA8AA0C72A7

Function 00F55780 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 127COMMON

Download Yara Rule

APIs

Part of subcall function 00F56990: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,00F5246C,?,?,00000400,?,00000000,00000800), ref: 00F569A8

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000,?,00F5142E,?,00000000,00F52AFF,?,?,?,?,00000000), ref: 00F557E4

Strings

LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00F557F9
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00F55855
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00F557B3

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 2001182103-3498232454
Opcode ID: ab8cc7d22a54aa51b593dd03db8bfd601427cc10b7b3ff904aa7c5bba2a46241
Instruction ID: 0775316f8e7b2361801366cbb119a9c9085e343a939174f261a955557ce3968e
Opcode Fuzzy Hash: ab8cc7d22a54aa51b593dd03db8bfd601427cc10b7b3ff904aa7c5bba2a46241
Instruction Fuzzy Hash: D2311CB2A406006BE6247374AC47FAB72989F84B12F440535FF09D7282F978E50C92D7

Function 00F51E30 Relevance: 13.6, APIs: 9, Instructions: 139COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00F51E50
SelectObject.GDI32(00000000,?), ref: 00F51EA0
DrawTextW.USER32(00000000,?,000000FF,?,00002550), ref: 00F51EB5
SelectObject.GDI32(00000000,00000000), ref: 00F51EC6
ReleaseDC.USER32(?,00000000), ref: 00F51ECF
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?,?,?,?,?,00000032,00000004), ref: 00F51F1C
MoveWindow.USER32(?,?,?,?,00000014,00000001,?,?,?,?,?,?,?,00000032,00000004), ref: 00F51F4B
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?,00000014,00000001), ref: 00F51F95
MoveWindow.USER32(?,?,00000000,?,?,00000001,?,?,?,00000014,00000001), ref: 00F51FCA

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID:
API String ID: 2147705588-0
Opcode ID: a541af4a0bd3edb6ee3ccae4f94c33fe04acaef8439d3bec591122df70117b51
Instruction ID: e3f4b86dfca041221862fb3933a24816087f14b65d557c3100a17000a34a8018
Opcode Fuzzy Hash: a541af4a0bd3edb6ee3ccae4f94c33fe04acaef8439d3bec591122df70117b51
Instruction Fuzzy Hash: 69418C71604310AFD724DF2DCC889BBB7E9FB88701F41052EF98AC2291E675AD44E761

Function 00F566B0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 105COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00F56709
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00F5673E

Strings

Out of memory., xrefs: 00F56767
Failed to get UTF-8 buffer size., xrefs: 00F56773
Failed to encode wchar_t as UTF-8., xrefs: 00F56760
WideCharToMultiByte, xrefs: 00F56778
win32_utils_to_utf8, xrefs: 00F5676C

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: d15ff7dec77ee99a8b1c9b23cea78c0903954ee68d1e6b356f0b7d8cfa2df274
Instruction ID: 3b749cbd0952adfff472b126a4938a46b6872cbf4caadd73a4212a003a757894
Opcode Fuzzy Hash: d15ff7dec77ee99a8b1c9b23cea78c0903954ee68d1e6b356f0b7d8cfa2df274
Instruction Fuzzy Hash: DF313C71644305ABDB106E64BC82F1677D4EB44B26F500536FF54EB2C0EAA5E90CA263

Function 00F560F0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 100processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00F56990: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,00F5246C,?,?,00000400,?,00000000,00000800), ref: 00F569A8

Part of subcall function 00F60F12: SetConsoleCtrlHandler.KERNEL32(00F60B95,00000001,00F7EE98,00000018,00000003,00F7EEB8), ref: 00F6102A

Part of subcall function 00F60F12: GetLastError.KERNEL32 ref: 00F61044

GetStartupInfoW.KERNEL32(?), ref: 00F5616B
GetCommandLineW.KERNEL32(?,00000000,00000001,00000000,00000000,00000000,?,?), ref: 00F561FC
CreateProcessW.KERNEL32(?,00000000), ref: 00F5620B
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00F5621B
GetExitCodeProcess.KERNEL32(?,00000000), ref: 00F56229

Strings

Error creating child process!, xrefs: 00F56247
CreateProcessW, xrefs: 00F5624C

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: Process$ByteCharCodeCommandConsoleCreateCtrlErrorExitHandlerInfoLastLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 1248179626-3524285272
Opcode ID: 19799a9b8f928aa4837bc36d50b763cdeff8f77d1e4a50297e7cf5be1b7ba8e5
Instruction ID: 07dea62a8891e7f97d8b8b6f8fcdbe468af907573e13a5ce9da34248cc774f38
Opcode Fuzzy Hash: 19799a9b8f928aa4837bc36d50b763cdeff8f77d1e4a50297e7cf5be1b7ba8e5
Instruction Fuzzy Hash: DB319370A08344ABEB10EFA0CC4AB4B77E8AF44705F504919B694961C2DBFDD558EB53

Function 00F56A30 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 65COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,00000000,00F5663C,00F8DC48,?,00001000,?,?), ref: 00F56A4A

Part of subcall function 00F52290: GetLastError.KERNEL32(?,00000000), ref: 00F522AD

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,00000000,00000000,?,00000000,00F5663C,00F8DC48,?,00001000,?,?), ref: 00F56AAF

Strings

Out of memory., xrefs: 00F56A81
Failed to get UTF-8 buffer size., xrefs: 00F56A56
Failed to encode wchar_t as UTF-8., xrefs: 00F56AB9
WideCharToMultiByte, xrefs: 00F56A5B, 00F56ABE
win32_utils_to_utf8, xrefs: 00F56A86

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 1717984340-27947307
Opcode ID: 6f52a251bf29f1bf449b33a4b3293576c740d20072ae93535e9e485171440620
Instruction ID: fe01976edd1574eceb9f11c660a5b0c0080faa7e6646e9a9a67f5b95292af34c
Opcode Fuzzy Hash: 6f52a251bf29f1bf449b33a4b3293576c740d20072ae93535e9e485171440620
Instruction Fuzzy Hash: D401E137B45221B6DA6061697C06F8B3A99CB86F72F154222FF1CE62C0E190E90671A3

Function 00F5ADC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00F5ADF7
___except_validate_context_record.LIBVCRUNTIME ref: 00F5ADFF
_ValidateLocalCookies.LIBCMT ref: 00F5AE88
__IsNonwritableInCurrentImage.LIBCMT ref: 00F5AEB3
_ValidateLocalCookies.LIBCMT ref: 00F5AF08

Strings

csm, xrefs: 00F5AE9D

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: bc6629a90984b088dfea3498b4301f573e68f9f55ff78c0580e79afcbc2f16e7
Instruction ID: 25227c0d234729539fdd7d9042b3328721c1a038aee64d02ba9f913a7ff1b066
Opcode Fuzzy Hash: bc6629a90984b088dfea3498b4301f573e68f9f55ff78c0580e79afcbc2f16e7
Instruction Fuzzy Hash: AC41E330E002089BCF00DF69CC85A9EBBB1AF05325F148255EE185B352D735DA29EB92

Function 00F56AE0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 102COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,00000000,?,?), ref: 00F56B35
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 00F56B66

Strings

Failed to get wchar_t buffer size., xrefs: 00F56B9B
Out of memory., xrefs: 00F56B8F
win32_utils_from_utf8, xrefs: 00F56B94
MultiByteToWideChar, xrefs: 00F56BA0
Failed to decode wchar_t from UTF-8, xrefs: 00F56B88

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 626452242-876015163
Opcode ID: 95718de30d3073db1f7eec85e98843929599eb2002b09e47a4c9a36acb02de40
Instruction ID: 991e8fc00a0d3e23406f830713655dbb03e6d62a53b6a6bfcae64e0ee9683035
Opcode Fuzzy Hash: 95718de30d3073db1f7eec85e98843929599eb2002b09e47a4c9a36acb02de40
Instruction Fuzzy Hash: 08313E72A443057BD7106E54AC41F1A7BD4EB84722F84063AFF58E72C0E6B5D90CB653

Function 00F6A6F5 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F6A6BD: _free.LIBCMT ref: 00F6A6E2

_free.LIBCMT ref: 00F6A743

Part of subcall function 00F63B77: RtlFreeHeap.NTDLL(00000000,00000000,?,00F62C8E), ref: 00F63B8D
Part of subcall function 00F63B77: GetLastError.KERNEL32(?,?,00F62C8E), ref: 00F63B9F

_free.LIBCMT ref: 00F6A74E
_free.LIBCMT ref: 00F6A759
_free.LIBCMT ref: 00F6A7AD
_free.LIBCMT ref: 00F6A7B8
_free.LIBCMT ref: 00F6A7C3
_free.LIBCMT ref: 00F6A7CE

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b82a83029192d2ac4a41a466b2bc48d6a5028a36daab7583f2bc1eaf857da398
Instruction ID: 8fc6fa305b51e44683b88a40dd04d519f63c6a23ae65a0e050bc05da06ccaf52
Opcode Fuzzy Hash: b82a83029192d2ac4a41a466b2bc48d6a5028a36daab7583f2bc1eaf857da398
Instruction Fuzzy Hash: D011FE71940B04FAD620BBB0CC47FDB77ECEF46700F444815B29ABA162DB6AB614AB51

Function 00F56990 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 61COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,00F5246C,?,?,00000400,?,00000000,00000800), ref: 00F569A8

Part of subcall function 00F52290: GetLastError.KERNEL32(?,00000000), ref: 00F522AD

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,?,?,00F5246C,?,?,00000400,?,00000000,00000800), ref: 00F56A09

Strings

Failed to get wchar_t buffer size., xrefs: 00F569B4
Out of memory., xrefs: 00F569DF
win32_utils_from_utf8, xrefs: 00F569E4
MultiByteToWideChar, xrefs: 00F569B9, 00F56A18
Failed to decode wchar_t from UTF-8, xrefs: 00F56A13

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 1717984340-876015163
Opcode ID: 2c3675797e2d5a051f0bdd890d8dab492bf35425fdd33ac874b4b0ce718b0c17
Instruction ID: f6b8689687b20ebc945d1b9d33434f2a923bd80851c786a8e18e79a5d1098dfa
Opcode Fuzzy Hash: 2c3675797e2d5a051f0bdd890d8dab492bf35425fdd33ac874b4b0ce718b0c17
Instruction Fuzzy Hash: E7012237B8422237D66065657C06D8B7B948B91F73F054232FF2CE21C0E5A0C94A71E3

Function 00F565B0 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00F522E9,00000000,?,?,?,00000400,?,00000000,?), ref: 00F565D3

Part of subcall function 00F56A30: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,00000000,00F5663C,00F8DC48,?,00001000,?,?), ref: 00F56A4A

FormatMessageW.KERNEL32(00001000,00000000,?,00000400,00000000,00001000,00000000,00F522E9,00000000,?,?,?,00000400,?,00000000,?), ref: 00F565F2

Strings

FormatMessageW, xrefs: 00F56601
No error messages generated., xrefs: 00F565FC
PyInstaller: FormatMessageW failed., xrefs: 00F5660E
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00F5663F

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ByteCharErrorFormatLastMessageMultiWide
String ID: FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.
API String ID: 1653872744-3268588819
Opcode ID: 42593e158f0bc9da27985fb996c9089100ffdbc07e085c1daaa7614a98c21f87
Instruction ID: 1f636125cce33de7bb2841f722e93ae9be730101c59c41b42e1ff931251e752b
Opcode Fuzzy Hash: 42593e158f0bc9da27985fb996c9089100ffdbc07e085c1daaa7614a98c21f87
Instruction Fuzzy Hash: 110188747443446BF61C97149C47BAA32D69F98B46F80841DBB0DCA1C2FAE49908E757

Function 00F64DEE Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000000,?), ref: 00F64E36
__fassign.LIBCMT ref: 00F6501B
__fassign.LIBCMT ref: 00F65038
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F65080
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00F650C0
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F65168

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 1a7edef9a2e473f89dde81f5d3efe6b78d59d84f00e00641ad273451c57e4397
Instruction ID: ec4ae302011906a40fe076b6a8c749e50aa35ce109be9874808602e1185343b7
Opcode Fuzzy Hash: 1a7edef9a2e473f89dde81f5d3efe6b78d59d84f00e00641ad273451c57e4397
Instruction Fuzzy Hash: 3BC19C75D002589FCF15CFE8C880AEDBBB5AF09314F28416AE855FB242D631AE46DF60

Function 00F5B231 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00F5B228,00F5B05F,00F5A0C5), ref: 00F5B23F
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00F5B24D
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F5B266
SetLastError.KERNEL32(00000000,00F5B228,00F5B05F,00F5A0C5), ref: 00F5B2B8

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 76c167b015c32b378901a69e23af06eab384b079ac478070c3951f2d8805d3ec
Instruction ID: 03de621223e499726134e827d4034e8e59c40bb8064c5b55b12ee0099b1d9d96
Opcode Fuzzy Hash: 76c167b015c32b378901a69e23af06eab384b079ac478070c3951f2d8805d3ec
Instruction Fuzzy Hash: E101B5329192156DE6162AB4BC95A6E3B54EB117B7F300229FF24451E1EF55480DB360

Function 00F51FE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,?,00000000,00000000,00F5218F,00000000,00000000,Failed to obtain/convert traceback!,?,?,?,00000000,00F52EDE,?,?), ref: 00F52013
DialogBoxIndirectParamW.USER32(00000000,?,00000000,00F51D70,?), ref: 00F520CB

Part of subcall function 00F5E365: _free.LIBCMT ref: 00F5E378

DeleteObject.GDI32(?), ref: 00F520FD
DestroyIcon.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000102), ref: 00F5210F

Strings

Unhandled exception in script, xrefs: 00F5203C

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam_free
String ID: Unhandled exception in script
API String ID: 4039461714-2699770090
Opcode ID: f50e41b2b33c4307503ff65714778dd97e952a53c79c8be51e6afa712859c6fd
Instruction ID: 8a8f955bf7b9ae801b611a4617f04d003c3cf147d6d57f131e030d0f9d71f4fe
Opcode Fuzzy Hash: f50e41b2b33c4307503ff65714778dd97e952a53c79c8be51e6afa712859c6fd
Instruction Fuzzy Hash: 81311C71508344ABD724AF64CC4DB9FB7E8BF89705F00092ABB8893252D7789509EB53

Function 00F5B3A3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,00F5B464,00000000,00000FA0,00F8EFD4,00000000,?,00F5B58F,00000004,InitializeCriticalSectionEx,00F78F9C,InitializeCriticalSectionEx,00000000), ref: 00F5B433

Strings

api-ms-, xrefs: 00F5B3F3

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 5ce524a4036252aee3644ccc48d6ac4964de901009f9fce16c89eba327acfaab
Instruction ID: bfb00436f6f58c1fa964ffd32e11ea06ce6c322b2e68ff0c89c4159eed4c28ea
Opcode Fuzzy Hash: 5ce524a4036252aee3644ccc48d6ac4964de901009f9fce16c89eba327acfaab
Instruction Fuzzy Hash: EA11C232E41635ABDB32CF689C49B6D73A4AF01775F250120EE19E7281D770EE05B6D2

Function 00F627E7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00F627DC,?,?,00F627A4,?,?,?), ref: 00F627FC
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00F6280F
FreeLibrary.KERNEL32(00000000,?,?,00F627DC,?,?,00F627A4,?,?,?), ref: 00F62832

Strings

CorExitProcess, xrefs: 00F62807
mscoree.dll, xrefs: 00F627F5

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 4f4aa37cbaba804fbb56d89cbb37c302ac2ac7de3fe95a4277c523cc798622ee
Instruction ID: e653d90eb1f1f895340e8867e863371b1b11f3a331b6608098028bd9cbe03460
Opcode Fuzzy Hash: 4f4aa37cbaba804fbb56d89cbb37c302ac2ac7de3fe95a4277c523cc798622ee
Instruction Fuzzy Hash: 92F01C3194161CFBDB129BA0DD0AB9D7B79EB44766F144161E809A21A0CBB18F40FAD6

Function 00F6D692 Relevance: 7.8, APIs: 5, Instructions: 330timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F6D74F
_free.LIBCMT ref: 00F6D91B
_free.LIBCMT ref: 00F6D993
GetTimeZoneInformation.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,?,?,?,00F6DB54,?,?,00000000), ref: 00F6D9A5

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: 11cb2e2517ef357f9062740e4738fe95859ca88b223a66d30342b10233e8c4f6
Instruction ID: d825624d30430361a82a9d734e65692aca9072600b93619af88ae2d7305dddf3
Opcode Fuzzy Hash: 11cb2e2517ef357f9062740e4738fe95859ca88b223a66d30342b10233e8c4f6
Instruction Fuzzy Hash: 26A12472F00219AFDB10AFB4DC42ABE7BB8EF44720F144169E904A7191EB349E45FB91

Function 00F5E955 Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00F5E887), ref: 00F5E977
GetFileInformationByHandle.KERNEL32(?,?), ref: 00F5E9D1
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00F5E887,?,000000FF,00000000,00000000), ref: 00F5EA5F
__dosmaperr.LIBCMT ref: 00F5EA66
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 00F5EAA3

Part of subcall function 00F5ED82: __dosmaperr.LIBCMT ref: 00F5EDB7

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: 76df95aa1384317f23b8c27d8ed51c292bc12d5cbdd1203b9e776b3204b55880
Instruction ID: f01c8a9091c9dd72ccf263a5a549be62fff9529a95c31a63c779c003bd53733b
Opcode Fuzzy Hash: 76df95aa1384317f23b8c27d8ed51c292bc12d5cbdd1203b9e776b3204b55880
Instruction Fuzzy Hash: E3416F75900204ABCB28DFB5DC459AFBBF9FF89311B00451DFA56D3211E7389A48EB10

Function 00F51D70 Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000002), ref: 00F51D8E
GetWindowLongW.USER32(?,00000008), ref: 00F51DA4
InvalidateRect.USER32(?,00000000,00000000), ref: 00F51DC3
SetWindowLongW.USER32(?,00000008,?), ref: 00F51DDE
EndDialog.USER32(?,?), ref: 00F51E17

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: DialogLongWindow$InvalidateRect
String ID:
API String ID: 1200242243-0
Opcode ID: 35951174aebc355fe0551280336abf48a79be2e1335c63e11f7031759b64025a
Instruction ID: 72ef2eb52f5dba8eb74be57d405bb46dd8eddc84c8882c28aa4925ad534eed54
Opcode Fuzzy Hash: 35951174aebc355fe0551280336abf48a79be2e1335c63e11f7031759b64025a
Instruction Fuzzy Hash: 5011E0359042147BE6209B14EC0AFAF77A4FB45322F108C15FE85D62D1C6A5FCC5E6A2

Function 00F6A654 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F6A66C

Part of subcall function 00F63B77: RtlFreeHeap.NTDLL(00000000,00000000,?,00F62C8E), ref: 00F63B8D
Part of subcall function 00F63B77: GetLastError.KERNEL32(?,?,00F62C8E), ref: 00F63B9F

_free.LIBCMT ref: 00F6A67E
_free.LIBCMT ref: 00F6A690
_free.LIBCMT ref: 00F6A6A2
_free.LIBCMT ref: 00F6A6B4

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b70929b96e95927e7c76b1533aa10232e646dffb323cb7073ccf7f308a75ed94
Instruction ID: 8ce288f14cc29528a7c818f92535e100ec2e2837f3179d362b4bb0b382ad8418
Opcode Fuzzy Hash: b70929b96e95927e7c76b1533aa10232e646dffb323cb7073ccf7f308a75ed94
Instruction Fuzzy Hash: B4F03032904244AB8660EB68EC86C7A73EDEE407207A94805F018E7521CB75FCC0AFA5

Function 00F54BB0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00F53630: _strncat.LIBCMT ref: 00F5368D

_strncpy.LIBCMT ref: 00F54D1D

Part of subcall function 00F53630: _strncat.LIBCMT ref: 00F536B2

_strncpy.LIBCMT ref: 00F54D46

Part of subcall function 00F533E0: _strrchr.LIBCMT ref: 00F533E8
Part of subcall function 00F533E0: _strrchr.LIBCMT ref: 00F533F7

Strings

SPLASH: Cannot extract requirement %s., xrefs: 00F54CD8
SPLASH: Cannot find requirement %s in archive., xrefs: 00F54D8B

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _strncat_strncpy_strrchr
String ID: SPLASH: Cannot extract requirement %s.$SPLASH: Cannot find requirement %s in archive.
API String ID: 4078740465-4094522769
Opcode ID: ae307b57f568946c5deeed348958dd275230ed6068620d6ec8b3b3f4e56f78a0
Instruction ID: 2511db4ecb3df59b33a62026420ee0334ea4d0a9160cdb3665004b1fa753839f
Opcode Fuzzy Hash: ae307b57f568946c5deeed348958dd275230ed6068620d6ec8b3b3f4e56f78a0
Instruction Fuzzy Hash: 0851C472404340ABDB21DF54CC85ADF77ECAF85359F000519FE8997202D775A64DEBA2

Function 00F54F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 00F54FE2
_strncpy.LIBCMT ref: 00F54FF4
_strncpy.LIBCMT ref: 00F55006

Strings

Cannot allocate memory for necessary files., xrefs: 00F550E1

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _strncpy
String ID: Cannot allocate memory for necessary files.
API String ID: 2961919466-2795144771
Opcode ID: 335ec637f1ff5c98f8143b5c59d524eb9362e5c9af056ce788065d784e96144c
Instruction ID: 3936028c1cdd2d8b150a77e956c7a3298e567c6c718c49ac081f34ed32a26dd4
Opcode Fuzzy Hash: 335ec637f1ff5c98f8143b5c59d524eb9362e5c9af056ce788065d784e96144c
Instruction Fuzzy Hash: 6241D4B2500205ABDB10DE68DC84EA63398BF44316F080975FF0CCB582D775E598A7B1

Function 00F61D83 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\ceFgl3jkkk.exe, xrefs: 00F61DC1, 00F61DC8, 00F61DFC

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\ceFgl3jkkk.exe
API String ID: 0-2340494698
Opcode ID: 1ee21537f8899424de46d14492487d68d136b9319ad74834ea4bb9b305180722
Instruction ID: 769c05011eb38cc9b8a535f25af5ba234d1ecafb8155463702d38078dff943d7
Opcode Fuzzy Hash: 1ee21537f8899424de46d14492487d68d136b9319ad74834ea4bb9b305180722
Instruction Fuzzy Hash: 46319171E00218EFCB21DF99CC819EEBBB8FF99310B144166E804E7211D7B59E44EBA0

Function 00F612F7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F613AF

Strings

TMP, xrefs: 00F61305

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _free
String ID: TMP
API String ID: 269201875-3125297090
Opcode ID: 2b6dec763d7ffd3746eac685c2f9a38739514d2a48c56df694a6c88b8f74af37
Instruction ID: fa3d2acf416d4f7a16f8131d253360dda85099e39a6b30d901fd219c02cec381
Opcode Fuzzy Hash: 2b6dec763d7ffd3746eac685c2f9a38739514d2a48c56df694a6c88b8f74af37
Instruction Fuzzy Hash: FD21937790420A6E5725AA1A9C83D7F73EDEAC277432D802AFC0A9B741EF74DD017261

Function 00F534A0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00001000,?,00F52F89,?,?), ref: 00F534CC

Part of subcall function 00F52290: GetLastError.KERNEL32(?,00000000), ref: 00F522AD

Strings

Failed to get executable path., xrefs: 00F534D6
Failed to convert executable path to UTF-8., xrefs: 00F53517
GetModuleFileNameW, xrefs: 00F534DB

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2776309574-1977442011
Opcode ID: 7203b36ba09c081e13841837aa3e3abb5763877b420da7cbadbee37e8c27ccf3
Instruction ID: 4b6baa833ee212b6c71ae0a493299a779dbd1518df30678c6390aaa1cfa8743d
Opcode Fuzzy Hash: 7203b36ba09c081e13841837aa3e3abb5763877b420da7cbadbee37e8c27ccf3
Instruction Fuzzy Hash: 6901DD757143006BF618A7249C8B7EB33C9AF54701F804455BF4DC2182F5AC9A0CE697

Function 00F66605 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00F6668F

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 3e2da1a130bff8e067e98c8726f26c942e917486e4e2f1078dcd2f7c3124a5e2
Instruction ID: 623d3f7e87e38a1deec7359d066e732d88ff50c55bf4223ad5eb84214dfbaf4b
Opcode Fuzzy Hash: 3e2da1a130bff8e067e98c8726f26c942e917486e4e2f1078dcd2f7c3124a5e2
Instruction Fuzzy Hash: 90B13772D002859FDB11CF38C851BEEBBF5EF55354F2481AAE845EB242D6399D01EBA0

Function 00F7007E Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F7014E
_free.LIBCMT ref: 00F70177
SetEndOfFile.KERNEL32(00000000,00F6E4B2,00000000,00F68438,?,?,?,?,?,?,?,00F6E4B2,00F68438,00000000), ref: 00F701A9
GetLastError.KERNEL32(?,?,?,?,?,?,?,00F6E4B2,00F68438,00000000,?,?,?,?,00000000), ref: 00F701C5

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 7139cca7aff077eef02f7aed4396b56b03c4382cfc5e347f77a0116eaec51539
Instruction ID: 13ddb5071b192cfb74f8b1ca9e122d77cae321ad4dff42bc04ff47a7b393d20d
Opcode Fuzzy Hash: 7139cca7aff077eef02f7aed4396b56b03c4382cfc5e347f77a0116eaec51539
Instruction Fuzzy Hash: 8E412832900204EBDB15ABB8DC42B9E37B5EF443B0F644552F91CE72A1DEB8D954B722

Function 00F66254 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00F5C84E,?,?,?,?,00F5C00A,?,?,?), ref: 00F66259
_free.LIBCMT ref: 00F662B6
_free.LIBCMT ref: 00F662EC
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,00F5C00A,?,?,?), ref: 00F662F7

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: a55ae2014cfa04874ce23825ba001e4a069db79a32f60693468b2ee8f0c8e56c
Instruction ID: 136cb0932026ed6828fda241b995760918b02c09c823bb6373c1d24061a6b29d
Opcode Fuzzy Hash: a55ae2014cfa04874ce23825ba001e4a069db79a32f60693468b2ee8f0c8e56c
Instruction Fuzzy Hash: F11182326046443ADF5137B89CD7E7B3A59DBC1778B340224F924C72E2DEB58D097220

Function 00F663AB Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00F5E61E,00F63B9D,?,?,00F62C8E), ref: 00F663B0
_free.LIBCMT ref: 00F6640D
_free.LIBCMT ref: 00F66443
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00F5E61E,00F63B9D,?,?,00F62C8E), ref: 00F6644E

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 51225b37bfae98ba5e6780cf1bd25e6a3a60b35b50ec3c0c9486a74a420bf827
Instruction ID: ad61a686e0009904b778177c8fe733baf8bba1387840896059b781d75bd600b9
Opcode Fuzzy Hash: 51225b37bfae98ba5e6780cf1bd25e6a3a60b35b50ec3c0c9486a74a420bf827
Instruction Fuzzy Hash: F711A5326046147AD7117AB5AC87E7B3659DBC1774B240334F528D33E1DEB58C457311

Function 00F5F1CC Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,00F5F2C8,00000000,?,00F67FB9,00000000,00000000,00F5F2C8,?,?,00000000,00000000,00000001), ref: 00F5F1E2
GetLastError.KERNEL32(?,00F67FB9,00000000,00000000,00F5F2C8,?,?,00000000,00000000,00000001,00000000,00000000,?,00F5F2C8,00000000,00000104), ref: 00F5F1EC
__dosmaperr.LIBCMT ref: 00F5F1F3

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: b2929e8e3de4c27899dfb58b33ef189809aac49330ff89cc93e7d278efb7e2b0
Instruction ID: ac1cbd61f767423f856330e0a65cf455ee27284160f5922c561c3f7546230a5b
Opcode Fuzzy Hash: b2929e8e3de4c27899dfb58b33ef189809aac49330ff89cc93e7d278efb7e2b0
Instruction Fuzzy Hash: E9F06D36A00115BBCB202FA2DC08D5AFF69EF457B270445A1FA19C6420D731E969FBD0

Function 00F5F163 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,00F5F2C8,00000000,?,00F6802E,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 00F5F179
GetLastError.KERNEL32(?,00F6802E,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,00F5F2C8,00000000,00000104,?), ref: 00F5F183
__dosmaperr.LIBCMT ref: 00F5F18A

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: d9a54613b5a475e994f8ec2bc3b85c782482a97b510cc08c41ed2cf40d44f248
Instruction ID: 86f8cb9fd64ca095aeac8cc7ba234300bac01f384a57444d162aadc13a297d2a
Opcode Fuzzy Hash: d9a54613b5a475e994f8ec2bc3b85c782482a97b510cc08c41ed2cf40d44f248
Instruction Fuzzy Hash: 88F06932A00915FBCB202BA2DC08D5ABF6AEF443A27154562FA1DC6420D731E968FBD0

Function 00F6F667 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,00F6B50E,00000000,00000001,00000000,00000000,?,00F651C5,?,?,00000000), ref: 00F6F67E
GetLastError.KERNEL32(?,00F6B50E,00000000,00000001,00000000,00000000,?,00F651C5,?,?,00000000,?,00000000,?,00F65711,?), ref: 00F6F68A

Part of subcall function 00F6F650: CloseHandle.KERNEL32(FFFFFFFE,00F6F69A,?,00F6B50E,00000000,00000001,00000000,00000000,?,00F651C5,?,?,00000000,?,00000000), ref: 00F6F660

___initconout.LIBCMT ref: 00F6F69A

Part of subcall function 00F6F612: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00F6F641,00F6B4FB,00000000,?,00F651C5,?,?,00000000,?), ref: 00F6F625

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,00F6B50E,00000000,00000001,00000000,00000000,?,00F651C5,?,?,00000000,?), ref: 00F6F6AF

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: de70cf53483ed63e81c22757a3f055b67df80735369e5c45ac841450481bd5ff
Instruction ID: 44d623b026365f8bbcac9ade9d576851d5f63ffecef2259d229fc677b74173b4
Opcode Fuzzy Hash: de70cf53483ed63e81c22757a3f055b67df80735369e5c45ac841450481bd5ff
Instruction Fuzzy Hash: EAF03937400128BBCF222F95ED099DA7F66FF197A0B404020FA0C96170CB338964BB91

Function 00F62DCC Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F62DD5

Part of subcall function 00F63B77: RtlFreeHeap.NTDLL(00000000,00000000,?,00F62C8E), ref: 00F63B8D
Part of subcall function 00F63B77: GetLastError.KERNEL32(?,?,00F62C8E), ref: 00F63B9F

_free.LIBCMT ref: 00F62DE8
_free.LIBCMT ref: 00F62DF9
_free.LIBCMT ref: 00F62E0A

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 00ab3fef0f48faab1170fbd163fd7754a07a314bb970dfdf4ea34aaeb44ff74e
Instruction ID: cbf15a8db23bfed0f43eb8ecd8a3a98e53ff0e54d82640f23c8a9c4b1b90513c
Opcode Fuzzy Hash: 00ab3fef0f48faab1170fbd163fd7754a07a314bb970dfdf4ea34aaeb44ff74e
Instruction Fuzzy Hash: 57E0BF714001689E8711AF25FC028F63B75E7887207514027F414A2232C7B5165DFFD1

Function 00F54310 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

_mbstowcs.LIBCMT ref: 00F543D2

Strings

pyi-, xrefs: 00F5438B
Failed to convert Wflag %s using mbstowcs (invalid multibyte string), xrefs: 00F544DA

Memory Dump Source

Source File: 00000002.00000002.1547556693.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000002.00000002.1547519181.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547603566.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F83000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547633141.0000000000F8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1547723933.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f50000_ceFgl3jkkk.jbxd

Similarity

API ID: _mbstowcs
String ID: Failed to convert Wflag %s using mbstowcs (invalid multibyte string)$pyi-
API String ID: 686213805-3625900369
Opcode ID: 1eec3864be578206728606b48d12121a23e467f040a6e6459063817da859d417
Instruction ID: fa3554216c446def08ab37fcb0b8a6d9cd0deafa84d4ecbccc4e2728118b1d6d
Opcode Fuzzy Hash: 1eec3864be578206728606b48d12121a23e467f040a6e6459063817da859d417
Instruction Fuzzy Hash: 6341E8B69403006BD754EF64EC47F6637A8AB0031AF440950FF0497293EABDB55CB7A2

Analysis Process: ngentask.exePID: 2976, Parent PID: 7008COMMON

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	35.4%
Total number of Nodes:	96
Total number of Limit Nodes:	5

Executed Functions

Function 00439E03 Relevance: 35.6, APIs: 10, Strings: 10, Instructions: 575
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(8FDF8923), ref: 00439E62
SysAllocString.OLEAUT32(8FDF8923), ref: 00439F18

Strings

9k?m, xrefs: 00439EC4
bS3U, xrefs: 00439EB4
i?y1, xrefs: 00439E6C
q7bI, xrefs: 00439E7C
1[!], xrefs: 00439EA4
lo, xrefs: 00439ECC
l3u5, xrefs: 00439E74
i?y1, xrefs: 00439E5D
hKpM, xrefs: 00439E84
"_kQ, xrefs: 00439EAC

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: AllocString
String ID: "_kQ$1[!]$9k?m$bS3U$hKpM$i?y1$i?y1$l3u5$lo$q7bI
API String ID: 2525500382-2291679449
Opcode ID: 3f84ddf9d68db4cfd429c7386c9fa6934f0b9a5841c78f71d6627337152d25ec
Instruction ID: 0f33f5176dd057a132bed2c5aac49cb092b48a7f49199e5d7c126567dc2015bb
Opcode Fuzzy Hash: 3f84ddf9d68db4cfd429c7386c9fa6934f0b9a5841c78f71d6627337152d25ec
Instruction Fuzzy Hash: B302ED79A08300DFD3049F24E885B6BB7E5FFCA315F14882DF4858B291D779A81ACB56

Function 00411210 Relevance: 21.4, APIs: 4, Strings: 8, Instructions: 374
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 00411221
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411243
CoUninitialize.COMBASE ref: 0041250A

Strings

2 />, xrefs: 004112E8
dc, xrefs: 004115E0
6910431D5D6F41B70608286674507D91, xrefs: 00411253
marshal-zhukov.com, xrefs: 00411664
'676, xrefs: 004112F3
2,/&, xrefs: 004112DD
uy, xrefs: 004114BA
N967, xrefs: 00411549

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: Initialize$SecurityUninitialize
String ID: '676$2 />$2,/&$6910431D5D6F41B70608286674507D91$N967$dc$marshal-zhukov.com$uy
API String ID: 3757020523-386217003
Opcode ID: 7b7ab738a5cf8cdd31bd884001b1d08f61c0211879b15022554c4b45fb3b2319
Instruction ID: a48284d29e9631185903a87ed17f6b227f394860366b5a2ac340633ba54a95c6
Opcode Fuzzy Hash: 7b7ab738a5cf8cdd31bd884001b1d08f61c0211879b15022554c4b45fb3b2319
Instruction Fuzzy Hash: 29C1E0B564C3919BD370CF259881BDBBBE1EB96310F18892DD4D88B392D7394806CB96

Function 0040F882 Relevance: 17.8, Strings: 14, Instructions: 259
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A?=, xrefs: 0040F9F2
5C1A, xrefs: 0040FA10
dS`Q, xrefs: 0040FA38
`_l], xrefs: 0040FA42
]kQi, xrefs: 0040FA74
W/[-, xrefs: 0040F9CA
G+), xrefs: 0040F9D4
Y3G1, xrefs: 0040F9E8
PG8E, xrefs: 0040FA06
sKuI, xrefs: 0040FA24
UwOu, xrefs: 0040FA7E
FsOq, xrefs: 0040FA88
a7]5, xrefs: 0040F9DE
l[zY, xrefs: 0040FA4C

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: 5C1A$A?=$FsOq$G+)$PG8E$UwOu$W/[-$Y3G1$]kQi$`_l]$a7]5$dS`Q$l[zY$sKuI
API String ID: 0-3170360268
Opcode ID: 01935e236d4e2d5ca6a53654527dfc5a5fb418dcb0cdf122a0998de2afce7c2b
Instruction ID: 0c74cb9e6d9683c85258a1eaff13ec23cf88813475e3750d48fb34ca779fcadf
Opcode Fuzzy Hash: 01935e236d4e2d5ca6a53654527dfc5a5fb418dcb0cdf122a0998de2afce7c2b
Instruction Fuzzy Hash: 23B154B5100B40CFE324CF25C89279BBBE2FB55314F148A2CE5AB8B690DB74A446CF45

Function 0040D330 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 185
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteW.SHELL32(00000000,19AA1BAD,004473DA,?,00000000,00000005), ref: 0040D559
GetCurrentThreadId.KERNEL32 ref: 0040D568
GetInputState.USER32 ref: 0040D56E
GetCurrentProcessId.KERNEL32(?,00000000,00000005), ref: 0040D578
ExitProcess.KERNEL32 ref: 0040D598

Strings

/KjM, xrefs: 0040D48C
@C, xrefs: 0040D49C
}O+A, xrefs: 0040D494
dc, xrefs: 0040D505

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: CurrentProcess$ExecuteExitInputShellStateThread
String ID: /KjM$@C$dc$}O+A
API String ID: 288744916-4249039376
Opcode ID: 325933621e40d8b8d9436bdf2174ccf44da36203a8cf2298e4bcc684bfa02207
Instruction ID: b0541360ae2b64190384122f8a4b8c1e9bcb0c968cf5f3129e2bd2afac22441e
Opcode Fuzzy Hash: 325933621e40d8b8d9436bdf2174ccf44da36203a8cf2298e4bcc684bfa02207
Instruction Fuzzy Hash: 6E516571A5C3005BD30CDF65CC5576BBAE29BC5708F04D87DA685DB2C1EB7888068B8A

Function 00439BF0 Relevance: 3.1, APIs: 2, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5202720c2f036047dc9b756f8f30debdf675b11aadd7bbad5fdf7d6fa87505eb
Instruction ID: 99db50029e9be6752580d46d303db5ca9f103b376aad5169e6ee161556f02837
Opcode Fuzzy Hash: 5202720c2f036047dc9b756f8f30debdf675b11aadd7bbad5fdf7d6fa87505eb
Instruction Fuzzy Hash: 62316474158740AFF3008F55D948B4BBBE4EB86B05F10892DF694AA290C7B99908CF9B

Function 00440600 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00443BA2,005C003F,00000002,00000018,?), ref: 0044062E

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 0044082D Relevance: 1.4, Strings: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 00440C8D

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 328e5bc532d5bb4fb304c21ed20fbd052a0cae81ad7fa653924ff17c9a6d0f18
Instruction ID: 678d0e188adab1d5500fadea400446abedbc663d0db3939ff0fd71b1963abac5
Opcode Fuzzy Hash: 328e5bc532d5bb4fb304c21ed20fbd052a0cae81ad7fa653924ff17c9a6d0f18
Instruction Fuzzy Hash: F041F0745083428BE708DF14C49126BB7F2FFC6304F14491EE1C18B2A0E779C91ACB9A

Function 0041032C Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

01, xrefs: 0041037C

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: 01
API String ID: 0-3477152822
Opcode ID: 99af49e7e6929860ae38d849f9117ce2c28b81cedbf8253e612d591faa750a2a
Instruction ID: 78b3c5e0676231c38cd4605f4b388ec8c79a0720ff071878e1746d55816391af
Opcode Fuzzy Hash: 99af49e7e6929860ae38d849f9117ce2c28b81cedbf8253e612d591faa750a2a
Instruction Fuzzy Hash: 4B31CB741183419BE714CF25C890ABBB7F0FF86708F04891CF9869B290EB748945CB5A

Function 004410DE Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd532eb7a17253d19b88c1acda108e62323a713565142c17b70a4033e7d8cfdd
Instruction ID: 3fecb3c509470740bee7bdbf72550d9fe83e400ddcc0ba0c7b2fb13a490dde12
Opcode Fuzzy Hash: cd532eb7a17253d19b88c1acda108e62323a713565142c17b70a4033e7d8cfdd
Instruction Fuzzy Hash: 61112C3460864157F3115B24CC45737B7D2EB9B725F64582FE184973A1C37DC885C75A

Function 0043D442 Relevance: 1.6, APIs: 1, Instructions: 61
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 0043D4A7

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: ccc46a3820b10345fc24cd63001c7ab07fbaf0123408abc039a2ae43fef11ea0
Instruction ID: 1c16604aae1155129467535911cc151fb7d307c800175087f761eb098441637a
Opcode Fuzzy Hash: ccc46a3820b10345fc24cd63001c7ab07fbaf0123408abc039a2ae43fef11ea0
Instruction Fuzzy Hash: 3AF0223A3563508BD3048BA8ECA076A7B92DFDA719F28817DD5C48B6A1C7B59811C382

Function 00440570 Relevance: 1.6, APIs: 1, Instructions: 50
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 004405D1

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f02fbea22e2f1fecda0fbe97150a80e4dce3797cd52e50948bf4926b8f36c52f
Instruction ID: 9f33d7cd772fb8c8d349ea5c543c91de8ed9321a1ce8ce1756a76ed8757ee429
Opcode Fuzzy Hash: f02fbea22e2f1fecda0fbe97150a80e4dce3797cd52e50948bf4926b8f36c52f
Instruction Fuzzy Hash: AC0178B0B093018BE3149F35FD5672B37A6EBD9301F08993CE5C042201DB39A86ADA52

Function 00439D4B Relevance: 1.5, APIs: 1, Instructions: 49
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00439DA7

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 466cf1c0b300e9601f0207c7ac9956b4fca475642fe190e5ad588be647a22d04
Instruction ID: ea566c1fd506d3c3c4a31fb516f702cb4fc5e1c4ed8b9d2d4bc3451663e8c17f
Opcode Fuzzy Hash: 466cf1c0b300e9601f0207c7ac9956b4fca475642fe190e5ad588be647a22d04
Instruction Fuzzy Hash: 100128740083419FD250CF2A9918A1FBBF4EBD6724F108E1CF0D99B292D7749506CF86

Function 0043D3C0 Relevance: 1.5, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,080B0A0D,0044445F,?), ref: 0043D41D

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 143eb64a3b55460c315d82f57733e4fa82a727e942247282b2b0d6e3ab2a6114
Instruction ID: 5c90e11579244bbd2ace7ce541f9c3816f34a726410f7e311f42a6b46214092b
Opcode Fuzzy Hash: 143eb64a3b55460c315d82f57733e4fa82a727e942247282b2b0d6e3ab2a6114
Instruction Fuzzy Hash: AAF020B290C2208BD314DA24BC60F2B7B95CFA5310F0581BCE88657392C5340C62CA82

Function 00440719 Relevance: 1.5, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 004407E4

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: be48297a947cafd24aad413243e9e9642570d7df916d39cec16fb6297b1b4795
Instruction ID: d269cd60ec57109cef6505a058307629c74f5e3a7ebf775ef5c6d47ae3ed9ab2
Opcode Fuzzy Hash: be48297a947cafd24aad413243e9e9642570d7df916d39cec16fb6297b1b4795
Instruction Fuzzy Hash: 8601213A9583508FE324DB2AD44126ABA92AB8A305F08483DD982D7341D93889028B9B

Function 00439DDF Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00439DF1

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: aa4dc9aeb2aac6ad379bb582322bd8c04ec0d7ac6b00bb7007832ed099619ace
Instruction ID: 8e0993bda027286ab82495093d853fbb0d0f9e428c0d52a1ce927598f9c0f880
Opcode Fuzzy Hash: aa4dc9aeb2aac6ad379bb582322bd8c04ec0d7ac6b00bb7007832ed099619ace
Instruction Fuzzy Hash: DED04C347D4304BBF1310B14EC17F0535547747F03F201461B7857C0E18AF16611995E

Function 00412501 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CoUninitialize.COMBASE ref: 0041250A

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: Uninitialize
String ID:
API String ID: 3861434553-0
Opcode ID: d8b991163c7b0e0110516da00cc703152a1edba145b5b422256e62435027964e
Instruction ID: 186d8afe7595d41557b92fe9ba1272d5117619c5063a4085c3627a12fa5ea572
Opcode Fuzzy Hash: d8b991163c7b0e0110516da00cc703152a1edba145b5b422256e62435027964e
Instruction Fuzzy Hash: 6BC09BFBE440045AD70027B5BC450CEB354EAC81397000573D61ED5413E635517545D6

Non-executed Functions

Function 0041F860 Relevance: 27.7, Strings: 21, Instructions: 1451COMMON

Download Yara Rule

Strings

, xrefs: 00420254
SRQY, xrefs: 0041FB20
znml, xrefs: 0041FB2B
E|UX, xrefs: 0041FB0A
{L}p, xrefs: 0041FB78
pwvu, xrefs: 0041FC83
nJjo, xrefs: 0041FB41
|, xrefs: 0041F9A2
H, xrefs: 0041FBC5
kecn, xrefs: 0041FAFF
^.s, xrefs: 0041FC2C
CBA@, xrefs: 0041FAF4
t{zy, xrefs: 0041FC8E
xmOT, xrefs: 0041FB15
OrvF, xrefs: 0041FB62
- 1', xrefs: 0041FBAF
rMnM, xrefs: 0041FB4C
`onm, xrefs: 0041FC4B
wFkA, xrefs: 0041FB6D
vDL, xrefs: 0041FF36
,-, xrefs: 00420515

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: ,-$- 1'$CBA@$E|UX$H$OrvF$SRQY$^.s$`onm$kecn$nJjo$pwvu$rMnM$t{zy$vDL$wFkA$xmOT$znml${L}p$|$
API String ID: 0-3082829593
Opcode ID: 46fc4ddae59c42f2bec1145c203149dcdba483be0f597f81eba90ee5b336954d
Instruction ID: 9779ffeb6b8a81ec734d8479c4d0d522fa62d7f05c387235cc8d142b68de0a8d
Opcode Fuzzy Hash: 46fc4ddae59c42f2bec1145c203149dcdba483be0f597f81eba90ee5b336954d
Instruction Fuzzy Hash: ACA202716083918FD724CF25D4907AFBBE2AFD6304F58892EE4C98B392D7789805CB56

Function 00429F40 Relevance: 24.8, APIs: 1, Strings: 13, Instructions: 293COMMON

Download Yara Rule

Strings

.K1M, xrefs: 0042A96B
TW, xrefs: 0042A9A3
#[#], xrefs: 0042A98B
;e'g, xrefs: 0042A735
4S4U, xrefs: 0042A99B
2a/c, xrefs: 0042A73D
b_(Q, xrefs: 0042A993
5O"A, xrefs: 0042A973
\3W5, xrefs: 0042A95B
T1`3, xrefs: 0042A788
E7HI, xrefs: 0042A963
:G Y, xrefs: 0042A983
%C3E, xrefs: 0042A97B

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: #[#]$%C3E$.K1M$2a/c$4S4U$5O"A$:G Y$;e'g$E7HI$T1`3$TW$\3W5$b_(Q
API String ID: 0-2643699812
Opcode ID: 3cb2ab92c587ef23c3e23da19c85b142e6e3f12224995ef8766afe3e3fbf4a2e
Instruction ID: 9c5e7d650131d79a7565773c7b78ebb0e5702fff2b8320420968a0bbec45ba09
Opcode Fuzzy Hash: 3cb2ab92c587ef23c3e23da19c85b142e6e3f12224995ef8766afe3e3fbf4a2e
Instruction Fuzzy Hash: CB91CCB46083908FD3208F26E88176BBBE0FF86719F54492DE5C89B351E7788842CB57

Function 00401000 Relevance: 19.5, Strings: 14, Instructions: 1989COMMON

Download Yara Rule

Strings

gfff, xrefs: 00401D18
gfff, xrefs: 00401D75
-, xrefs: 00401CCD
0123456789abcdefxp, xrefs: 004013FA, 0040146C
gfff, xrefs: 00401DBF
gfff, xrefs: 00401D03
, xrefs: 004037B0
, xrefs: 004037A2
, xrefs: 0040378D
, xrefs: 00403794
, xrefs: 00403826
, xrefs: 0040379B
0123456789ABCDEFXP, xrefs: 004013EC, 0040145F
, xrefs: 004037A9

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $ $-$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff$gfff$gfff
API String ID: 0-3131871939
Opcode ID: b7995fde9e1908a52ea5d26cf2d849ebd4c33492a31da251fcf359cc77123eac
Instruction ID: 21d4b27a028d4d4ddeec7d042d62c3f9fb7f63177426393f51e4234b68456d89
Opcode Fuzzy Hash: b7995fde9e1908a52ea5d26cf2d849ebd4c33492a31da251fcf359cc77123eac
Instruction Fuzzy Hash: C6E2E2716083418FC718CF28C49436BBBE2AF95314F18867EE495AB3D1D778D949CB8A

Function 0042F339 Relevance: 18.1, Strings: 14, Instructions: 583COMMON

Download Yara Rule

Strings

[[PV, xrefs: 0042F3B9
[@Ar, xrefs: 0042F452
tDYq, xrefs: 0042F959
(\QQ, xrefs: 0042F861
FB[\, xrefs: 0042F8F0
(\QQ, xrefs: 0042F3C7
tDYq, xrefs: 0042F4C2
W$XJ, xrefs: 0042F3C0
W$XJ, xrefs: 0042F85A
BC@A, xrefs: 0042F960
FB[\, xrefs: 0042F459
[[PV, xrefs: 0042F853
BC@A, xrefs: 0042F4C9
[@Ar, xrefs: 0042F8E9

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: (\QQ$(\QQ$BC@A$BC@A$FB[\$FB[\$W$XJ$W$XJ$[@Ar$[@Ar$[[PV$[[PV$tDYq$tDYq
API String ID: 0-4000027297
Opcode ID: ae39f447f0d4ce71628b31e1f5dc983b01162ac437195a421be4307255823ca2
Instruction ID: 3976845d03887606f30b699428933fc9a00ef16a6c658f0ffb33c17f796ec726
Opcode Fuzzy Hash: ae39f447f0d4ce71628b31e1f5dc983b01162ac437195a421be4307255823ca2
Instruction Fuzzy Hash: EE12ABB48047819FD324AF39D296722BFB0AB12304F6446ADD4EA0F796D375940ACFD6

Function 004012D5 Relevance: 16.0, Strings: 12, Instructions: 987COMMON

Download Yara Rule

Strings

0, xrefs: 00402151
0000, xrefs: 004027B3
0000, xrefs: 004027AC
0000, xrefs: 004027C8
@, xrefs: 004029AF
0000, xrefs: 0040280E
i, xrefs: 00402A7E
0000, xrefs: 004027C1
0, xrefs: 004021FF
0, xrefs: 00402449
0000, xrefs: 004027A5
0000, xrefs: 004027BA

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: 0$0$0$0000$0000$0000$0000$0000$0000$0000$@$i
API String ID: 0-3385986306
Opcode ID: 193dcca42ce5b82e84e61127cc103a9640f48a3172cf1efa4fda8a059422e451
Instruction ID: bb11d2dfe3237e36cf5f3331cb6bc72618a1c068451a123b6a5a4c7d41c3a196
Opcode Fuzzy Hash: 193dcca42ce5b82e84e61127cc103a9640f48a3172cf1efa4fda8a059422e451
Instruction Fuzzy Hash: 4882D6756093418FC719CF28C69431ABBE1AB85304F18897EE8D6A73D1D3B8DD05CB8A

Function 00420C10 Relevance: 10.7, Strings: 8, Instructions: 695COMMON

Download Yara Rule

Strings

(w4q, xrefs: 004213A7
US, xrefs: 00421068
Q_, xrefs: 00421070
$%, xrefs: 0042125B
"Qo, xrefs: 00420E4B
'Y)W, xrefs: 00420E3B
Ug$a, xrefs: 00421387
ps, xrefs: 004213AF

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: "Qo$$%$'Y)W$(w4q$Ug$a$ps$Q_$US
API String ID: 0-1517657186
Opcode ID: db48c746725156d6f6a7437236bc49462d394272c498057fa7c81c489f4c8b4e
Instruction ID: e6373a85cb02f6e078bcc90773bb4296628cd5e45be5ea5545782c43d670e834
Opcode Fuzzy Hash: db48c746725156d6f6a7437236bc49462d394272c498057fa7c81c489f4c8b4e
Instruction Fuzzy Hash: B73200B1648350CBD710CF24E89166BBBF1EF96354F08892DF4C58B3A1E7789945CB8A

Function 0040F1A0 Relevance: 10.4, Strings: 8, Instructions: 449COMMON

Download Yara Rule

Strings

$Ph, xrefs: 0040F2F8
e{, xrefs: 0040F2A0
:P*>, xrefs: 0040F576
>, xrefs: 0040F416
#Ph, xrefs: 0040F341
y5, xrefs: 0040F2A8
9, xrefs: 0040F606
~}, xrefs: 0040F2B8

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: #Ph$$Ph$:P*>$>$e{$y5$~}$9
API String ID: 0-1947081359
Opcode ID: 40615cf9abfa25e582db7780deced612d13e263efce829548beaa8e35488073b
Instruction ID: ac3a32da69d80a167024953774dae0e943330d2acfc08ccbd3f545c58aef2271
Opcode Fuzzy Hash: 40615cf9abfa25e582db7780deced612d13e263efce829548beaa8e35488073b
Instruction Fuzzy Hash: 3CD12D726083914BD324CF29C89126BBBD2ABD5314F18C87EE4D59B791D73DC84E8B86

Function 004348D0 Relevance: 9.1, APIs: 6, Instructions: 127clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004348F2
GetWindowLongW.USER32 ref: 0043491D
GetClipboardData.USER32 ref: 0043492D
CloseClipboard.USER32 ref: 00434A51

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID:
API String ID: 1647500905-0
Opcode ID: 26b7884f557a2746f62ff004eabefa3d9931e2d1e0f7bf6fe7b69128ee335c58
Instruction ID: 1837353812a8e86b0fb0541b3a8676121ac9bf11c10da0ff377391a60270a56b
Opcode Fuzzy Hash: 26b7884f557a2746f62ff004eabefa3d9931e2d1e0f7bf6fe7b69128ee335c58
Instruction Fuzzy Hash: 1341B3B090C6819ED700AB78D44939EBFE0AF46304F04867AD4999B741D37DA558CBAB

Function 0042F5E8 Relevance: 9.1, Strings: 7, Instructions: 342COMMON

Download Yara Rule

Strings

W$XJ, xrefs: 0042F85A
BC@A, xrefs: 0042F960
tDYq, xrefs: 0042F959
(\QQ, xrefs: 0042F861
FB[\, xrefs: 0042F8F0
[[PV, xrefs: 0042F853
[@Ar, xrefs: 0042F8E9

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: (\QQ$BC@A$FB[\$W$XJ$[@Ar$[[PV$tDYq
API String ID: 0-980740811
Opcode ID: bfeace66cea1cacd67a85cfcda81f4497bbda8098cafef2ce8ed5ef24093d274
Instruction ID: 58e1d5ebe3e0694e966824a20c61b9600778cbd76c65da536945e0c1700d6978
Opcode Fuzzy Hash: bfeace66cea1cacd67a85cfcda81f4497bbda8098cafef2ce8ed5ef24093d274
Instruction Fuzzy Hash: 9FD14DB48047419FD320AF399286753BFB0AB12300F554AAED4EA4F7A6D374941ACBD7

Function 0041DBCE Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 337COMMON

Download Yara Rule

APIs

FindWindowExW.USER32(00000000,?,?,00000000), ref: 0041DCBB

Strings

, xrefs: 0041DF50, 0041DFE4
SQ, xrefs: 0041DC08
_], xrefs: 0041DBFD

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: FindWindow
String ID: SQ$_]$
API String ID: 134000473-3954728958
Opcode ID: 743aa98a36c98baba9afc72abf711ffcd9c01d3838119340ef49dc9bf45c721e
Instruction ID: d9e8bd2d8d317a42e5ec49ff7c452a2dcd6082122de2a4316046d7dd55c7460b
Opcode Fuzzy Hash: 743aa98a36c98baba9afc72abf711ffcd9c01d3838119340ef49dc9bf45c721e
Instruction Fuzzy Hash: 8EC125B9948311CFD3209F24D8817ABB7E1EF85315F04893DE4859B3A1D7789946CB4B

Function 00421D90 Relevance: 6.9, Strings: 5, Instructions: 638COMMON

Download Yara Rule

Strings

!3], xrefs: 00421EA7
, xrefs: 00421F97, 00422057, 00422197, 00422267
TI, xrefs: 00421DF7
, xrefs: 00421F3D, 00421F2D
CR, xrefs: 00421E0D

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: !3]$CR$TI$$
API String ID: 0-3212265549
Opcode ID: 8fccb5ed78a93f7a4e047e72b4a67e30eae647e4be54753b1ac114440c737d61
Instruction ID: 44386a42ef0423ad7510f9aa78bca2fc96bd53a98e6408decd68b6f70294129f
Opcode Fuzzy Hash: 8fccb5ed78a93f7a4e047e72b4a67e30eae647e4be54753b1ac114440c737d61
Instruction Fuzzy Hash: 5E221174708351ABD730DF11E941BABB7E2EBC8304F54882EE9899B390D7B89845CB56

Function 0041D68E Relevance: 5.5, Strings: 4, Instructions: 461COMMON

Download Yara Rule

Strings

, xrefs: 0041D988, 0041D872, 0041D7F2, 0041D762, 0041D6E1
, xrefs: 0041DAD2, 0041DB76
, xrefs: 0041D917
, xrefs: 0041DA30

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: InitializeThunk
String ID: $$$
API String ID: 2994545307-533796878
Opcode ID: 2a071475ffe3d5380dbb5278c2df51ed5b1a4397aa32772b2b9aae9ab646ffe7
Instruction ID: 6753a23fd6165b827f91bacd85881790e3aded2fd112e0ca8af2d8699be4416c
Opcode Fuzzy Hash: 2a071475ffe3d5380dbb5278c2df51ed5b1a4397aa32772b2b9aae9ab646ffe7
Instruction Fuzzy Hash: 9BD149B9A882008FC7249F14D491ABF7792FB8A310F64553DE0D253365C37CD946CB5A

Function 0040DE20 Relevance: 5.4, Strings: 4, Instructions: 415COMMON

Download Yara Rule

Strings

DC, xrefs: 0040E2CE
$, xrefs: 0040E00B
6910431D5D6F41B70608286674507D91, xrefs: 0040DEEE
(6+', xrefs: 0040DEE4, 0040DEF3

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: $$(6+'$6910431D5D6F41B70608286674507D91$DC
API String ID: 0-2263128210
Opcode ID: 4e4ee3513309a9faf15118a24aaf3dd1e549905e31e4cf6d1b50d257ba2e5d5d
Instruction ID: 770e4f6945f516a0339da7008f4fa6d40a0b561d67b226599b3cee5f38f4c038
Opcode Fuzzy Hash: 4e4ee3513309a9faf15118a24aaf3dd1e549905e31e4cf6d1b50d257ba2e5d5d
Instruction Fuzzy Hash: 95D114716083409FD310DF65C84579FBBE2EBC5318F188E2DE4D89B391D779890A8B86

Function 00435785 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 004357D0
GetSystemMetrics.USER32 ref: 004357DF

Strings

, xrefs: 004358B3

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: d68769d38832ff43a91d3f031e4e9622ed4c93283567f94ea7bf24aada394559
Instruction ID: e7b160778f9ec54d9b112390c7816de4f0c9d84f7e3a94cf802ef197df6bb8fa
Opcode Fuzzy Hash: d68769d38832ff43a91d3f031e4e9622ed4c93283567f94ea7bf24aada394559
Instruction Fuzzy Hash: DE5192B4E182089FDB40EFACD98569EBBF0BB48300F10856DE458E7350D734A945CF96

Function 004106BE Relevance: 5.2, Strings: 4, Instructions: 223COMMON

Download Yara Rule

Strings

;9, xrefs: 0041098D
-., xrefs: 00410A12
PY, xrefs: 00410A19
?=, xrefs: 00410994

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: -.$PY$;9$?=
API String ID: 0-2855059432
Opcode ID: a6f3e2ca6bfe04b43198fd0dcdb5daaed722b62a47790d91904bf4272bb981a0
Instruction ID: 51c57b6d0beb2fc3002ded6013571b0f71cc0e468458301d8937ef5e388f5b0c
Opcode Fuzzy Hash: a6f3e2ca6bfe04b43198fd0dcdb5daaed722b62a47790d91904bf4272bb981a0
Instruction Fuzzy Hash: DEC1DEB8501B40CFE3208F26859578BBBF1FB11604F109A0CE5EA1BB91C774A44ACF96

Function 00425D50 Relevance: 4.2, Strings: 3, Instructions: 432COMMON

Download Yara Rule

Strings

, xrefs: 004261AD
DC, xrefs: 00425D7A
bidh, xrefs: 00425D87

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: DC$bidh$
API String ID: 0-1136523539
Opcode ID: ddcb85b9b25ab2013000dd88c9709f243bd9e826e49d51198347e0a6a508ae26
Instruction ID: f2257167311730e06d814e7221e7553dbe4635024cb3ffaee04f698e1ed39a51
Opcode Fuzzy Hash: ddcb85b9b25ab2013000dd88c9709f243bd9e826e49d51198347e0a6a508ae26
Instruction Fuzzy Hash: 6DB15972A083208BD710DF14E88173B73A2EF95354F9A852DE8C59B381E379DD05879A

Function 00408890 Relevance: 4.1, Strings: 3, Instructions: 395COMMON

Download Yara Rule

Strings

), xrefs: 00408916
), xrefs: 0040890C
IEND, xrefs: 00408CF0

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 3ccf92ca3d1c6f40b8f70e1cbba77614f6c1119945a88c8342f75fd8a510d51d
Instruction ID: 6340cc1672e157917752c6dca66b5422701e69e0103ca7cf805f0ccfb7bbc76e
Opcode Fuzzy Hash: 3ccf92ca3d1c6f40b8f70e1cbba77614f6c1119945a88c8342f75fd8a510d51d
Instruction Fuzzy Hash: AAE1BDB1A087019BE310DF29D88171ABBE0BB94308F14463EE5D4AB3C2D779E915CBD6

Function 0043E100 Relevance: 3.1, Strings: 2, Instructions: 620COMMON

Download Yara Rule

Strings

f, xrefs: 0043E2D2
, xrefs: 0043E177, 0043E7D4, 0043E84A, 0043E3D7, 0043E340, 0043E372, 0043E376, 0043E84E

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: InitializeThunk
String ID: f$
API String ID: 2994545307-508322865
Opcode ID: a3a2cbc03b058b4af98d16b69d493af32376e3672f3202d064ff84bcb6e52f15
Instruction ID: e76ab74602f4687971b0939b18825c13b0cc92ac21aa0ac6b25134c02c101070
Opcode Fuzzy Hash: a3a2cbc03b058b4af98d16b69d493af32376e3672f3202d064ff84bcb6e52f15
Instruction Fuzzy Hash: 692203746093419FC714CF2AC890B2BBBE1BBC9314F189A2EF4A587391C738D805CB56

Function 0042FA6E Relevance: 3.1, Strings: 2, Instructions: 591COMMON

Download Yara Rule

Strings

V^^n, xrefs: 0042FF46
kWeo, xrefs: 0042FF54

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: V^^n$kWeo
API String ID: 0-2464879550
Opcode ID: 9a4f898dd24805e610d32d95ca686e7e7874f7c8016c21d5bad20c2c69c2dc23
Instruction ID: 6fa0a6f6551fff3048ddde94446ddbce8633058fccddcc1b1368fcefa3c6e798
Opcode Fuzzy Hash: 9a4f898dd24805e610d32d95ca686e7e7874f7c8016c21d5bad20c2c69c2dc23
Instruction Fuzzy Hash: 9DF134702047918BD7258F26D4A0733BBF1AF67304FA845AED4C78B792C779980ACB65

Function 004240E0 Relevance: 3.0, Strings: 2, Instructions: 505COMMON

Download Yara Rule

Strings

;:9, xrefs: 00424596
QFB, xrefs: 0042464B

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: QFB$;:9
API String ID: 0-2157042503
Opcode ID: 36253e0703ba9fe598bbba1bee51164e12056d2cfce67fedea1061751af68b03
Instruction ID: 40787000c266968bcd8442315732843066b36391672960b0a6f6844d46ab3f7a
Opcode Fuzzy Hash: 36253e0703ba9fe598bbba1bee51164e12056d2cfce67fedea1061751af68b03
Instruction Fuzzy Hash: C0D12FB16083208BC724DF25D85276BB7F1EFD2364F588A1CE8D58B390E7789801CB96

Function 0042B8A0 Relevance: 3.0, Strings: 2, Instructions: 471COMMON

Download Yara Rule

Strings

u|, xrefs: 0042BB21
@A, xrefs: 0042BD8E

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: @A$u|
API String ID: 0-1424213698
Opcode ID: 1f2ced1ed0f1ed9b1c4fb13284fb343f05fddca9131d1d74bd6d8213c8b59358
Instruction ID: 931048a4458d0abfbc295f3ead734b0802221035c34180ce1df8209221ff6df0
Opcode Fuzzy Hash: 1f2ced1ed0f1ed9b1c4fb13284fb343f05fddca9131d1d74bd6d8213c8b59358
Instruction Fuzzy Hash: 52E11E726083518FC324CF29D88179BB7E1FBC4304F154A2DE9959B391DBB89A06CBC6

Function 004226F0 Relevance: 2.9, Strings: 2, Instructions: 448COMMON

Download Yara Rule

Strings

d, xrefs: 0042293F
l, xrefs: 00422A03

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: d$l
API String ID: 0-91452987
Opcode ID: cfc013165ef0648a63da397ee148c5bfcab9e91ea3cce50d27f1fbe008c5977b
Instruction ID: d9f537cc18cb400ada0e1ca4c04407e36999ac958c652f7c4ddeca09d11a0f41
Opcode Fuzzy Hash: cfc013165ef0648a63da397ee148c5bfcab9e91ea3cce50d27f1fbe008c5977b
Instruction Fuzzy Hash: C8E13971608350ABE310DF21ED81BABBBE4EBD1314F04892EF8C957281E679DC158B97

Function 004292C0 Relevance: 2.9, Strings: 2, Instructions: 392COMMON

Download Yara Rule

Strings

, xrefs: 004295A5, 00429850, 004295C4, 00429854
, xrefs: 004297A4, 004297BE

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-1425349742
Opcode ID: bd454edc8cf098558b70c0e49182fa173854b92305fdd34751e44128b781663a
Instruction ID: e0a55b096aea4560b2d6f4186fcaba9e7fd148264441248b81668e098e370aca
Opcode Fuzzy Hash: bd454edc8cf098558b70c0e49182fa173854b92305fdd34751e44128b781663a
Instruction Fuzzy Hash: 3AD1E0B5608340DFE7249F24E881B6FB7F1FB86304F94492DE58587262DB38D905CB8A

Function 0042CC8A Relevance: 2.9, Strings: 2, Instructions: 386COMMON

Download Yara Rule

Strings

, xrefs: 0042CFC5, 0042CFE0, 0042D0BD, 0042D0C6, 0042D0EC, 0042CD44
zH}F, xrefs: 0042D068

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: zH}F$
API String ID: 0-987448492
Opcode ID: 1bdacec18f93a94b77de5c52221dc18fb1ca287a9f411cf4219dd7f7fcbaa4f1
Instruction ID: a7ed96e80fa597e803c9b787d5aac206f28a645af99075a1e5a7bf3ad89faf97
Opcode Fuzzy Hash: 1bdacec18f93a94b77de5c52221dc18fb1ca287a9f411cf4219dd7f7fcbaa4f1
Instruction Fuzzy Hash: 0EC14575608250CFD3048F24E89162FBBE2EF86318F584A7DF49997391D739DA05CB8A

Function 0043DD10 Relevance: 2.7, Strings: 2, Instructions: 202COMMON

Download Yara Rule

Strings

d, xrefs: 0043DDD5
0, xrefs: 0043DE6B

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: 0$d
API String ID: 0-1612544101
Opcode ID: 02af58cfd1b400e8f41eeff3eb34a08905940d030acf83bd4927b504d697c8ba
Instruction ID: ae5b4fcae11682e1a1d239a01d846dd17f598bd9ae64dc0cab92682f84a08f57
Opcode Fuzzy Hash: 02af58cfd1b400e8f41eeff3eb34a08905940d030acf83bd4927b504d697c8ba
Instruction Fuzzy Hash: B5719AB4A083009FD714CF14E49076BBBE6EF89304F24882EF9958B391C37AD845CB96

Function 0043D4D0 Relevance: 2.7, Strings: 2, Instructions: 177COMMON

Download Yara Rule

Strings

, xrefs: 0043D5B8
, xrefs: 0043D517

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: InitializeThunk
String ID: $
API String ID: 2994545307-1425349742
Opcode ID: 34e62cb45fe5b36b2b6f5c74e100c357ec8eefe135705cd1b4869fb971fe4574
Instruction ID: 672198a99c993db8873dc901af7382d056dc10dc2a456ed110ce13ebf6d51b6d
Opcode Fuzzy Hash: 34e62cb45fe5b36b2b6f5c74e100c357ec8eefe135705cd1b4869fb971fe4574
Instruction Fuzzy Hash: 6E419C71F046005FD7249F28E841B2B77A2EBCD718F39A43EE5955B312D138EC11875A

Function 0042F04C Relevance: 1.8, APIs: 1, Instructions: 265COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(B9CAA089), ref: 0042F326

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: f50d186f23bcb17534f085227635f0c3494dc82024b1910238da7a2875b6f59f
Instruction ID: fb468e960744d0964d6a54c24ab65e53c3f2cedaab5be564a2d607b693a7bda3
Opcode Fuzzy Hash: f50d186f23bcb17534f085227635f0c3494dc82024b1910238da7a2875b6f59f
Instruction Fuzzy Hash: 47914A34604741CBD3258F24D880763FBB2AF96314FA8867ED4960B3C2D77AE81AC795

Function 00425AF0 Relevance: 1.7, APIs: 1, Instructions: 241comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00446A60,00000000,00000001,00446A50), ref: 00425B19

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: d02935a03b72f4b9daf67ba47a6ae6e90e25aa44049c2513cd37ccf0cbe15a71
Instruction ID: 4be127970e74d3ba8cbdf26ebc5aee934b8144dff0c651ee01612779b641df8d
Opcode Fuzzy Hash: d02935a03b72f4b9daf67ba47a6ae6e90e25aa44049c2513cd37ccf0cbe15a71
Instruction Fuzzy Hash: E051BBB07047249BDB209B24EC96B7733A4EF82368F548559F985CB391F378E801C76A

Function 0042DBD0 Relevance: 1.7, Strings: 1, Instructions: 403COMMON

Download Yara Rule

Strings

", xrefs: 0042DEFF

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 4fcae840f10020b6eb056c7bbf700c9250a17545a0d18b781a1dd7076018ac5b
Instruction ID: dd14d937a97cefaf8bffdfa9403b6e9a7d8b00ff17e57d5e12b70809dd5c9411
Opcode Fuzzy Hash: 4fcae840f10020b6eb056c7bbf700c9250a17545a0d18b781a1dd7076018ac5b
Instruction Fuzzy Hash: 54C14871F083209FD724CE25E48076BB7E5AB94310FA9852FE4958B382E778DC45C78A

Function 0042BF7F Relevance: 1.6, Strings: 1, Instructions: 375COMMON

Download Yara Rule

Strings

--%(, xrefs: 0042C209

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: --%(
API String ID: 0-2664367441
Opcode ID: 988560fdc17f744206da9937a4aec0366f3267a55da167e509994a1b18515a03
Instruction ID: d88aec2eb7fe39cc1b7b47485eaa87fa011e6ba56b41b500a549fcdf20a5733a
Opcode Fuzzy Hash: 988560fdc17f744206da9937a4aec0366f3267a55da167e509994a1b18515a03
Instruction Fuzzy Hash: 8CD145B190C3A08FC714DF65D49166FFBE1AF92308F44896EE4D947282D778D909CB8A

Function 00429C80 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

, xrefs: 00429CA5, 00429CB6, 00429D34, 00429D44

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-3019521637
Opcode ID: a62f12c785040157e8b7fec30024f87e97063765c70b64fc9a21fdd16a94ed29
Instruction ID: 6370a15c0eadb2c0176990f0375590d17bd257baa0dd12198a9f28dd6846b8a9
Opcode Fuzzy Hash: a62f12c785040157e8b7fec30024f87e97063765c70b64fc9a21fdd16a94ed29
Instruction Fuzzy Hash: DE6139B5B043105BD720AF25F88173777D5EB95718F98843EE98187382E278DC05D35A

Function 0042E080 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0042E27E

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: c601073c496ea05fc122c30db4d8fae994325c58c904d4ae809ad3c14beac2ae
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: 5F711B31B083358BD714CE2ED44072FB7D2ABC5710F99896FE49497391D278DC45878A

Function 0042BCB0 Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

@A, xrefs: 0042BD8E

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: @A
API String ID: 0-2960862460
Opcode ID: 853bf25300ffd70dd1672832c4ab5f789289b0aa41f718e29d3b2827d7af40b0
Instruction ID: 4719d8b980e654881bd5ae54f2d4b62ca754f3e150f2326b80e933f85abe6e03
Opcode Fuzzy Hash: 853bf25300ffd70dd1672832c4ab5f789289b0aa41f718e29d3b2827d7af40b0
Instruction Fuzzy Hash: 6A51EF726043118BD314CF29E8527AAB3F1FF81314F19492DEA958B3A1E778D941CB8A

Function 0043DFA0 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

uxVd, xrefs: 0043E0C0

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: uxVd
API String ID: 0-2172250569
Opcode ID: 1b8588ce542fe38f60b518b41e37844cfaec0c15d9904e6db533feca748b9241
Instruction ID: cfe32196f296b3655a051a700cb7ccaf60a1c3d8bf43f6ddb438b1d264a746a2
Opcode Fuzzy Hash: 1b8588ce542fe38f60b518b41e37844cfaec0c15d9904e6db533feca748b9241
Instruction Fuzzy Hash: BF414635605210EBDB259F16DC40B6BB7B6EB8C300F14982EF99547391C3BADC11CB5A

Function 00443FC0 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

@, xrefs: 00444028

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: b5dc717f0fbba509c6785d93897d05ffe255b17a6a7ee23cbca4033ae7c97cc9
Instruction ID: 8a1cbf2da3cce85e16e5ddc7bff621da34532a0a9f7602195c82e4c827d3f028
Opcode Fuzzy Hash: b5dc717f0fbba509c6785d93897d05ffe255b17a6a7ee23cbca4033ae7c97cc9
Instruction Fuzzy Hash: 1E3124711483048BE314DF58C88176BBBF4EBC9328F28892DEA9587351D37999188B6A

Function 0042D13C Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

, xrefs: 0042D155, 0042D1D5, 0042D1F0, 0042D170

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-3019521637
Opcode ID: 75d1dea9b8ae6d3d52cd8fab9c8ed0d56aa657e303dc28c0bb7e37ecd5b2999d
Instruction ID: 003cd98cb6478ae5473ed13b07942baf67a07c151dbbb83d673c0b07066971a1
Opcode Fuzzy Hash: 75d1dea9b8ae6d3d52cd8fab9c8ed0d56aa657e303dc28c0bb7e37ecd5b2999d
Instruction Fuzzy Hash: 0D21F875B08210DBE7188B14B59163B73A2BF5A704FB8153EE44227712C729DC26CA9E

Function 0042B76F Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

, xrefs: 0042B795, 0042B7B0

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: fce78583beccccb18dcbe4383cf36ed0bca4275cc3974188bb6dc5112421aeef
Instruction ID: 1bc23dd65da3dd8c740786462998b77e799f5a1b88ee2868af09e1f3cb0ee478
Opcode Fuzzy Hash: fce78583beccccb18dcbe4383cf36ed0bca4275cc3974188bb6dc5112421aeef
Instruction Fuzzy Hash: 1901DF797086608BD7289F08A45063BB3A6FBCA704FA4563ED58127612C339EC11CBDE

Function 0041DED1 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

, xrefs: 0041DF50

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-3019521637
Opcode ID: be7a76aebc2ca3cfc71e5c82a45ba6aa8e370cf5ff2fb2360d4394e444ec2ccd
Instruction ID: 0a034f5f1663caace4a6bb9a836a32d191f2d6f5481833966dd2236e8cf04307
Opcode Fuzzy Hash: be7a76aebc2ca3cfc71e5c82a45ba6aa8e370cf5ff2fb2360d4394e444ec2ccd
Instruction Fuzzy Hash: 2D1159B0E447108FD3249B1888805B7B7A2E796315FA4642DF1C3D7265D228D993C70A

Function 0042B2AA Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

, xrefs: 0042B2C5, 0042B2E0

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 4ef03bff933ae179d6d4d0a0667eebb199f2544cf3e0b41afaa997531e0d8d6b
Instruction ID: be3b5f2746f02530deb5feb29746b47a25c0387c6939b62836406c7d2f1bb1bc
Opcode Fuzzy Hash: 4ef03bff933ae179d6d4d0a0667eebb199f2544cf3e0b41afaa997531e0d8d6b
Instruction Fuzzy Hash: B2017C79708620DBD7189B10E45053FB7A2FBDA314FA59A2DE88123612C338EC02C7D9

Function 0042C5B6 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

, xrefs: 0042C5D5, 0042C5F4

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: d897d307f14a83324b55d38241cd95c5d1d7233cd29fcd26d955bab2ca7c9954
Instruction ID: c5db213e68517389fa1bacc7fe02f2657e0d406accfa76c5e8c5ae6cafa21dbc
Opcode Fuzzy Hash: d897d307f14a83324b55d38241cd95c5d1d7233cd29fcd26d955bab2ca7c9954
Instruction Fuzzy Hash: 7401D676608710DBD7059F04A4D153FB3A2FB85304F64292DE99113312C375EC21CBCA

Function 004411C0 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

SM, xrefs: 004411CF

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: SM
API String ID: 0-1979282939
Opcode ID: 453dd9c33fd62f94cf89f3633494ef655db85fd5194a2ccd465a6e066069d6d9
Instruction ID: 686e4e71a5838c5623eca8c372c09e40d61c3fe1fb4bf8d66c1442654bdc4e02
Opcode Fuzzy Hash: 453dd9c33fd62f94cf89f3633494ef655db85fd5194a2ccd465a6e066069d6d9
Instruction Fuzzy Hash: 5E014933E59361A7E7084B764C4602BB5B7ABD5308F1BD03ED99C97E94D83CC8418781

Function 0041D44C Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

, xrefs: 0041D487

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-3019521637
Opcode ID: 0573dd715991369cdd1f280fb759e34388a203f8046d75158a62b467908f8789
Instruction ID: 6775068db407afbd029485dd67f48e92e12a705e0908efcb34529f614b8733f4
Opcode Fuzzy Hash: 0573dd715991369cdd1f280fb759e34388a203f8046d75158a62b467908f8789
Instruction Fuzzy Hash: 5A019CB4A406415BEB359B14CC51BBB73E1DB85315F64443DF6C393295C678A841CB0A

Function 0040EB29 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

marshal-zhukov.com, xrefs: 0040EB2E

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID: marshal-zhukov.com
API String ID: 0-4220902806
Opcode ID: 35afdaf516eea33ce03e6513eaf148aaf0eae721f362cd89d6e775b2e3548cf2
Instruction ID: 99b9a3520732db4a189a64fdaa69584b650ab3ad65be4d7a7ec9059ec022e64d
Opcode Fuzzy Hash: 35afdaf516eea33ce03e6513eaf148aaf0eae721f362cd89d6e775b2e3548cf2
Instruction Fuzzy Hash: 20E0867854520086C314DF15C9627B373B1FF67345F04286AE583A7790E378D900C70E

Function 0040C150 Relevance: .8, Instructions: 775COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e92d9e2089b5f81b34984f0e7f9c4b9ef9ccf47d19e4db63930f3c2caffc988a
Instruction ID: 3aa304a7d0fa500fc6045f644cc37729666229ce156517ad1b57301595ece370
Opcode Fuzzy Hash: e92d9e2089b5f81b34984f0e7f9c4b9ef9ccf47d19e4db63930f3c2caffc988a
Instruction Fuzzy Hash: DD42A172608712CBC724DF19C8C066AB3E1FFD5315F198A3ED985A73C5D738A8518B8A

Function 00430698 Relevance: .5, Instructions: 528COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2845f90b0f95c747a555fa5bf8a918051d1958b0d98236403ea50b6d7d56deda
Instruction ID: 1777e68b7d91d386861c3b6715b6e2e1425b0655a589d629913e829c29501dd8
Opcode Fuzzy Hash: 2845f90b0f95c747a555fa5bf8a918051d1958b0d98236403ea50b6d7d56deda
Instruction Fuzzy Hash: E3F1E5351047418FE729CF29C4A0762BBE2AFAA314F19D69DC4D64F793C739A806CB64

Function 00430C1E Relevance: .5, Instructions: 517COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4efca549c26abc44cea81274d44c2d83f50ace1a55e197e4540ed3a8f98eb8eb
Instruction ID: 79ef2ac2ab079c9716288af27d722cb335b435f82c8a601f77b53c19c6a9811e
Opcode Fuzzy Hash: 4efca549c26abc44cea81274d44c2d83f50ace1a55e197e4540ed3a8f98eb8eb
Instruction Fuzzy Hash: 6FF1C3702047818FE729CF25C4A0762BBE2EF5A304F18D59ED4D68F796C639E806CB65

Function 0040A5D0 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a1bde69dad0bb83ce981db007d88c7df5383efd9b8352ab850b70e9fafa4c5f
Instruction ID: 4c7b76722d64659d1048aeec527b08ff0f6b3b14b1c8534bef11c1cb48b09bf1
Opcode Fuzzy Hash: 1a1bde69dad0bb83ce981db007d88c7df5383efd9b8352ab850b70e9fafa4c5f
Instruction Fuzzy Hash: A9F1CE356087418FC724CF29C88166BFBE2AFD9304F08892DE4D987791E679E815CB56

Function 00441322 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e0cf6ceb5c9cf3f6408161c8e4c2c883fb952aeb6c5033a0ef318948abf4994
Instruction ID: 4ab0ddeb53594f42122f396bed1e7cc8276a244e5ca2720b1984a3d426efef0d
Opcode Fuzzy Hash: 2e0cf6ceb5c9cf3f6408161c8e4c2c883fb952aeb6c5033a0ef318948abf4994
Instruction Fuzzy Hash: DAD1363A60C341CFD718CF39D89012AB7E2BB8A315F59467DD8A2873A2D735E945CB44

Function 00441A90 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c701a98d002c9dbb6c9a59e0476d63c917ac8eae1dadfe1b5f7b4c759653338d
Instruction ID: a61c44c01c9a0434f13fc9c78c48c3f9d4e48d367aadd388ca72e3039ceefae1
Opcode Fuzzy Hash: c701a98d002c9dbb6c9a59e0476d63c917ac8eae1dadfe1b5f7b4c759653338d
Instruction Fuzzy Hash: C6A18E36A043109BE724DF28CC817ABB7D1EB89304F54893EF995D73A1EA34AC41C75A

Function 00444930 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b0ff7d083fc6f99a0781a80b03fcaa9ba85323ce8c2922655b4ffd266a37a9a9
Instruction ID: 589add2fa41e31c9997d06b46da1bb0001926bf99ec90e931a762477534cca45
Opcode Fuzzy Hash: b0ff7d083fc6f99a0781a80b03fcaa9ba85323ce8c2922655b4ffd266a37a9a9
Instruction Fuzzy Hash: A5813672B083514BE724CE28DC80B2BB7E2EBC9314F19892DE995973A1E734EC01C795

Function 0043E8B0 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 015b18410103d42386a69cc8c64fbfd32ebe4fb51cfb67af8722f38daa065ad2
Instruction ID: 1b48f47e0eab76b7d8bc870642a400784874d071703526f9b2e8ccaa7b962a57
Opcode Fuzzy Hash: 015b18410103d42386a69cc8c64fbfd32ebe4fb51cfb67af8722f38daa065ad2
Instruction Fuzzy Hash: 80A1177060D3928FC315CF2AC4D062AFBE2AFD9314F1986AEE4E54B392C635D805CB56

Function 0041EB05 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c109c4271a62ad69e9fa0db3bdc99f00f5ac8d887c75a014c68c9c01d7bcbd10
Instruction ID: 021ac32237e3de101d5eaed90d65682ef050e0b34237964dbfa914d8232d51c5
Opcode Fuzzy Hash: c109c4271a62ad69e9fa0db3bdc99f00f5ac8d887c75a014c68c9c01d7bcbd10
Instruction Fuzzy Hash: 7A8146B9608301CFC714CF25D8526ABB7E1EF95354F04892DF89A87392E738E885CB56

Function 004440F0 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a83c1ef261f37a1dc15fb6e6cd1ca9af2119ab112a38c06ca8dbf84291098b1c
Instruction ID: 13c2b204bf09f3f92fe5bc76204d053a7afa86719872a2d14acb09db6cc85df8
Opcode Fuzzy Hash: a83c1ef261f37a1dc15fb6e6cd1ca9af2119ab112a38c06ca8dbf84291098b1c
Instruction Fuzzy Hash: 04614531A083119BE7249F58C84076BB7E2EFD8750F29C53DE98547361EA79DC50C789

Function 0040D830 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f19c1671aec1f889b41fd3618f042ef459f59e6baa6d344aa8703376dfc3fde
Instruction ID: a04cf31874ae338892e57a4df6820a8180589f41023e9d8b723c52286c29b4d3
Opcode Fuzzy Hash: 0f19c1671aec1f889b41fd3618f042ef459f59e6baa6d344aa8703376dfc3fde
Instruction Fuzzy Hash: 4051B57160C3828FD7118F69C59076BFFE1AF92344F1849AEE4D19B382C379850ACB66

Function 0043EC20 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7bafa08bad9d9116c1c63dd45c09b455ebe49ae71fa4bcc4cefa4c31ac6c4f4e
Instruction ID: df868054e21979bf635f59e1e6354e638118bae598b796eed872d70c115fc362
Opcode Fuzzy Hash: 7bafa08bad9d9116c1c63dd45c09b455ebe49ae71fa4bcc4cefa4c31ac6c4f4e
Instruction Fuzzy Hash: 5D5105346493025BC724DF26C880B2BB7E2ABCD314F28A92EF4D5973D5C278DC06874A

Function 004124A9 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347e5f27b1a7e8abec28799ae86e1cdc461b99de390a6d701bbfa8810c8ef1f2
Instruction ID: 457cece9f224bafde436ee95a900d670ea02eebb2a5a69afb31b57df2a3af6bc
Opcode Fuzzy Hash: 347e5f27b1a7e8abec28799ae86e1cdc461b99de390a6d701bbfa8810c8ef1f2
Instruction Fuzzy Hash: 82512B35108240FBD72C9B14D6A16BF7352FB95308F64843EE44653292C7BADCA7CB5A

Function 00405D50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b29dea5a8f183d8acf94dfcedb2c9a8392c00d7f53bab5646fb8eae0639cdb75
Instruction ID: 4ad7e9ecd07623892f8382a6ce56f0e25be950db3abcc79367a2b1ca5eabb2fb
Opcode Fuzzy Hash: b29dea5a8f183d8acf94dfcedb2c9a8392c00d7f53bab5646fb8eae0639cdb75
Instruction Fuzzy Hash: 7F51D070A046019FD714DF14C480927B7A1FF85328F15867EE899AB392DA38EC42CF9A

Function 0043DB10 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e61ffab149f65f2a36282800bf19c731ff7051e50c0c7c81f964f59a71d42744
Instruction ID: baf6374348c6a5d04551104ff014b430a12857dff9407b71573024f7f8b341f0
Opcode Fuzzy Hash: e61ffab149f65f2a36282800bf19c731ff7051e50c0c7c81f964f59a71d42744
Instruction Fuzzy Hash: E9412734E482005BD7219F14F880B6BB7E6EB8D304F24A92EE4C597316C3B9ED41C75A

Function 0043D6C0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62a481f38d6e3f7fb9cc860d6b47c7c8c03f983ebc683065253a008ccc13cf74
Instruction ID: 2e2f1a4e6b9348aa9e644b890a2fd66f03e9966b682800d659288625f5a63310
Opcode Fuzzy Hash: 62a481f38d6e3f7fb9cc860d6b47c7c8c03f983ebc683065253a008ccc13cf74
Instruction Fuzzy Hash: F43132759083108FD320DF14E480B2BBBE5EBC9354F14992EE8C59B351D3798D4ACB9A

Function 00404CB0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11143ed903d55c081b29aa8ddac220b818a8c328501f0edc796692383fc751be
Instruction ID: 9ca7f75b23475dbba00361bcd5267fab3e01802d4fe443a195772d7f3664adee
Opcode Fuzzy Hash: 11143ed903d55c081b29aa8ddac220b818a8c328501f0edc796692383fc751be
Instruction Fuzzy Hash: C331BBB16082009BD7149F19D880A2BB7E1EFC4359F14493EE999E73D5D339EC42CB4A

Function 0042C442 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 551a38319bcb747577a76c629d3bf974cc28e0aa052f2066d3922482742d8ba9
Instruction ID: 686adc304c1ae320e0c6daf4f9fc5568531569f3015bb1f80b8446df69a0c773
Opcode Fuzzy Hash: 551a38319bcb747577a76c629d3bf974cc28e0aa052f2066d3922482742d8ba9
Instruction Fuzzy Hash: 5731CD75908311CFC3008F28D85126BB7F1EFC6385F058999E8D06B3A0E378E984CB8A

Function 004374E0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 5ffa12840469dc731bcb426f7cb35325ba097447bf8290b576edb3a554fe3c13
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: DD112973A091D40EC32A8D3C8440665BFA34A97634F5953DAF4F89B3D2D626CD8A8359

Function 0042D590 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c2f32ce9bc383ba00d7ed0832d78b484c6060efe00dad96bb9a55ecadd4a8a1
Instruction ID: 47bf9c085548fa84875d00c3c5d65b3e1f87cf2bd146b3f1374b63a54812abd8
Opcode Fuzzy Hash: 3c2f32ce9bc383ba00d7ed0832d78b484c6060efe00dad96bb9a55ecadd4a8a1
Instruction Fuzzy Hash: 8D019EB1F00311A7D620AF19B4C1727B2A86F8570CF58053EE8089B342EBF9EC4486AD

Function 0043D820 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 26ca6e44b68741cae2ba47c105817e80baac913b7d3d3ea5de346e01ce13634b
Instruction ID: 6fd8ed32c65a67e545e30c222b7712cd34344acc3dbbb54f6c8140322037564e
Opcode Fuzzy Hash: 26ca6e44b68741cae2ba47c105817e80baac913b7d3d3ea5de346e01ce13634b
Instruction Fuzzy Hash: BF014935F441040BD7257A15B88067B7766EFCA364F29A43AE0D44731AC279AC128365

Function 0043BEE0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: b7fec47195b87a2ccdeee0d802a3b4902b2ff3332171a4b6b0f7a9ed850d631d
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 88D05B61508661469B648D1D9401577F7F0E9C7711F45655FF781D3254D334DC41C1AD

Function 0041E0F7 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 84windowCOMMON

Download Yara Rule

APIs

FindWindowExW.USER32(00000000,?,?,00000000), ref: 0041E1D4
IsWindowEnabled.USER32(00000000), ref: 0041E1EF
IsWindowVisible.USER32(?), ref: 0041E204

Strings

w, xrefs: 0041E10D
fw, xrefs: 0041E102
TEk, xrefs: 0041E174

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: Window$EnabledFindVisible
String ID: TEk$fw$w
API String ID: 18089171-1650657573
Opcode ID: 802ddc08e65f075a8e6804e72eef4bc9b66d4397e9fbd3a9e5a186ac1f9e9fb1
Instruction ID: 42b8097cafa45b3ab70ac05e9a44b887173912cb8e5f825cefcdd8df64589f78
Opcode Fuzzy Hash: 802ddc08e65f075a8e6804e72eef4bc9b66d4397e9fbd3a9e5a186ac1f9e9fb1
Instruction Fuzzy Hash: CB31F1B995C751DFD3348F24D8507EFB7E4EB8A305F05893CD9899B260DB3488918B86

Function 00434EF5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00434F2F
GetSystemMetrics.USER32 ref: 00434F3E

Strings

, xrefs: 00434FE9

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: adefc81e243a333a41284b0ce5c5cd4c262681601008b0a0876e86edf09e69f1
Instruction ID: 444d623a228d729f7ebde6f46af1a76120007dc39f6511e19822679111f862eb
Opcode Fuzzy Hash: adefc81e243a333a41284b0ce5c5cd4c262681601008b0a0876e86edf09e69f1
Instruction Fuzzy Hash: FB318FB4918304DFDB00EF68D985A5EBBF0BB89304F01896DE488DB360D770A949CF96

Function 00431B45 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00431B52
VariantInit.OLEAUT32 ref: 00431B5E

Strings

^, xrefs: 00431B45

Memory Dump Source

Source File: 00000003.00000002.1612877242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ngentask.jbxd

Similarity

API ID: Variant$ClearInit
String ID: ^
API String ID: 2610073882-1590793086
Opcode ID: 444702d241a70ce79c783c97807d7e1c73b1ab4471c9fa6b073bd9deb887ac46
Instruction ID: c71001e4ab46b3d10acf56b45298640c99e2cfb66b3cac6edeaa9ee220a5b3da
Opcode Fuzzy Hash: 444702d241a70ce79c783c97807d7e1c73b1ab4471c9fa6b073bd9deb887ac46
Instruction Fuzzy Hash: 2131F760108BC29ED312CB3C8448619FFA17B56224F08879CD5F94BBD2D379A56AC7A2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ceFgl3jkkk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI8242\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI8242\_asyncio.pyd

C:\Users\user\AppData\Local\Temp\_MEI8242\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI8242\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI8242\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI8242\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI8242\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI8242\_multiprocessing.pyd

C:\Users\user\AppData\Local\Temp\_MEI8242\_overlapped.pyd

C:\Users\user\AppData\Local\Temp\_MEI8242\_queue.pyd

C:\Users\user\AppData\Local\Temp\_MEI8242\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI8242\_ssl.pyd

C:\Users\user\AppData\Local\Temp\_MEI8242\_uuid.pyd

C:\Users\user\AppData\Local\Temp\_MEI8242\base_library.zip

C:\Users\user\AppData\Local\Temp\_MEI8242\libcrypto-1_1.dll

Windows Analysis Report
ceFgl3jkkk.exe

Function 00F6D933 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167
timeCOMMON

Function 00F603E2 Relevance: 6.2, APIs: 4, Instructions: 194
fileCOMMON

Function 00F51740 Relevance: 21.2, APIs: 2, Strings: 10, Instructions: 194
COMMON

Function 00F51420 Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 170
COMMON

Function 00F56830 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 106
COMMON

Function 00F644F5 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301
COMMONLIBRARYCODE

Function 00F6E4D6 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Function 00F6D692 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 330
timeCOMMON

Function 00F51040 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 155
COMMON

Function 00F560F0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 100
processsynchronizationCOMMON

Function 00F670E9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE